Privacy Policy

Who is responsible for your data

Covalence is operated by Rémi Al Ajroudi. The operator is the controller for website, account, contact and service administration data. The Contact section and Legal Notice provide the operator’s address and contact details.

Business customers determine the purposes for processing personal data in their documents, communications and interview evidence. Covalence processes that content on their documented instructions, under the data processing agreement for the engagement. Customers provide the information and permissions appropriate to the people whose data they share.

Information we process

Account and contact information includes work email addresses, account identifiers, authentication details, support correspondence, organization, role and billing details where relevant. Work email and authentication details provide the information required to create and access an account.

Connected services and uploaded files provide documents, messages, recordings, transcripts, project items, source identifiers and connection credentials. The content available to Covalence depends on the services you connect, the files you upload and the permissions granted to each connection.

External organization analysis uses professional information from public sources and licensed providers such as Crustdata. This can include names, roles, employment history, professional locations, profile links and photographs. These sources support the organization analysis requested by the customer.

Interview information includes participant identity and role, invitations, session details, consent choices, responses, transcripts, summaries and cited evidence. Voice interviews process audio through the selected voice provider and store participant audio segments. Avatar providers supply the selected interview presentation.

Corrections and preferences include the submitted instruction, the account and project concerned, and the submission time. The correction form offers Memory to apply a preference in future work. Retiring a preference ends its future application while preserving its history.

Operational information includes error categories, stack traces, routes, software versions, timings and pseudonymous account, project, request and workflow identifiers. Hosting and security providers also process connection and access logs. Cookie-based usage measurements are described in Cookies and similar technologies below.

How we use information and the legal bases

Account administration, access, support and service communications help us provide Covalence and manage customer relationships. Where applicable, these activities rely on performance of a contract or steps requested before a contract. For a business customer’s employees and representatives, our legitimate interest is administering that business relationship.

Security, fraud prevention and service reliability rely on our legitimate interests in protecting users and operating a dependable service. Records required for legal, accounting or regulatory purposes are processed on the basis of the applicable legal obligation.

Customer content supports the requested business analysis, source-linked findings, project records, review workflows and connected features. The customer establishes the lawful basis for this processing and supplies the relevant instructions. AI providers receive the excerpts, prompts, responses or audio required for the selected feature, subject to the engagement and provider terms.

Website and product measurements through PostHog rely on your consent. These measurements help us understand visits, navigation and feature use. You control this processing through Cookies and may withdraw consent at any time. Withdrawal takes effect for future collection; processing carried out under your earlier consent retains its legal basis.

Covalence provides analysis and proposed actions for business users. Responsible people and customer processes determine how to apply those results, including decisions concerning employment, legal rights or comparable matters.

Interviews and participant choices

For interviews, the inviting customer is the controller and Covalence is its processor. The customer relies on its legitimate interest in assessing and planning the integration (GDPR Art. 6(1)(f)). The interview notice names that customer; after closing, it also names the company being integrated.

Your name, role and answers are shared with the customer’s deal team and the advisers it authorizes. We received your name, work email and role from that customer. When you join through a shared interview link, you give your name and role yourself.

Voice interviews display an AI and recording notice, and the interviewer explains the recording at the start. Covalence records how a voice interview opened: by itself under that notice, or after a choice. Opening the interview, or leaving the page without speaking, is never recorded as having read the notice. After an automatic opening, when the participant speaks after the interviewer’s opening, Covalence records that the participant continued and confirmed having read the notice. Responses become evidence for the customer’s review. A text interview begins after an affirmative choice. Covalence does not use interview recordings to train AI models.

Taking part is voluntary. Participants can decline, skip a question, stop an interview, or use Decline during the session. Decline stops the session, deletes its stored audio and withdraws its answers from use. The notice tells participants that their answers are shared with the deal team under their name; written questionnaires are also answered under the participant’s name.

You may object at any time to this use of your answers. Send the objection to the inviting organization, or to Covalence at the contact address below; Covalence passes it to the customer and applies its instructions.

Service providers and disclosures

We share information with the providers that support the features you use. Their roles include hosting, authentication, storage, AI processing, interview media, professional information, transactional email and diagnostics. The list below identifies providers used by the Service and their respective purposes.

Professional advisers may receive information needed for their work. Disclosures also support applicable legal requirements and the protection of rights and security. Connected source systems process information under their own terms. A future change of operator will be reflected in updated legal information and the relevant contractual arrangements.

• Vercel: Website hosting, application runtime and operational logs.
• Supabase: Database, authentication and file storage.
• OpenAI: AI analysis and, for voice interviews, audio processing and transcription.
• Tavus: Avatar rendering when Tavus interviews are enabled.
• Daily: Media transport for Tavus avatar interviews.
• Anam: Avatar rendering when Anam interviews are enabled.
• Crustdata: Professional company and people data when external organization analysis is enabled.
• Hyperbrowser: Hosted browsing of authorized professional sources when the cloud browser is selected.
• Resend: Transactional service emails when enabled.
• Sentry: Error monitoring and tracing when diagnostics are enabled.
• PostHog: Consent-based website and product measurements; homepage heatmaps and masked session recordings.

Storage and security

We use encrypted transport and access controls to protect service information and manage access for authorized users. Connected-tool credentials are encrypted at the application layer with AES-256-GCM before storage. Contact us at the address below to report a security concern.

International processing

Service providers process information in the locations associated with their infrastructure and the customer’s configuration, which can include the United States and other countries. The current PostHog project uses its European region.

Where international transfer rules apply, the relevant engagement must establish the appropriate transfer safeguards before the transfer. Contact us for the locations and safeguards applicable to your engagement, and for information about obtaining a copy of the relevant arrangements.

How long we retain information

We retain account information for the account relationship and for the periods needed to administer the service, resolve requests and meet applicable legal obligations. The purpose, type of information, customer agreement and applicable retention duties determine the period for each record.

Customer project records include uploaded or connected source copies, transcripts, cited evidence, correction history, derived analysis and saved preferences. Their retention follows the customer’s instructions, the engagement and applicable legal obligations. Source disconnection ends future access; deletion requests address the records already held in Covalence.

Stored voice audio has a configured expiry of 18 months after recording, with earlier deletion where required or when a participant declines during the interview. Each session records its expiry. Transcripts and cited answers have no fixed expiry: they are kept with the customer’s project and deleted when that project or the customer account is deleted. The selected voice and media providers apply the retention arrangements for those services.

Cookie choices and browser identifiers have a six-month browser lifetime. Account-level cookie preferences are renewed after a fresh choice and remain valid for six months. Usage events are kept for longitudinal service-use analysis under our analytics project’s lifecycle and the retention terms of its PostHog plan, subject to applicable deletion requests. Homepage session recordings have a 30-day retention period.

Deletion requests cover the applicable active records, source copies, exports, audio, cached avatars, derived analysis and preferences. We verify the requester’s authority and identify records subject to a legal retention requirement or another customer’s instructions. Backups and provider logs expire under their configured schedules. Approved deletion instructions are reapplied following a backup restoration.

Your rights and how to use them

Applicable law may give you rights to access, correct, erase, restrict or receive a portable copy of your personal data. You may object to processing based on legitimate interests and withdraw consent-based processing. You may also lodge a complaint with the relevant supervisory authority, including the CNIL in France where applicable.

Send requests to the contact address below. Where the GDPR applies, we respond within one month; complex requests may qualify for an extension, explained within that first month. Identity and authority checks are proportionate to the request. Other applicable deadlines and legal exceptions govern requests covered by other laws.

For information controlled by a business customer, contact that organization as well. Covalence assists the responsible customer with the request and applies its instructions to the relevant records.

Cookies and similar technologies

Covalence uses strictly necessary service cookies for sign-in and to remember choices, and local storage for interface preferences such as the selected theme. These are always active. The cookie banner separately asks for consent to Performance cookies, which are PostHog measurements. Accept All Cookies gives that consent in one step. In most regions, including the European Union, the European Economic Area, the United Kingdom, Switzerland, Brazil and Quebec, the banner also offers Continue without accepting, which refuses in one step. A strictly necessary cookie records which banner applies, based on the country or province derived from your IP address by our hosting provider; it stores no other location detail and lasts one day. Manage my preferences opens the Privacy Preference Center, where Performance cookies stay inactive until you switch them on, and Save my preferences records the choice. Until you choose, no Performance cookie is set and no measurement is collected. Access to the website and application is available under either choice. After a choice, the banner closes. Cookie preferences, in the website footer and in the application’s Settings, reopens the Privacy Preference Center to change the choice at any time.

With consent, PostHog measures website visits, referral categories, approximate countries inferred from IP addresses, scroll depth, demo-button clicks and confirmed demo submissions. On the public homepage, heatmaps and session recordings capture page interactions to help us improve navigation. In the application, measurements cover approved action names, generalized page categories and a pseudonymous account identifier. Session recordings represent the public page with masked form elements.

Before sign-in, the browser’s cookie remembers the website choice. Signed-in users make a separate choice covering devices and browsers where they sign in. Signed-in acceptance, refusal and withdrawal have the same account scope. The browser’s signed-out choice is preserved. A browser refusal takes precedence when choices are initially reconciled; the Privacy Preference Center explains a conflict and provides controls to update the signed-in choice.

Account choices are checked at sign-in, page load, when returning to the app, and every minute while a signed-in tab is visible. A fresh signed-in choice establishes or renews permission for collection across signed-in devices. Synchronization uses the authenticated account rather than an IP address. The Privacy Preference Center reports a synchronization issue and provides Retry sync.

Our tracking controls apply your saved choice and the browser’s Global Privacy Control signal. A Global Privacy Control signal sets PostHog collection to declined. The same saved-choice and Global Privacy Control rules apply to browsers sending a Do Not Track signal. PostHog receives information for the Covalence measurements described here.

Professional use and customer instructions

Covalence is designed for adult business users. Customer instructions, authorizations and contractual safeguards govern the personal data provided for an engagement, including any information requiring additional legal protection. Contact us about information that requires correction, restricted access or deletion.

Google API Services — Limited Use disclosure

Covalence’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Information received through your Google connection is processed solely to provide the integration analysis and other user-facing features you request in Covalence. AI processing of that content is confined to producing those requested results. Access, storage and permitted provider disclosures serve those purposes under the Limited Use requirements.

Changes to this policy

We update the date above when this policy changes. Material changes are communicated where applicable, with a fresh consent choice before processing that requires a new permission.

Contact

For privacy questions, access requests or deletion requests, contact remi@usecovalence.com.

Rémi Al Ajroudi — 3915 Beechwood Blvd, Pittsburgh, Pennsylvania, United States. Email us.