Privacy Policy

Who handles your data

C2O ONE is published by Vonus IA, based in France. For your account data (identity, email address, subscription), the publisher is the data controller. For the data your company enters (clients, employees, jobs, documents), your company is the data controller and the publisher acts on its behalf, under the Data Processing Agreement.

What we process, and why

• Account and subscription: to identify you and manage your access and billing.
• Business data entered by your company: to run the software, and for no other purpose.
• Technical logs: for security and to diagnose incidents.
• Email tips: a company on Freemium receives at most one email a month, at its account address, to help it use C2O ONE and to present the paid plans. Every email lets you unsubscribe in one click, without logging in. Your mailbox data and the data your company enters are not used for them.

No data is sold or used for third-party advertising.

Data protection

The data you entrust to us, in particular your email data, is protected by the following measures.

• Encryption in transit: all exchanges with C2O ONE go over HTTPS (TLS), and browsers are required to use HTTPS only (HSTS).
• Encryption at rest: the database and files are encrypted on our host’s disks (AES-256).
• Access to your mailbox: Gmail and Outlook access tokens, and the password of an IMAP mailbox, are encrypted with AES-256-GCM using a key held by the server. They are never sent to the browser: only the server can read them, not even the logged-in user.
• Separation: each company sees only its own data; this separation is enforced by the database itself, on every query. A mailbox is used only by its owner, or by the company they have entrusted it to.
• Role-based access: each member of a company can reach only the modules their role allows.
• Minimization: your emails are not copied to our database; they are read on demand from your email provider. We keep only the result of Vonix’s analysis (type of request, contact details) and what you create from a message.
• Deletion: disconnecting a mailbox immediately deletes its encrypted tokens and password.
• Bank details: they are encrypted in the database.
• Incidents: in the event of a data breach, we notify the CNIL (the French data protection authority) and, where necessary, the people concerned, within the time limits set by the GDPR.

Connected Gmail inbox

If you connect your Gmail inbox, C2O ONE accesses it with your authorization, in order to: show your messages and threads in the Email screen; send from your address the estimates, invoices, reminders and replies you approve; let Vonix sort the emails you submit to it (estimate request, issue report, client request); and mark as read a message you open.

C2O ONE’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only for the features above, visible to you; it is not sold, not used for advertising, and not used to train artificial intelligence models, and no human reads it without your agreement, except where required by law or for security reasons. You can disconnect your inbox at any time from the Email screen or from your Google account.

Vonix, the AI assistant

When you use Vonix, your request and what is needed to answer it (attached documents, an email submitted for sorting, your company’s data) are sent to the provider of the language model, Anthropic, to produce the answer. Vonix applies the permissions of the person using it: it returns no data they don’t already have access to.

Service providers and hosting

The application is hosted by Vercel; the database and files are stored in the European Union (Ireland) with Supabase. The full list of service providers, and the framework for transfers outside the European Union, are in the Data Processing Agreement.

Retention periods

• Account and company data: for the length of the subscription, then until the account is deleted.
• Accounting records (invoices): 10 years, the period required by the French Commercial Code.
• Gmail access: until the inbox is disconnected; the access tokens are then deleted.

Your rights

You can request access to, correction, erasure, restriction or portability of your data, and object to processing, by writing to contact@c2o-one.com. You can also file a complaint with the CNIL (cnil.fr). The account can be deleted from the application.