Privacy notice

Calivo tells companies whether they qualify for public funding. Here is what we collect on the public check and when you leave your email, and why.

1. What we collect — the tax ID you enter (stored only as a hash), public registry data about the company, a daily hash of your IP address (never the address itself), and, if you leave it, your email address with the time and version of your consent.
2. Why — to compute and show the pre-qualification, to limit abuse of the free check, and to send you the results and the confirmation email you asked for.
3. Legal basis — your consent (email) and our legitimate interest in running and protecting the service (abuse limits, audit).
4. Accounts and organisations — when you create an account we store your email address, name and language, the organisation you belong to and the entities you add (name, tax ID, region, activity code, financial figures — for sole traders this is personal data), together with the verdicts computed for them.
5. Automatic matching and alerts — the engine recomputes the matches between your entities and the open programmes when rules or data change and, if you enable alerts, sends you a summary at the frequency you chose, to the address you chose.
6. Retention — shared results expire after 90 days; the confirmation link after 7 days; audit records are kept as required for the service.
7. Sharing — we do not sell or share your email; the email is delivered by our transactional email provider; payments, when you subscribe, are handled by Paddle.
8. Our processors — Supabase (database and authentication), Vercel (hosting), Resend (transactional email), Paddle (payments, as merchant of record). Rule extraction uses an AI model provider (Anthropic) on the official documents only — no personal data is sent to it.
9. Where data is processed — our processors may process data outside the EEA under standard contractual clauses and equivalent safeguards; details are available on request.
10. Your rights — access, rectification, erasure, restriction and objection under the GDPR; write to us and we will answer within 30 days.
11. Export and erasure — the organisation owner can download a complete export and can anonymise the organisation from the settings; audit records are kept without any personal data.
12. Double opt-in — we send nothing beyond the single confirmation email until you confirm your address.
13. Cookies — strictly necessary cookies only, unless you accept analytics; see the cookie policy and change your choice at any time.
14. Complaints — you may lodge a complaint with the supervisory authority of your country (ANSPDCP in Romania, AEPD in Spain, CNPD in Portugal, CNIL in France).

Contact: contact@calivo.app