Last updated: September 23, 2026. The retention rules below take effect on October 15, 2026.
This policy explains how Klark SAS handles personal data when operating its website, managing business relationships, and providing its customer service platform.
For website inquiries, demo requests, business contacts, and account administration, Klark acts as a data controller. For customer support data processed through the platform on behalf of an organization, that organization is the data controller, and Klark acts as its processor in accordance with the organization’s documented instructions and the applicable data processing agreement. This policy does not modify those agreements or authorize additional uses or international transfers.
Depending on the services and integrations used, we process:
Information may come directly from you, from your organization, or from systems that your organization connects to Klark. Free-text messages and attachments may contain additional personal information. Customers should provide only the information needed for the relevant service and avoid including unnecessary sensitive information.
For our customers, we process support data to understand inquiries, retrieve relevant information, classify and route requests, generate responses, and provide the assistance or automation configured by the customer. We also analyze satisfaction, service quality, usage, and handling times to improve our algorithms and provide customers with insights into the performance of their processes, human advisors, and AI agents, including during service reviews. Analyses and reports are limited to the relevant customer’s data. Each customer can access only its own data and metrics. These analyses do not themselves make automated decisions about individuals. Processing is conducted in accordance with the customer’s documented instructions and the applicable agreement.
For our own business, we process contact and account information to respond to inquiries, arrange demonstrations, manage contracts and accounts, provide support, and handle billing. We process operational records to maintain security, investigate incidents, and comply with legal obligations. With the necessary consent, website analytics help us understand visitor behavior and attribute demo bookings to advertising.
Customer support content is not provided to advertising pixels for campaign measurement. Automated replies, routing, and other service actions depend on the customer's configuration. Customers remain responsible for the purposes, legal basis, and appropriate oversight of their use of the service.
For processing in which Klark acts as the data controller, the applicable legal basis depends on the purpose:
For support data processed on behalf of a customer, that customer determines the applicable legal basis and provides the relevant information to the individuals concerned.
We limit the data we process to what is necessary for the service and use masking, replacement of identifiers, and encryption to protect personal information. Controls apply to free-text fields, attachments, and contextual fields, and any gaps we identify are used to improve these measures.
Information that can identify a person, either directly or by combining it with other data or a separate key, remains personal data. We protect pseudonymized and encrypted information accordingly. Only data that has been irreversibly anonymized is treated as anonymous.
Retention periods depend on the type of data, its purpose, the customer's instructions, and applicable legal obligations. The shortest applicable period takes precedence. Mappings between personal information and replacement identifiers must be deleted when the ticket is closed or, if it remains open, after 30 days without any genuine ticket activity. Imports, recalculations, and other technical operations do not restart a retention period.
Our retention policy sets a maximum of 30 days for operational AI logs containing processing inputs or outputs. Chatbot and Ask Klark conversations, supplementary data, and other designated personal content are retained for up to 90 days. Support tickets and their associated exchanges—including questions, responses, suggestions, summaries, attachments, contact information, free-text satisfaction analyses, and personal business fields—are retained for up to 12 calendar months from the date of the original message, event, or collection. The names of agents and staff required for historical reporting are also retained for up to 12 calendar months from the date of the event in question. Technical identifiers and numerical metrics are retained only for documented purposes under the applicable agreement. The applicable retention period applies to all copies of the data; where multiple retention periods apply, the shortest one takes precedence.
When a service ends, the relevant processing must cease, integrations and secrets must be revoked or disabled, and service data must be returned or deleted in accordance with the customer's agreement and instructions. Information required for an active account or integration is retained for as long as it is needed. Data retained to comply with a legal obligation or preserve evidence is limited to that purpose, protected by restricted access, and subject to its own retention period.
Business contact information is retained while handling an inquiry or maintaining the relevant business relationship, and the continued necessity for retention is reviewed regularly. Contract and billing records are retained in accordance with applicable statutory retention periods. Backups are maintained for restoration and service continuity purposes, with restricted access and encryption. Any residual personal data in backups must be deleted no later than 30 days after it is deleted from active systems, unless a shorter contractual retention period applies. Required deletions must be reapplied after restoration before the data is put back into use.
Contact dpo@klark.ai for information regarding the retention period applicable to your data or organization.
Personal data may be accessed by authorized personnel in the course of their work and by third-party providers necessary to deliver the relevant service. These include hosting and infrastructure providers, AI processing providers, customer relationship and meeting-booking services, and website or analytics providers.
For example, the service uses OpenAI and Amazon Web Services, including Amazon Bedrock, for relevant AI processing workflows. The website uses Webflow for hosting, Weglot for translation, and HubSpot for demo scheduling. Google Analytics supports audience measurement, and Lemlist supports the identification of website visitors for business prospecting, subject to the applicable consent choices. When enabled and consented to, OpenAI Ads measures website visits and confirmed demo bookings. These are distinct processing activities: the use of an AI provider for customer support does not imply permission to use support content for advertising.
The subprocessing of customer data is governed by the applicable agreement and authorizations. The list of subprocessors and information about their roles and locations can be requested from dpo@klark.ai. We do not sell or rent personal data. We may disclose information when legally required to do so, limiting disclosure to the extent necessary to comply with the relevant requirement.
Processing locations depend on the service and the customer's configuration. Application hosting is documented in France; some AI processing takes place through OpenAI in the United States and through Amazon Bedrock in configured European regions. The applicable recipients, locations, support access, and transfer safeguards are documented for the services used.
International processing of personal data remains subject to the customer’s instructions and contractual restrictions. For OpenAI API processing, Section 4.1 of the OpenAI Data Processing Addendum provides for transfers by OpenAI Ireland under agreements containing the European Commission’s standard contractual clauses or an applicable adequacy decision. AWS includes standard contractual clauses in its data processing terms for transfers to which those clauses apply; see the AWS GDPR safeguards. These safeguards are separate from the region configured for each service and do not override any requirement for prior customer authorization. Masking or pseudonymization alone does not remove transfer requirements. Contact dpo@klark.ai for information on the recipients, locations, and contractual safeguards applicable to your service, and to obtain a copy of the relevant safeguards.
The website uses essential technologies to operate and remember privacy settings, and optional technologies for audience measurement and marketing. Google Analytics is used for audience measurement; OpenAI Ads for advertising attribution; and Lemlist for visitor identification and business prospecting. The website provides cookie preferences for non-essential purposes. You can opt out of marketing cookies and change your settings using the site's cookie preference controls.
When OpenAI Ads tracking is enabled, it is configured to load after marketing consent is granted. It tracks page views and successful demo reservations through the embedded HubSpot booking flow. This tracking may include browser, device, and page information, as well as advertising attribution identifiers processed by OpenAI. The integration does not send the content of your demo form or customer support conversations as conversion event data.
Withdrawing marketing consent prevents OpenAI from collecting data through this integration in the future. Withdrawal does not delete information that has already been lawfully collected; requests for deletion can be made using the rights described below. See also the OpenAI Privacy Policy.
We implement technical and organizational measures appropriate to the processing, including access restrictions, authentication, network protection, encryption of relevant secrets, monitoring, and security reviews. We conduct an annual security audit. These measures reduce the risk of unauthorized access, disclosure, alteration, or loss and are reviewed in light of identified risks and incidents.
Following the security incident identified in August 2026, we strengthened network access controls and authentication for the affected internal analytics environment, addressed the vulnerability, revoked compromised access, and renewed the relevant API keys. Data protection controls include data minimization, retention, masking of identifiers, and deletion at the end of the service.
When a personal data breach occurs, we investigate, take containment measures, and notify affected customers without undue delay when acting as their processor. We assist customers with their assessment and notification obligations. When Klark acts as a controller, we notify the competent authority and affected individuals when required by applicable law. An update to this policy does not replace an individual breach notification.
Subject to the provisions of applicable law, you may request access to, correction, erasure, or restriction of the processing of your personal data, as well as data portability; you may object to processing based on legitimate interests; and you may withdraw your consent. You may object to direct marketing at any time.
Contact dpo@klark.ai. We may request reasonable information to verify your identity. We normally respond within one month; if a lawful extension is needed, we will explain the reason within that period. Requests are normally handled free of charge.
If your data is processed on behalf of one of our customers, that organization is responsible for handling your request as the data controller. We will forward the request as appropriate and assist that organization in accordance with our agreement. You may also file a complaint with the CNIL or another competent supervisory authority without first contacting Klark.
Klark SAS's data protection contact is Nicolas Pellissier, at dpo@klark.ai. We update this policy when our data processing practices or applicable requirements change. The date above identifies the version, and material changes will be communicated as appropriate. An update does not retroactively change the purposes or legal basis of prior data processing or override commitments in a customer's agreement.