Privacy Policy

1. Introduction

CoVœur is a digital relationship-support and self-reflection service, powered by artificial intelligence. It is neither a healthcare service, nor a psychological diagnosis, nor a crisis-response system.

CoVœur places fundamental importance on protecting your personal data. This Privacy Policy describes how we collect, use, store, and protect your data when you use the CoVœur Service, available via WhatsApp and the website www.covoeur.com.

This policy complies with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the amended French Data Protection Act.

2. Data controller

The data controller is NOproBS, a SASU with share capital of €1,000, RCS Paris 984 241 075, registered office in Paris, France. Contact: contact form

3. Data collected

CoVœur only collects data that you voluntarily provide when using the Service:

• Identifier: your WhatsApp phone number
• First name: provided during onboarding to personalize your experience. If you introduce yourself in your first message, we use that rather than asking again
• Date of birth: asked once, during sign-up formalities. It is used to verify that you are an adult — the Service is for adults only — and, if you ever ask for your birth chart, to draw it up without asking you again. You can correct it at any time
• Your partner's age: never asked for. It is only recorded if you mention it yourself in your messages, because it informs how we read your situation. You can ask for it to be erased at any time
• Gender: inferred automatically from your first name, mentions, or grammatical agreements in your messages — never asked for directly
• Relationship status: single or in a relationship, communicated during onboarding
• Questionnaire responses: your answers to the relational self-assessment questionnaire
• Relationship context: information you choose to share about your relationship
• WhatsApp conversations: only if you explicitly consent, with double consent with your partner
• Usage data: history of interactions with the Service (via WhatsApp)

Intimate data

CoVœur supports you in your romantic life. What you write here therefore touches on the intimate: how you are doing, what you are going through, your relationship, your desire — and sometimes harder moments. A low patch. A step you have taken for yourself. A situation of violence you report.

We call this intimate data. The GDPR places it among the special categories of data (Article 9) — commonly referred to as “sensitive data”. This is why the sign-up formalities ask for your explicit, separate consent: we did not want to process it in among everything else without telling you.

Two points that matter to us:

• Nothing is asked of you. This information is only processed because you choose to write it. CoVœur asks no questions about your health.
• When a sign of distress is identified, the extract of your message that triggered it is kept. Not to label you, but so that a human can check that the signal was warranted — a label on its own cannot be verified (see “Vigilance” in §5).

You can ask for all of this to be erased at any time. And, to be complete about what we do not process: no racial or ethnic origin, no political opinions, no religious or philosophical beliefs, no trade union membership, and no genetic or biometric data.

4. Legal bases for processing

Purpose	Legal basis
Provision of the Service (assessments, analyses, programs)	Performance of a contract (Art. 6(1)(b) GDPR)
Analysis of WhatsApp conversations	Explicit consent (Art. 6(1)(a) GDPR)
Service improvement	Legitimate interest (Art. 6(1)(f) GDPR)
Evaluation of the quality of our replies and referrals — internal replay (see §5)	Legitimate interest (Art. 6(1)(f) GDPR); for sensitive content, explicit consent (Art. 9(2)(a) GDPR) collected during sign-up formalities
Age verification (date of birth)	Legitimate interest — protection of minors (Art. 6(1)(f) GDPR)
Processing of sensitive data (mental health, emotional and sexual life, reported violence)	Explicit consent (Art. 9(2)(a) GDPR), collected separately during sign-up formalities
Vigilance — identifying situations of distress, violence or risk	Explicit consent (Art. 9(2)(a) GDPR) and vital interests of the data subject (Art. 9(2)(c) GDPR)
Compliance with legal obligations	Legal obligation (Art. 6(1)(c) GDPR)

5. How we use data

Your data is used exclusively to:

• Generate your personalized Relational Profile (individual assessment)
• Produce the combined Couple Assessment (if you and your partner consent)
• Personalize your coaching journey and programs
• Send you exercises, reminders, and check-ins via WhatsApp
• Improve the quality of the CoVœur Service

Your data is never sold, shared, or transferred to third parties for commercial purposes.

Vigilance — identifying serious situations

CoVœur automatically examines your messages for signs of distress, violence, or risk to a third party. This is a protective measure, and it has concrete consequences:

• the extract of the message that triggered the signal is kept, so that a human review can verify that it was warranted;
• the CoVœur team is alerted, and the alert is repeated until someone has taken it into account;
• while the situation remains open, CoVœur suspends its paid offers and scheduled check-ins, and may direct you to emergency services and then close the conversation (see the Terms of Use, article 8);
• only a human action closes the signal — it never expires on its own.

This mechanism has one purpose only: not to leave someone in difficulty alone with an automated system. It is not used to assess your profile, serves no commercial purpose, and is disclosed to no third party.

Quality control

The reports generated and the exchanges may be subject to an after-the-fact quality review, on pseudonymized data — first names are replaced by markers (“[Person]”, “[Partner]”) — in order to check the relevance of the analyses and the proper functioning of the vigilance signals. This review is carried out by the CoVœur team. It does not constitute an individual clinical validation of each report.

Evaluation of wording (internal replay)

In order to check and improve the quality of our replies — in particular the Service's ability to identify situations that exceed its scope (distress, violence, risk to a third party) and to direct people towards a professional or a dedicated service — past exchanges may be replayed to compare several formulations.

• Exchanges are stripped of first names, contact details and identifiers before being submitted to the model. The phone number is never transmitted.
• These replays are run manually by the team, on a designated account. No automated processing is carried out for this purpose.
• The model used for this evaluation is provided by Anthropic PBC (United States) — see §7 and §11. This data is not used for model training.
• The comparison reports are kept internally and remain linked to the account concerned: this is therefore pseudonymized data, not anonymous data.
• This replay has no effect on the person whose exchange is replayed: it serves to correct wording for the future, not to come back to them.

6. Analysis of WhatsApp conversations

If you choose to share a WhatsApp conversation for analysis:

• Consent from both partners is required before any processing
• The conversation is anonymized before processing: first names, addresses, and phone numbers are replaced by neutral identifiers (Partner A / Partner B, [CITY], [NUMBER]…)
• Anonymization is performed in memory (RAM) on our servers, right before sending it to the AI model. The raw (non-anonymized) version of your conversation is not durably stored on disk: only the anonymized version may be retained as needed for the analysis.
• The analysis is performed by an AI model (Azure OpenAI, Microsoft — hosted in Switzerland, a country recognized as adequate by the European Commission) in accordance with their terms of use, and only receives the anonymized version
• Raw (non-anonymized) data is not retained after analysis

7. Processors and recipients

CoVœur uses the following processors, with GDPR-compliant data processing agreements in place:

Processor	Role	Location
Microsoft Azure OpenAI	AI-generated analyses, reports and conversations, and analysis of warning signals	Switzerland (country recognized as adequate by the European Commission) — GDPR DPA
Microsoft Azure OpenAI (Whisper)	Transcription of your voice messages into text	Netherlands (European Union) — GDPR DPA
Anthropic PBC	Model used for the internal evaluation of wording (replay, see §5) — only on exchanges stripped of first names, contact details and identifiers	United States — GDPR DPA and standard contractual clauses
Meta (WhatsApp Business API)	Messaging infrastructure for WhatsApp	Ireland (European Union) — GDPR DPA
Microsoft Azure	Hosting of the backend and data	France (France Central region) — GDPR DPA
Stripe	Payment processing (subscriptions and purchases)	Ireland (European Union) — GDPR DPA
CoVœur team	After-the-fact quality review of reports and exchanges (see §5)	France — access on pseudonymized data

No other third party has access to your personal data.

8. Data retention

Your data is retained for the following durations:

• Profile data and questionnaire responses: as long as needed to provide the Service, then deletion upon request
• WhatsApp conversations submitted for analysis: kept in anonymized form after analysis
• Coaching conversation history: up to 12 months
• Therapist files (notes and conversation summaries): duration of Service use + 12 months, then deletion upon request
• Interaction history: 30 days (raw messages); coaching summaries: duration of Service use
• Billing data (where applicable): 10 years (statutory accounting obligation)

You can request the deletion of your data at any time by contacting us via WhatsApp.

What our deletion does not cover. Our deletions apply to our own databases. They do not extend to the history WhatsApp keeps on its side, at Meta and on your phone: deleting your data with us does not delete the conversation in your app, and deleting the conversation in your app does not delete anything with us. For the history held by Meta, those rights are exercised with Meta.

9. Your rights (GDPR)

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data being processed
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: obtain the deletion of your data ("right to be forgotten")
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to the processing of your data for legitimate interest purposes
• Right to withdraw consent: withdraw your consent at any time for processing based on it
• Right to restriction: request the suspension of processing in certain cases

To exercise these rights, contact us via our contact form. We commit to responding within one month.

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr.

10. Data security

CoVœur implements appropriate technical and organizational measures to protect your data:

• Transmission via encrypted protocols (HTTPS/TLS)
• Hosting on secure servers in Europe (Microsoft Azure, France)
• Access to data restricted to authorized members of the CoVœur team only
• Anonymization of sensitive data before AI processing

What people believe about WhatsApp, and which is not true here. Between individuals, WhatsApp conversations are end-to-end encrypted: WhatsApp states that no one outside the conversation, "not even WhatsApp or Meta", can read the content. That is not the case for our messages. For a conversation with a business that has chosen Meta as its host, which is our configuration, WhatsApp states that it does not consider these messages to be end-to-end encrypted. Meta therefore hosts the messages in order to deliver them to us, and can access them. You are writing in the app where all your other conversations are inaccessible to Meta: this one is not, and we would rather say so than let the context imply otherwise.

11. International transfers

All data processing carried out by CoVœur and its main processors is located as follows: backend hosting and database (Microsoft Azure, France); generation of analyses, reports and conversations, and analysis of warning signals (Azure OpenAI, Switzerland); transcription of voice messages (Azure OpenAI Whisper, Netherlands); messaging (Meta WhatsApp Business API, data at rest in Germany, see below); payments (Stripe, Ireland).

Transfers outside the European Union. Switzerland is a third country recognized as adequate by the European Commission, which allows transfers without further safeguards. In addition, our internal review of wordings (processing no. 11 in our record of processing activities) sends excerpts stripped of first names, contact details and identifiers to a model provider in the United States, under the European Commission's standard contractual clauses. These excerpts are not used to train models.

Messaging: data at rest is stored in Germany. Measured on 1 October 2026 on our number, after activation: data localization is enabled, and Meta stores the content of our messages at rest in Germany, therefore within the European Union. Meta documents a retention of at most 30 days, encryption at rest, and deletion of identifiers within 30 days.

Two residues this setting does not remove, which we would rather write down than announce an entirely European perimeter: Meta documents up to 60 minutes of processing on its international data centres while a message is in transit, and contact lists remain on its servers whatever the setting. A transfer outside the European Union therefore remains, residual and bounded, covered by the European Commission's standard contractual clauses set out in Meta's processing terms.

12. Cookies and trackers

The CoVœur Service is mainly accessible via WhatsApp and does not use tracking cookies. The site www.covoeur.com may use technical cookies strictly necessary for the website to function. No advertising or profiling cookies are used.

Personal Space session cookie: when you access your personal space via the secure link sent by WhatsApp, a session cookie (espace_session) is placed on your browser. This cookie is strictly necessary to maintain your connection to your personal space. It contains no personal data — only a random session identifier. It expires automatically after 30 days. This technical cookie does not require your prior consent in accordance with Article 82 of the French Data Protection Act.

Scanning a CoVœur QR code. CoVœur distributes stickers bearing a QR code at its partners' locations (salons, practitioners, events). Scanning that code redirects you to WhatsApp; no information is read from your phone, no cookie is placed, and no terminal fingerprinting technique is used. We only record what your browser transmits of its own accord with the request: the date of the scan, the sticker's code, your IP address reduced to its network (the last digits are replaced with zero, which does not allow you to be identified) and your browser type. This information is linked to no account and is not used to recognise you from one visit to the next: the resulting figure is a number of scans, never a number of people. Purpose: measuring each partner's activity. Legal basis: legitimate interest (Article 6.1.f GDPR). Retention: 13 months. As this concerns information transmitted spontaneously by your browser, and not access to your terminal, this processing does not fall under Article 82 of the French Data Protection Act.

13. Minors

The CoVœur Service is reserved for adults (18 years or older). We do not knowingly collect personal data regarding minors. If you become aware that a minor has used the Service, please inform us so that we can take the necessary measures.

14. Changes to this policy

CoVœur reserves the right to modify this Privacy Policy. Any material change will be communicated via WhatsApp. We encourage you to check this page regularly.

15. Contact

For any question related to the protection of your data: contact us via our contact form.