Last updated: 23 September 2026. The retention rules below take effect on 15 October 2026.
This policy explains how Klark SAS handles personal data when operating its website, managing business relationships and providing its customer service platform.
For website enquiries, demo requests, business contacts and account administration, Klark acts as a data controller. For customer support data processed through the platform on an organisation's behalf, that organisation is the data controller and Klark acts as its processor under its documented instructions and the applicable data processing agreement. This policy does not amend those agreements or authorise additional uses or international transfers.
Depending on the services and integrations used, we process:
Information can come directly from you, from your organisation or from systems that your organisation connects to Klark. Free-text messages and attachments can contain additional personal information. Customers should provide only information needed for the relevant service and avoid unnecessary sensitive information.
For our customers, we process support data to understand enquiries, retrieve relevant information, classify and route requests, generate responses and provide the assistance or automation configured by the customer. We also analyse satisfaction, service quality, usage and handling times to improve our algorithms and provide customers with insights into the performance of their processes, human advisers and AI agents, including during service reviews. Analyses and reports are limited to the relevant customer's data. Each customer can access only its own data and indicators. These analyses do not themselves make automated decisions about individuals. Processing follows the customer's documented instructions and the applicable agreement.
For our own business, we process contact and account data to respond to enquiries, arrange demonstrations, administer contracts and accounts, provide support and manage billing. We process operational records to maintain security, investigate incidents and meet legal obligations. With the required consent, website measurement helps us understand visits and attribute demo bookings to advertising.
Customer support content is not supplied to advertising pixels for campaign measurement. Automated replies, routing and other service actions depend on the customer's configuration. Customers remain responsible for the purposes, legal basis and appropriate oversight of their use of the service.
For processing where Klark acts as controller, the applicable basis depends on the purpose:
For support data processed on behalf of a customer, that customer determines the applicable legal basis and provides the relevant information to the individuals concerned.
We limit the data processed to the needs of the service and use masking, replacement of identifiers and encryption to protect personal information. Controls cover free text, attachments and contextual fields, and detected gaps feed into the improvement of these measures.
Information that can identify a person, directly or by combining it with other data or a separate key, remains personal data. We protect pseudonymised and encrypted information accordingly. Only data that has been irreversibly anonymised is treated as anonymous.
Retention periods depend on the type of data, its purpose, the customer's instructions and applicable legal obligations. The shortest applicable period takes precedence. Mappings between personal information and replacement identifiers must be deleted when the ticket closes or, if it remains open, after 30 days without genuine ticket activity. Imports, recalculations and other technical operations do not restart a retention period.
Our retention policy sets a maximum of 30 days for operational AI logs containing processing inputs or outputs. Chatbot and Ask Klark conversations, supplementary data and other designated personal content are retained for up to 90 days. Support tickets and their associated exchanges, including questions, responses, suggestions, summaries, attachments, contact identities, free-text satisfaction analyses and personal business fields, are retained for up to 12 calendar months from the original message, event or collection. Names of agents and staff needed for historical reporting are also retained for up to 12 calendar months from the event measured. Technical identifiers and numerical metrics are retained only for documented purposes under the applicable agreement. The applicable deadline follows the data through its copies; where several limits apply, the shortest takes precedence.
When a service ends, the relevant processing must stop, integrations and secrets must be revoked or disabled, and service data must be returned or deleted according to the customer's agreement and instructions. Information needed for an active account or integration is retained for the duration of that need. Data retained to meet a legal obligation or preserve evidence is limited to that purpose, protected by restricted access and assigned its own retention period.
Business contact information is retained while handling an enquiry or maintaining the relevant business relationship, with continued necessity reviewed regularly. Contract and billing records follow applicable statutory periods. Backups are reserved for restoration and service continuity, with restricted access and encryption. Residual personal data in backups must expire no later than 30 days after deletion from active systems, unless a shorter contractual period applies. Required deletions must be reapplied after restoration before data is returned to use.
Contact dpo@klark.ai for the retention information applicable to your data or organisation.
Personal data may be accessed by authorised personnel for their work and by providers needed to deliver the relevant service. These include hosting and infrastructure providers, AI processing providers, customer relationship and meeting-booking services, and website or measurement providers.
For example, the service uses OpenAI and Amazon Web Services, including Amazon Bedrock, for relevant AI processing flows. The website uses Webflow for hosting, Weglot for translation and HubSpot for demo scheduling. Google Analytics supports audience measurement, and Lemlist supports website visitor identification for business prospecting, subject to the applicable consent choices. When enabled and consented to, OpenAI Ads measures website visits and confirmed demo bookings. These are different processing activities: use of an AI provider for customer support does not imply permission to use support content for advertising.
Subprocessing of customer data is governed by the applicable agreement and authorisations. The list of subprocessors and information about their roles and locations can be requested from dpo@klark.ai. We do not sell or rent personal data. We may disclose information where legally required, limiting disclosure to the relevant requirement.
Processing locations depend on the service and the customer's configuration. Application hosting is documented in France; some AI processing takes place through OpenAI in the United States and through Amazon Bedrock in configured European regions. The applicable recipients, locations, support access and transfer safeguards are documented for the services used.
International processing of personal data remains subject to the customer's instructions and contractual restrictions. For OpenAI API processing, section 4.1 of the OpenAI Data Processing Addendum provides for transfers by OpenAI Ireland under agreements containing the European Commission's standard contractual clauses or an applicable adequacy decision. AWS includes standard contractual clauses in its data processing terms for transfers to which those clauses apply; see the AWS GDPR safeguards. These safeguards are separate from the region configured for each service and do not override any requirement for prior customer authorisation. Masking or pseudonymisation alone does not remove transfer requirements. Contact dpo@klark.ai for the recipients, locations and contractual safeguards applicable to your service and to obtain a copy of the relevant safeguards.
The website uses essential technologies to operate and remember privacy choices, and optional technologies for audience measurement and marketing. Google Analytics is used for audience measurement; OpenAI Ads for advertising attribution; and Lemlist for visitor identification and business prospecting. The website provides cookie preferences for non-essential purposes. You can refuse marketing cookies and change your choice using the site's cookie preference controls.
When OpenAI Ads tracking is activated, it is configured to load after marketing consent. It measures page views and successful demo reservations through the embedded HubSpot booking flow. Measurement can involve browser, device and page information and advertising attribution identifiers processed by OpenAI. The integration does not send the content of your demo form or customer support conversations as conversion event data.
Withdrawing marketing consent stops future OpenAI measurement through this integration. Withdrawal does not erase information already lawfully collected; deletion requests can be addressed through the rights described below. See also the OpenAI Privacy Policy.
We apply technical and organisational measures appropriate to the processing, including access restrictions, authentication, network protection, encryption of relevant secrets, monitoring and security reviews. We conduct a security audit annually. These measures reduce the risk of unauthorised access, disclosure, alteration or loss and are reviewed in light of identified risks and incidents.
Following the security incident identified in August 2026, we strengthened network access controls and authentication for the affected internal analytics environment, corrected the vulnerability, invalidated compromised access and renewed the relevant API keys. Data protection controls cover minimisation, retention, masking of identifiers and deletion at the end of the service.
Where a personal data breach occurs, we investigate, take containment measures and notify affected customers without undue delay when acting as their processor. We assist customers with their assessment and notification obligations. Where Klark acts as controller, we notify the competent authority and affected individuals when required by applicable law. An update to this policy does not replace an individual breach notification.
Subject to the conditions in applicable law, you may request access, correction, erasure, restriction of processing and portability of your personal data, object to processing based on legitimate interests, and withdraw consent. You may object to direct marketing at any time.
Contact dpo@klark.ai. We may request proportionate information to verify your identity. We normally respond within one month; where a lawful extension is needed, we will explain it within that period. Requests are normally handled free of charge.
If your data is processed for one of our customers, that organisation is responsible for handling your request as controller. We will direct the request appropriately and assist that organisation under our agreement. You may also complain to the CNIL or another competent supervisory authority without first contacting Klark.
Klark SAS's data protection contact is Nicolas Pellissier, at dpo@klark.ai. We update this policy when our processing practices or applicable requirements change. The date above identifies the version, and material changes will be communicated as appropriate. An update does not retroactively change the purposes or legal basis of earlier processing or override commitments in a customer's agreement.