Skip to content
Constellia
Book a demo

Privacy Policy

Last updated: October 29, 2026. This English version is provided for convenience; the French version prevails.

1. Who we are and what this policy covers

CONSTELLIA, a French simplified joint-stock company (SAS) with a share capital of EUR 1,000, registered with the Paris Trade and Companies Register under number 938 577 137, with its registered office at 61 rue de Lyon, 75012 Paris, France ("CONSTELLIA", "we"), publishes Orion, an AI-powered sales assistance service for businesses (the "Service").

This policy describes how we process the personal data of:

  • visitors to our website and online services (constellia.ai, cnstl.ai and their subdomains);
  • people who create an account for, administer or use the Service (admin console and Orion desktop app);
  • our prospects, customers, suppliers and partners, and their contacts;
  • people in contact with our customers, as described in section 10.

It supplements the General Terms of Use ("Terms of Use"), the General Terms of Sale ("Terms of Sale") and the Data Processing Agreement ("DPA") entered into with our customers.

2. Our two roles: controller and processor

When we act as controller. We determine the purposes and means of the processing described in sections 3 to 9: account management, billing, security, support, business relationships and the operation of our websites. This policy applies in full to that processing.

When we act as processor. The data that our customers and their users entrust to the Service (data synchronized from their CRM and calendars, documents in their knowledge base, conversations with the assistant, meeting recordings and transcripts kept by their users) is processed on behalf of our customers and on their instructions. Each customer is the controller of that data; our obligations are set out in the DPA. If you are in contact with one of our customers, see section 10.

3. What data we process, why, and on what legal basis

Account creation and management

  • Purpose: authentication, license assignment, settings for administrators and users.
  • Data: first and last name, business email address, business phone number, identifier of the CRM account used to sign in, role, language, time zone, sign-in dates.
  • Legal basis: performance of the contract (Terms of Use).
  • Retention: for the term of the contract, then deleted within 90 days after it ends (same period after a trial that does not turn into a subscription).

Proof of acceptance of contractual documents

  • Data: user identifier, document version, date and time, IP address, browser.
  • Legal basis: legitimate interest (evidence and defense of our rights) and legal obligation.
  • Retention: term of the contract plus 5 years.

Billing, payment and collection

  • Data: company name, registration number, address, VAT number, name and contact details of the billing contact, invoice and payment history. Card and IBAN data is collected and stored only by our payment provider, Stripe.
  • Legal basis: performance of the contract (Terms of Sale) and legal obligations (accounting and tax).
  • Retention: 10 years from the end of the financial year (accounting records).

Service emails

  • Purpose: activation, billing notifications, usage alerts, contractual updates.
  • Data: name, email address, content of the notifications.
  • Legal basis: performance of the contract.
  • Retention: 12 months for sending logs.

Support, bug reports and complaints

  • Data: identity, email address, content of the exchanges.
  • Legal basis: performance of the contract and legitimate interest (improving the Service).
  • Retention: 3 years after the request is closed.

Security, fraud and abuse prevention, technical logging

  • Data: IP address, technical identifiers, connection and usage logs.
  • Legal basis: legitimate interest (security) and legal obligation.
  • Retention: 12 months at most.

Usage statistics and Service improvement

  • Data: aggregated usage data (features used, volumes, credit consumption), without the content of conversations.
  • Legal basis: legitimate interest (improving the Service).
  • Retention: 12 months for raw data; aggregated or anonymized data is kept without limit.

Prospecting and business relationships with professionals

  • Purpose: first contact, demos, sales follow-up, newsletters.
  • Data: identity, job title, company, business contact details, history of exchanges, source of the contact.
  • Legal basis: legitimate interest (developing our business); consent for newsletters where required.
  • Retention: 3 years from the last contact or exchange.

Supplier and partner management

  • Data: identity and business contact details of contact persons, contractual data.
  • Legal basis: performance of the contract and legitimate interest.
  • Retention: duration of the relationship plus 5 years.

Operation of our websites and console

  • Data and retention: see section 6.
  • Legal basis: legitimate interest (operating the service you request) for strictly necessary trackers; consent for the others.

Account data is collected when the account is created, from the CRM account (HubSpot) of the person who signs up or signs in, with their authorization, or entered by the administrator when inviting a user. Prospecting data comes from our direct exchanges, our websites, our partners or public professional sources (company websites, professional social networks, directories).

Information marked as required when creating an account, subscribing or in our forms is needed to provide the Service or handle your request: without it, we cannot do so.

We do not make any decision that produces legal effects concerning you or similarly significantly affects you based solely on automated processing.

4. Artificial intelligence features

The Service uses generative AI models provided by third parties and run on infrastructure located in the European Union. Only the data needed for each request is sent to the models. Neither CONSTELLIA nor its providers use the data of our customers or their users to train or improve AI models. Generated content is decision support, meant to be reviewed by users.

5. Recipients and processors

Data is accessible, within the limits of their duties, to authorized members of the CONSTELLIA team and to our processors, bound by contract:

  • hosting, storage and running AI models: Amazon Web Services, in the European Union;
  • payment and billing: Stripe, in the European Union, with safeguarded intra-group transfers to the United States;
  • sending service emails: an email delivery provider, in the European Union;
  • web search and business contact verification: specialized providers, in the European Union or outside it with the safeguards described in section 7;
  • hosting and audience measurement for the constellia.ai website: Vercel, Google and Microsoft, in the European Union and the United States;
  • managing our own business relationships: our CRM and our email and video conferencing tools, in the European Union and the United States.

The up-to-date list of our processors, by name, is available on request at contact@constellia.ai.

We may also disclose data to authorities when required by law, to our advisers bound by professional secrecy and, in the event of a merger or sale, to the acquirer under the conditions provided by law.

Our customers choose the services they connect to the Service (for example HubSpot, Google Workspace or Microsoft 365); those providers process data under their own terms. Orion's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Cookies and trackers

Admin console and app (orion.constellia.ai). No advertising cookies or third-party audience measurement tools are used. Only trackers strictly necessary to provide the service you request are set, and they do not require consent:

  • Sign-in and session security: until you sign out, at most 24 hours (7 days if you choose to stay signed in).
  • Protection against forged requests: for the session.
  • Sign-in with your CRM account: a few minutes, while you sign in.
  • Display preferences: your language for 1 year; the light or dark theme stays in your browser.
  • Payment: on payment pages, our provider Stripe sets its own cookies to secure payments and prevent fraud, under its own policy.

constellia.ai website. Audience measurement and browsing analytics tools (Vercel Analytics, Vercel Speed Insights and, through Google Tag Manager, Microsoft Clarity) are loaded only after you consent through the banner shown on your first visit. You can withdraw consent at any time from that banner. Google reCAPTCHA Enterprise is loaded on our contact form to protect it against bots and abuse.

7. Transfers outside the European Union

Service data is hosted in the European Union. The constellia.ai website is hosted by Vercel (United States), and some of our providers are based outside the European Union or may access data remotely (support, administration). These transfers rely on the mechanisms of Chapter V of the GDPR: an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified organizations) or the standard contractual clauses adopted by the European Commission, with additional measures where needed. You can obtain a copy of the applicable safeguards by contacting us.

8. Security

We protect data with measures appropriate to the risks: hosting in the European Union, encryption of data in transit and at rest, separation of each customer's data, access control, logging and backups. The measures applying to our customers' data are detailed in the DPA.

9. Your rights

Under the applicable regulations, you have the right to access, rectify and erase your data, to restrict its processing, to data portability and to object (in particular to direct marketing, at any time and without giving a reason), as well as the right to set instructions about your data after your death. Where processing is based on your consent, you can withdraw it at any time.

To exercise your rights or ask any question about this policy, write to contact@constellia.ai or by post to CONSTELLIA, 61 rue de Lyon, 75012 Paris, France. CONSTELLIA has not appointed a data protection officer, as this is not mandatory for its activities. We may ask for proof of identity if we have reasonable doubts about your identity. We reply within one month, which may be extended by two months for complex requests.

You can also lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr).

10. If you are in contact with one of our customers

Our customers are companies whose sales teams use Orion. If you are in contact with one of them (customer, prospect, partner, meeting participant), some of your data may be processed through the Service on its behalf: data from its CRM, meeting recordings, transcripts and summaries, business contact details. That company is the controller; CONSTELLIA acts as its processor and does not use your data for its own purposes. To exercise your rights, contact that company; if you contact us, we will forward your request to it.

A meeting is recorded only with your agreement, collected according to the rule the company has chosen: out loud at the start of the call, by email before the meeting, or declared by the sales rep. Without agreement, nothing is kept. During the call, the text of the conversation may be analyzed to check this agreement and to give the sales rep suggestions. If the sales rep keeps the recording, the audio and its transcript are stored in the European Union on behalf of their company, until the company deletes them. You can refuse the recording, or ask for it to stop, at any time.

11. Orion desktop app

The app records meetings and transcribes them on the user's computer; no audio is sent to a transcription service. Audio files stay on the computer only for the duration of the meeting: at the end, the user chooses to delete the recording or keep it. If kept, the audio and the transcript are sent to the Service and stored in the European Union until they are deleted from the app or the company's data is deleted. On first launch, the app downloads its transcription model from a public model repository, which sends only technical connection data; it also regularly checks our servers for updates (installed version, operating system). It contains no audience measurement or advertising tracking tools.

12. Minors

The Service is intended for professionals only; we do not knowingly collect data about people under 18.

13. Changes

We may update this policy to reflect changes in our services or in the regulations. The current, dated version is published on our website; material changes are notified to our customers' administrators.