Privacy policy
This English version is provided for convenience. In the event of any discrepancy, the French version prevails.
Purpose of this policy
This policy explains how Kardanos collects, uses, stores and protects personal data in connection with its website, its forms, its demo requests, its commercial communications and its SaaS services.
Data collected
- Identification data: surname, first name, job title, company
- Contact details: email address, telephone number, business address
- Request data: message, written chats with Sophia on the website, stated need, sector, company size
- Commercial data: quotes, subscriptions, invoices, customer status
- Website usage data: IP address, pages viewed, device, browser
- Data relating to the use of Kardanos: leads, opportunities, appointments, notes, conversations
- Support data: tickets, assistance requests, technical logs
Purposes
- Responding to requests sent via the website
- Arranging demos and sales meetings
- Managing the commercial relationship, quotes, subscriptions and invoices
- Providing, configuring, maintaining and improving the Kardanos services
- Providing customer support and technical follow-up
- Securing the services and complying with legal obligations
Lawful bases
- Contact, demo and quote requests: steps taken at your request prior to a contract
- Provision of services, support and customer invoicing: performance of the contract
- Voice or written demo with Sophia on the website: your consent, collected before the conversation starts
- Business-to-business prospecting and service security: Kardanos’s legitimate interest
- Retention of accounting records: legal obligation
Technical processors
- Netlify — website hosting and forms
- Supabase — Cockpit / Pocket application data (Frankfurt region)
- n8n, hosted by Elestio — orchestration and automations (Germany)
- ElevenLabs — voice and conversational agents, including the written chat with Sophia on this website
- Google — appointment booking (Google Calendar) and sending emails (Gmail)
- Microsoft — calendar and email for businesses that connect Outlook / Microsoft 365
- Brevo — sending confirmation emails and text messages
- Unipile (France, data hosted in France) — connection of the mailboxes our customers link to the email agent
- Anthropic — Claude language model, used by Sophia, Pocket and the email agent to understand requests and formulate answers
- Telnyx — telephony
- smsmode — SMS
- Twenty — CRM
- Stripe — payment
- Plausible Analytics — website audience measurement, cookie-free, hosted in the European Union
- Google Fonts — display of the website’s typefaces (your IP address is sent to Google when they load)
- unpkg and jsDelivr — delivery of the code for the ElevenLabs chat window and voice demo
Google and Microsoft data (Cockpit application)
A business customer can connect its Google account (Google Calendar, Gmail) or Microsoft account (Outlook, Microsoft 365) from the Cockpit application (cockpit.xenaos.com, published by VLB Group as Xenaos Cockpit). Kardanos then uses this data only to provide the service: reading the calendar's free/busy times, creating, moving or cancelling the appointments booked by Sophia, listing calendars so each department can choose its own, and sending confirmations and reminders from the business's own address. Kardanos never reads the content of emails or the details of other events, never sells this data, never uses it for advertising and never uses it to train artificial intelligence models. The business can disconnect its account at any time from Cockpit, which revokes access.
Kardanos's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Full details: Cockpit privacy policy.
Email agent. A customer company can also turn on the email agent. Its mailbox is then connected through Unipile, a French provider whose data is hosted in France, with a separate authorisation given on Unipile’s connection page, not through the Google or Microsoft connection described above. New incoming emails are read to be sorted and summarised, and a reply is drafted; it is only sent once the company approves it, except for requests from prospective customers when the company has turned on the immediate reply (the reply is then signed by its assistant). The text of the emails is analysed by Anthropic’s language model for this sole purpose and is not used to train any model. Cockpit keeps the sender, subject, summary and drafted reply for 12 months; the company can remove its mailbox at any time.
Transfers outside the European Union
Some providers are based in the United States, including Netlify, ElevenLabs, Anthropic, Google, Microsoft, Telnyx and Stripe. These transfers are governed by the adequacy decision on the EU–US Data Privacy Framework for certified companies and, failing that, by the European Commission’s standard contractual clauses. You can obtain a copy of these safeguards by writing to hello@xenaos.com.
Retention periods
- Contact requests and prospects: 3 years from the last active exchange
- Customer data and active accounts: for the duration of the contractual relationship
- Invoices and accounting records: the applicable statutory period (10 years in France)
- Summaries and transcripts of calls handled for our customers: period set by each customer in Cockpit, then deletion at the end of the contract
- Emails sorted by the email agent (sender, subject, summary, drafted reply): 12 months, then automatic deletion
Your rights
In accordance with the GDPR, you have the right of access, rectification, erasure, objection, restriction of processing, data portability and withdrawal of consent, which you may exercise by contacting hello@xenaos.com. You may lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr) or with the authority of your country of residence, such as the CNPD in Luxembourg or the APD in Belgium.
Kardanos has not appointed a data protection officer. For any question: hello@xenaos.com.
Cookies
This website does not set advertising cookies. Audience measurement (Plausible) works without cookies and without any data that could identify you. It uses the browser’s session storage (sessionStorage), which is cleared when the tab is closed, to remember the demo form and the source of your visit (campaign, landing page) in order to process your request. Demo appointments are booked via a Google Calendar page.