Privacy policy

1. Who is responsible

The data controller is Quavern, SASU, 14 Rue de Menespey, 33185 Le Haillan, France. For any question about this policy or your data, write to hello@quavern.com. Quavern has not appointed a data protection officer; requests are handled directly by the founder.

This policy covers quavern.com, the Marl assistant (chat.quavern.ai, marl.quavern.ai and the Marl Code application), the Marl API (api.quavern.ai), the myQuavern account space (my.quavern.com), and the online services of the QuavernOS operating system: downloads, update checks and optional connected features.

2. What we process

• Account data: e-mail address, display name, hashed password, language, sessions, revocable access tokens, organisation membership, and dated, versioned consent records.
• Marl content: your conversations, the files you attach, optional memory entries the assistant keeps about you, and your settings.
• Usage measures: request counts and token-based usage against your plan's quotas.
• Billing data: billing identity and subscription state, processed by Stripe. Quavern never stores card numbers.
• Technical logs: IP addresses, timestamps and error codes, kept for security and operations.
• Transactional e-mail: verification and security messages, sent through Proton.
• QuavernOS: the installed system sends nothing by default. Downloading images or checking for updates leaves ordinary technical logs; connecting a machine to your myQuavern account, or enabling an optional metrics or assistant feature, is an explicit, revocable choice recorded as a dated consent.

3. Why, and on what legal basis

• Providing the services you signed up for, including generating Marl's replies: performance of the contract.
• Billing, accounting and tax records: legal obligation.
• Security, abuse prevention and moderation of prohibited use: legitimate interest.
• Optional features such as assistant memory, and any future optional purpose: consent, which you can withdraw at any time.

There is no advertising on Quavern services, no audience-measurement tracking, and no sale of personal data.

4. Who receives data

Quavern uses a small number of processors, each limited to what its role requires:

• Hosting: Microsoft Azure (Microsoft Ireland Operations Limited), in the European Union.
• Payments: Stripe, for checkout, subscriptions and invoices.
• Transactional e-mail: Proton.
• AI inference providers, which process conversation content to generate the reply you asked for. Where such a provider is located in the United States, transfers are governed by the European Commission's Standard Contractual Clauses.

No other third party receives your data, except where the law requires it.

5. AI processing

Conversation content is processed to produce the reply you requested. Quavern does not use your conversations to train foundation models, and its inference providers are bound by contractual restrictions on how they may use the data they process.

Assistant memory is optional. When enabled, Marl keeps short, durable facts you can review and delete at any time from your account.

6. How long we keep data

• Account data: for as long as the account exists, then deleted or anonymised.
• Conversations on the Free plan: 30 days, enforced by an automatic daily purge.
• Conversations on paid plans: until you delete them or delete your account.
• Invoicing records: 10 years, as French law requires.
• Technical logs: a short, proportionate period for security and operations.

You can delete your Marl data, or the whole account, directly from myQuavern without asking anyone.

7. Your rights

You have the rights of access, rectification, erasure, portability, restriction and objection, and the right to withdraw consent at any time for processing based on consent. Write to hello@quavern.com; Quavern answers within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French supervisory authority, at cnil.fr.

8. Cookies and local storage

Quavern sites use only storage that is strictly necessary: authentication, session refresh, language, and the record of your privacy choice itself. That choice is kept on your device for at most six months, and the notice stays reachable from the bottom of every page.

There are no advertising, marketing or audience-measurement trackers, first-party or third-party. If an optional purpose is ever added, it will stay off until you explicitly accept it.

9. Security

Connections are encrypted in transit. Secret keys stay on the server side. Access tokens are hashed at rest, scoped to an audience, and revocable from your account. Production systems run with restricted privileges and least-access file permissions.

10. Age

Quavern services are intended for people aged 15 or over. Under French law, a person under 15 may only use them with the agreement of a parent or guardian.

11. Changes to this policy

This page is dated and versioned. If the policy changes in a way that matters, the change is announced in the product before it takes effect, and the previous version remains available on request.