Privacy policy

Controller and contact

KOTATIO SASU, share capital €1,000, 470 Promenade des Anglais, 06200 Nice, France, SIREN 920 193 703, is the controller for request handling, business relationship management and website security. Data contact: hello@askheyvi.com.

Where KOTATIO processes speaker or attendee data solely on behalf of a business client and under its instructions, a data processing agreement governs that processing. The client remains responsible for its own collection and information of data subjects.

Data processed

• Work email, request text, documents, images and other attachments.
• Optional profile (hotel, agency, company or other), language and interest in a plan or service. On the hotel guide: declared understanding of the change, positive or negative opinion and optional comment.
• Technical submission identifier, timestamps, receipt status and file metadata (name, type and size).
• Connection data processed by the host to route and secure requests, including IP address, browser and technical logs.

An email and either request text or a file are required to receive and follow up your submission. Your profile is optional. Only send necessary information; avoid full attendee lists, identity documents, health data and banking information.

Purposes and legal bases

Respond to your request and prepare services

Pre-contractual steps at your request, then performance of the contract. For business representatives’ contact data: legitimate interest in managing the business relationship.

Manage the agreed file follow-up

Performance of the contract and, for client-controlled data, documented client instructions.

Prevent abuse and protect access

Legitimate interest in securing the service.

Invoicing and legal duties

Compliance with applicable legal obligations.

Hotel guide feedback is used to organise the transition and address concerns, based on our legitimate interest in supporting business contacts. A positive opinion is not an order or evidence of actual service use. Submitting a request does not subscribe you to a newsletter. This form triggers neither targeted advertising nor automated decisions with legal effects on you. The landing page collects no payments.

What happens when you submit

Before confirmation, selected text and files remain in page memory. On submission, the server records the request and arranges file uploads to Convex storage. Complete receipt is shown after file checks. An interrupted submission may leave an incomplete request and files already received.

The team may then contact you and work on the file. The animation does not process your request. The current submission flow does not send your documents to an AI model provider. Any addition of such processing must be documented and disclosed before activation.

Recipients and providers

Only authorised KOTATIO personnel and technical providers necessary to deliver the service access data for their duties. Vercel Inc. hosts the site and handles server requests. Convex Inc. stores requests and attachments in the European environment configured for beta. European storage does not mean all technical access occurs in Europe.

Files are not freely distributed to suppliers. Relevant information is shared with identified parties in the context of the file or an accepted mandate. Data is not sold. Subsequent email exchanges also pass through correspondents’ email providers.

International processing

The website uses US providers and distributed infrastructure: some processing, including server execution or support, may occur outside the European Economic Area. Convex’s European storage location does not eliminate this possibility. Applicable safeguards must be established in agreements with each provider; copies or further details may be requested at hello@askheyvi.com.

Retention and deletion

Requests are retained while they are being reviewed and during exchanges necessary to handle them. When a request is no longer pursued, data that is no longer necessary must be deleted. For an agreed service, operational data is retained during the agreed follow-up until file closure, including billing issues, then according to agreed return or deletion instructions.

Accounting records are retained for ten years as required by law. Only records necessary to evidence commercial relationships or disputes are archived for applicable legal periods, including five years for commercial documents, unless another duty or proceeding requires otherwise. This does not justify retaining every event attachment.

You may request deletion or return at hello@askheyvi.com. Requests are assessed against legal obligations and other parties’ rights. The beta does not promise automatic deletion on a fixed date.

Cookies, language and dictation

The landing currently includes neither analytics nor advertising cookies. Your language preference is stored in browser local storage under heyvi.language until cleared or replaced. The heyvi_ops cookie is restricted to the back-office, lasts up to thirty days and maintains the operator session; it is not used for advertising.

Dictation is optional and requires microphone permission. It uses browser speech recognition, which may send audio to its provider under that provider’s terms. HEYVI receives the text you choose to submit, not an audio recording through this form. You may type without enabling the microphone.

Your rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, objection and portability. Where processing relies on consent, you may withdraw it for the future. You may also give instructions regarding your data after death under French law.

Write to hello@askheyvi.com with your request. Proportionate identity checks may be needed if there is doubt. We normally respond within one month; a reasoned two-month extension is possible in cases allowed by the GDPR. If KOTATIO acts for a client controller, we forward your request and assist that client.

You may lodge a complaint with the CNIL: https://www.cnil.fr/fr/plaintes.

Security and updates

The site uses HTTPS. Operator access to requests is protected and beta storage functions require server authentication. No system guarantees absolute security. Report concerns to hello@askheyvi.com. This policy will be updated when purposes, providers or operations change; the version date identifies the applicable text.