What we see.
What we don't.
Qovery (BIRDSIGHT SAS) is a deployment platform that runs in your cloud. By architecture, we process deployment metadata only - never your application data, never your customer data, never your secrets. This policy explains exactly what we see, why, and for how long.
Who is the data controller?
BIRDSIGHT SAS, trading as "Qovery", a French simplified joint-stock company (SAS) registered under number 852 571 108, with headquarters at 128 rue de la Boetie, 75008 Paris, France.
Qovery acts as data controller when you visit our website, create an account, or interact with our sales and support teams. When a customer creates user accounts on the Qovery platform, Qovery acts as data processor on behalf of that customer.
What personal data we collect
We collect only the data necessary to provide and improve our services. The specific categories depend on how you interact with Qovery.
| Category | Examples | Source | Mandatory |
|---|---|---|---|
| Identification data | Name, email address, phone number | Account registration, contact forms | Yes |
| Login data | GitHub / GitLab / Bitbucket OAuth tokens | Third-party authentication | Yes |
| Browsing data | IP address, browser type, pages visited | Automatic collection | No |
| Financial data | Credit card (via payment provider), invoices | Subscription payment | For paid plans |
| Usage data | Deploy events, cluster metrics, API calls | Platform telemetry | Yes |
Legal basis, purposes, and retention
We process your personal data on the following legal bases, for the stated purposes, and retain it for the specified durations.
| Purpose | Legal basis | Retention |
|---|---|---|
| Provide services via Website and API | Contract performance | Duration of account; deleted after 2 years of inactivity (with 1-month warning). Archived 5 years for proof. |
| Manage contracts, invoices, and CRM | Contract performance | Duration of business relationship. Invoices archived 10 years. Card data held by payment provider only. |
| Customer and prospect database | Legitimate interest | Customers: duration of relationship. Prospects: 3 years from last contact. |
| Newsletters and marketing | Consent (B2C) / Legitimate interest (B2B) | 3 years from last contact or until consent withdrawn. |
| Answer information requests | Legitimate interest | Duration of request processing; deleted when resolved. |
| Navigation analytics | Consent | 26 months. |
| Data subject rights requests | Legitimate interest | ID proof: during verification only. Right to object records: 3 years. |
Recipients of your personal data
Your personal data may be shared with the following categories of recipients:
- ->Qovery staff members who need access to perform their duties
- ->Data processors: hosting providers (AWS), CRM tools, mailing services, payment providers
- ->Public or private organizations when required by legal obligations or court orders
Transfers outside the EU
Qovery is hosted on Amazon Web Services. Some sub-processors are located in the United States. For all international transfers, we rely on one or more of the following safeguards:
- ->EU adequacy decisions for the destination country
- ->Standard Contractual Clauses (SCCs) approved by the European Commission
- ->Binding Corporate Rules where applicable
- ->EU-US Data Privacy Framework certification of the recipient
Your rights
Under the GDPR, you have the following rights regarding your personal data. You can exercise any of these rights by contacting us at [email protected].
- ->Right to be informed about the processing of your personal data
- ->Right of access to your personal data
- ->Right to rectification of inaccurate or incomplete data
- ->Right to restriction of processing in certain circumstances
- ->Right to erasure ("right to be forgotten")
- ->Right to lodge a complaint with the CNIL (French data protection authority)
- ->Right to define post-death instructions for your data
- ->Right to withdraw consent at any time (where consent is the legal basis)
- ->Right to data portability in a structured, machine-readable format
- ->Right to object to processing based on legitimate interest
Contact information
For any questions about this privacy policy or to exercise your rights, you can reach us at:
Email: [email protected]
Address: QOVERY (Birdsight SAS), 128 Rue de la Boetie, 75008 Paris, France.
Modifications
Qovery may modify this privacy policy at any time to reflect changes in our practices, legal requirements, or the services we offer. We will notify users of significant changes via email or a prominent notice on our website. Continued use of the platform after modifications constitutes acceptance of the updated policy.