Introduction
In accordance with Article 30 of the General Data Protection Regulation (GDPR), CoVœur keeps a record of processing activities. This record lists all personal data processing carried out as part of the CoVœur Service.
Data controller: NOproBS, SASU with share capital of €1,000, Paris Trade Register 984 241 075, registered office in Paris, France — contact form
Processing of personal data
1. User management and onboarding
| Purpose | Creating and managing the user profile during the first interaction with CoVœur |
| Legal basis | Performance of a contract (Art. 6(1)(b) GDPR) |
| Data processed | WhatsApp phone number, first name, relationship status (single / in a relationship) |
| Data subjects | Users of the CoVœur Service |
| Retention period | Duration of use of the Service + 12 months |
| Recipients | CoVœur team, Meta (WhatsApp Business API), Microsoft Azure (hosting) |
| Transfers outside the EU | Yes, residual — Meta (messaging): since 01/10/2026 data localization is enabled and data at rest is stored in Germany (European Union). A bounded transfer remains, which the setting does not remove: up to 60 minutes of processing on international data centres while a message is in transit, and contact lists on Meta's servers. Covered by the standard contractual clauses. |
2. Individual relational assessment (individual assessment)
| Purpose | Collecting responses to the relational self-assessment questionnaire and generating the personalized Relational Profile by AI |
| Legal basis | Performance of a contract (Art. 6(1)(b) GDPR) |
| Data processed | Questionnaire responses (15 questions), first name, generated Relational Profile |
| Data subjects | Users who completed the individual questionnaire |
| Retention period | Duration of use of the Service + 12 months |
| Recipients | CoVœur team, Microsoft Azure OpenAI (AI processing — Switzerland, recognized as adequate), Microsoft Azure (hosting) |
| Transfers outside the EU | Yes — Switzerland, a country recognized as adequate by the European Commission (adequacy decision), which allows the transfer without further safeguards. The transfer is limited to the AI model processing described above. |
3. Combined Couple Assessment
| Purpose | Connecting two partners, collecting relationship context, generating the personalized Couple Assessment by AI |
| Legal basis | Performance of a contract (Art. 6(1)(b) GDPR) + consent for sharing with the partner (Art. 6(1)(a) GDPR) |
| Data processed | Relational Profiles of both partners, relationship context, relationship duration and status, combined assessment generated |
| Data subjects | Users who initiated or accepted a Couple Assessment |
| Retention period | Duration of use of the Service + 12 months |
| Recipients | CoVœur team, Microsoft Azure OpenAI (AI processing — Switzerland, recognized as adequate), Microsoft Azure (hosting) |
| Transfers outside the EU | Yes — Switzerland, a country recognized as adequate by the European Commission (adequacy decision), which allows the transfer without further safeguards. The transfer is limited to the AI model processing described above. |
4. Analysis of WhatsApp conversations
| Purpose | Optional analysis of a WhatsApp conversation exported by both partners, with prior anonymization, to enrich the Couple Assessment |
| Legal basis | Explicit consent from both partners (Art. 6(1)(a) GDPR) |
| Data processed | Exported WhatsApp conversation. Anonymization is performed in RAM (memory) on our servers — first names, addresses, and phone numbers are replaced with neutral identifiers (Partner A / Partner B, [CITY], [NUMBER]…) before transmission to the AI model. The raw (non-anonymized) version is not stored persistently; only the anonymized version may be retained for analysis purposes. |
| Data subjects | Users who consented to the analysis of their WhatsApp conversation (bilateral consent required) |
| Retention period | Raw data: deleted after analysis. Analysis results: up to 12 months. |
| Recipients | CoVœur team, Microsoft Azure OpenAI (AI processing — anonymized data only — Switzerland, recognized as adequate), Microsoft Azure (hosting) |
| Transfers outside the EU | Yes — Switzerland, a country recognized as adequate by the European Commission. The transfer is limited to the anonymized version of the conversation. |
5. Coaching programs and follow-up
| Purpose | Sending personalized programs, exercises, reminders, and follow-ups via WhatsApp for personal and couple development |
| Legal basis | Performance of a contract (Art. 6(1)(b) GDPR) |
| Data processed | WhatsApp number, history of programs taken, progress, responses to exercises |
| Data subjects | Users subscribed to a coaching program |
| Retention period | Program duration + 12 months |
| Recipients | CoVœur team, Meta (WhatsApp Business API), Microsoft Azure OpenAI (AI processing — Switzerland, recognized as adequate) for drafting follow-up summaries, Microsoft Azure (hosting) |
| Transfers outside the EU | Yes — Switzerland, a country recognized as adequate by the European Commission (adequacy decision), which allows the transfer without further safeguards. The transfer is limited to the AI model processing described above.
Yes, residual — Meta (messaging): since 01/10/2026 data localization is enabled and data at rest is stored in Germany (European Union). A bounded transfer remains, which the setting does not remove: up to 60 minutes of processing on international data centres while a message is in transit, and contact lists on Meta's servers. Covered by the standard contractual clauses. |
6. Security and technical logs
| Purpose | Service security, abuse detection, and technical maintenance |
| Legal basis | Legitimate interest (Art. 6(1)(f) GDPR) |
| Data processed | Server logs (IP addresses, timestamps, requests) |
| Data subjects | All users of the Service |
| Retention period | 3 months |
| Recipients | CoVœur technical team, Microsoft Azure (hosting) |
| Transfers outside the EU | None |
7. Vigilance — identifying serious situations
| Purpose | Identify in messages the signs of distress, violence or risk to a third party, in order to direct the person towards human help and not leave them alone with an automated system. No commercial purpose, no profiling. |
| Legal basis | Explicit consent (Art. 9(2)(a) GDPR), collected separately during sign-up formalities; vital interests of the data subject (Art. 9(2)(c) GDPR) |
| Data processed | Special categories (Art. 9): mental health (expressed distress, psychological follow-up mentioned), emotional and sexual life, reported violence. Verbatim extract of the message that triggered the signal, date, level, review status and acknowledgement. |
| Data subjects | Users of the Service. Incidentally, third parties they mention (partner, former partner) where the signal concerns a risk to others — their contact details are never reproduced and are masked in the interface. |
| Retention period | Duration of use of the Service, then deletion on request. The triggering extract is kept as long as the signal has not been acknowledged, so that a human review can verify that it was warranted. |
| Recipients | CoVœur team; Microsoft Azure OpenAI (AI processing — Switzerland, recognized as adequate), which analyses messages to detect signals — our processor, not a recipient making its own use of the data. No disclosure to any third party, nor to emergency services: the person is directed to them, they are never reported to them. ; Meta (WhatsApp Business API) for message delivery |
| Transfers outside the EU | Yes — Switzerland, a country recognized as adequate by the European Commission (adequacy decision), which allows the transfer without further safeguards. The transfer is limited to the AI model processing described above.
Yes, residual — Meta (messaging): since 01/10/2026 data localization is enabled and data at rest is stored in Germany (European Union). A bounded transfer remains, which the setting does not remove: up to 60 minutes of processing on international data centres while a message is in transit, and contact lists on Meta's servers. Covered by the standard contractual clauses. |
8. Open conversation
| Purpose | Personalized support through open conversations with CoVœur’s AI (coaching, emotional support, relational exercises) |
| Legal basis | Performance of a contract (Art. 6(1)(b) GDPR) |
| Data processed | WhatsApp number, history of coaching conversations, detected topics, weekly summaries |
| Data subjects | Users with access to conversational coaching (free tier limited to 10 exchanges, then subscription) |
| Retention period | Rolling 12 months (messages older than 12 months are deleted automatically) |
| Recipients | CoVœur team, Microsoft Azure OpenAI (AI processing — Switzerland, recognized as adequate), Microsoft Azure (hosting) ; Meta (WhatsApp Business API) for message delivery |
| Transfers outside the EU | Yes — Switzerland, a country recognized as adequate by the European Commission (adequacy decision), which allows the transfer without further safeguards. The transfer is limited to the AI model processing described above.
Yes, residual — Meta (messaging): since 01/10/2026 data localization is enabled and data at rest is stored in Germany (European Union). A bounded transfer remains, which the setting does not remove: up to 60 minutes of processing on international data centres while a message is in transit, and contact lists on Meta's servers. Covered by the standard contractual clauses. |
9. Therapist records (notes and follow-up summaries)
| Purpose | Creating psychological follow-up notes and summaries for partner professionals (therapists, coaches) to support users |
| Legal basis | Performance of a contract (Art. 6(1)(b) GDPR) + legitimate interest in improving the quality of support (Art. 6(1)(f) GDPR) |
| Data processed | Synthesized summaries of conversations and assessments, Relational Profile, notes from partner professionals |
| Data subjects | Users who completed an individual or couple assessment |
| Retention period | Duration of use of the Service + 12 months, then deletion on request |
| Recipients | CoVœur team, authorized partner professionals, Microsoft Azure OpenAI (AI processing — Switzerland, recognized as adequate) for drafting summaries, Microsoft Azure (hosting) |
| Transfers outside the EU | Yes — Switzerland, a country recognized as adequate by the European Commission (adequacy decision), which allows the transfer without further safeguards. The transfer is limited to the AI model processing described above. |
10. Sharing reports with a prescribing practitioner
| Purpose | Allow the therapist whose invitation code the user used to consult the reports generated by CoVœur, in order to support their patient with full knowledge of the situation |
| Legal basis | Explicit consent (Art. 6(1)(a) GDPR; Art. 9(2)(a) for data relating to health and intimate life). Being linked to a practitioner opens no access by itself |
| Data processed | Reports generated by CoVœur (profile, assessments, pacts) and their summary. Excluded: conversations with CoVœur, which are never shared |
| Data subjects | Users who arrived through a practitioner's invitation code and gave their consent |
| Scope of consent | Name-specific: it applies to the practitioner designated at the time it is given, never to another |
| Withdrawal | At any time, by WhatsApp message. Immediate effect on access, with no prior human intervention. Full detachment from the account is then carried out by the team |
| Proof of consent | Append-only internal register: consent, refusal and withdrawal, each dated and linked to the practitioner concerned (Art. 7(1) GDPR) |
| Retention period | Access remains active until consent is withdrawn. Entries in the consent register are kept for 3 years after the end of the relationship, as evidence |
| Recipients | The designated prescribing practitioner, the CoVœur team, Microsoft Azure (hosting) |
| Transfers outside the EU | None |
11. Internal evaluation of wording (replay)
| Purpose | Check and improve the quality of our replies and of the referrals we make, in particular the Service's ability to identify situations that exceed its scope (distress, violence, risk to a third party) and to direct people towards a professional or a dedicated service. Past exchanges are replayed to compare several formulations. No commercial purpose, and no effect on the person whose exchange is replayed. |
| Legal basis | Legitimate interest (Art. 6(1)(f) GDPR); for content falling within the special categories, explicit consent (Art. 9(2)(a) GDPR) collected during sign-up formalities |
| Data processed | Extracts of exchanges stripped of first names, contact details and identifiers (phone numbers, e-mail addresses, postal addresses, IBANs, social security numbers, amounts); first names in the record are replaced by tokens (USER, PARTENAIRE, PROCHE_n). The phone number is never transmitted: it is only used as a lookup key in the database. The content may fall within the special categories (Art. 9) — mental health, emotional life, reported violence. |
| Data subjects | Users whose exchange is selected for a replay, and the third parties they mention, whose identifying elements are removed before any transmission |
| Retention period | Comparison reports kept internally for the duration of the quality work they relate to, then deleted |
| Recipients | CoVœur team; Anthropic PBC (United States) as provider of the evaluation model |
| Transfers outside the EU | Yes — United States, covered by the European Commission's standard contractual clauses. The transfer is limited to the extracts described above, run manually. This data is not used for model training. |
| Nature of the processing | The extracts transmitted are pseudonymized, not anonymous: the recipient cannot link them to a person, but the report kept internally does |
12. Transcription of voice messages
| Purpose | Convert the voice messages you send into text, so the Service can respond to them as it would to a written message. Without this conversion, a voice message cannot be read. |
| Legal basis | Performance of the contract (Art. 6(1)(b) GDPR); for content falling within special categories, explicit consent (Art. 9(2)(a) GDPR) obtained during sign-up formalities |
| Data concerned | The voice recording itself, transmitted as is to the transcription service, then the resulting text. The recording is not retained by CoVœur after transcription. The content may fall within special categories (Art. 9) — mental health, emotional life, reported violence. |
| Data subjects | Users who send voice messages, and the third parties they mention in them |
| Retention period | The transcribed text follows the retention period of the exchange it belongs to (see processing no. 8). The recording is not retained. |
| Recipients | CoVœur team; Microsoft Azure OpenAI (Whisper, Netherlands) as the transcription service provider |
| Transfers outside the EU | No — transcription takes place in the Netherlands, within the European Union |
| Nature of the processing | No account identifier accompanies the recording transmitted; the content of the message may nonetheless make the speaker identifiable |
Sub-processors
CoVœur uses the following sub-processors as part of its processing activities:
| Sub-processor |
Role |
Location |
GDPR safeguards |
| Microsoft Azure OpenAI |
Generation of AI analyses, reports and conversations, and analysis of warning signals |
Switzerland — country recognized as adequate by the European Commission |
GDPR-compliant DPA |
| Microsoft Azure OpenAI (Whisper) |
Transcription of voice messages into text (processing no. 12) |
Netherlands — European Union |
GDPR-compliant DPA |
| Anthropic PBC |
Model used for the internal evaluation of wording (processing no. 11) — extracts stripped of first names, contact details and identifiers |
United States |
GDPR-compliant DPA and standard contractual clauses; data not used for model training |
| Meta (WhatsApp Business API) |
WhatsApp messaging infrastructure |
Contracting entity: Ireland (European Union). Data at rest: Germany (European Union) — data localization enabled on 01/10/2026 and verified. Residual processing on international data centres while in transit (up to 60 min), and contact lists on Meta's servers |
GDPR-compliant DPA and the European Commission's standard contractual clauses; content retained for at most 30 days; encryption at rest. Messages are not end-to-end encrypted ("business hosted by Meta" configuration) |
| Microsoft Azure |
Backend hosting, database, storage |
France (France Central region) |
GDPR-compliant DPA — data hosted in France |
| Stripe |
Payment processing (subscriptions and one-off purchases) |
Ireland — European Union |
GDPR-compliant DPA |
Your rights
Under the GDPR, you have rights over your personal data (access, rectification, erasure, portability, objection, restriction). To exercise these rights, see our Privacy Policy or contact us via our contact form.
You can also lodge a complaint with the CNIL: www.cnil.fr.
