Korem · An OpaleCrest house

Privacy policy

Last updated: 9 September 2026

This is a translation provided for convenience. In case of any discrepancy between language versions, the French version prevails.

This policy describes how your personal data is collected and processed when you use the Korem site (korem.opalecrest.com). The data controller is OpaleCrest, the trading name of Mathieu Corne, sole trader (SIREN 943 061 820), 50 avenue des Champs-Élysées, 75008 Paris, France. For any question about your data, write to privacy@opalecrest.com.

The data we collect

Account and identity (Opale ID) — access to your Korem space is through Opale ID. Opale ID is not an outside provider: it is a service we publish ourselves, under the same entity as Korem, carrying the identity and consents of all our products. It handles your account, your authentication and the consents attached to it. We process your account identifier and the email address linked to it in order to give you access to the service and attach it to your subscription.
Your notes — what you write in Korem about the people among your relations belongs to your private sphere, in the same way as a diary or a personal address book. Those notes are yours. Korem uses them to provide the service, and for that alone: to warn you of a date you recorded, and to present you, when the moment comes, what matches what you noted. That is the very object of your subscription. This processing stays inside your space, with the single exception of what speaking to the Office transmits, described below. Your notes are never passed to the partner houses: when you place an order with one of them, it receives what it needs to fulfil it, never what you wrote about the person. They are never passed to an advertiser and do not leave the European Union. They are not used today to train any artificial intelligence model; were that to change, we would inform you and obtain your agreement beforehand. The people you mention are not contacted by Korem, receive nothing from it and hold no account with it. You may view, correct, delete individually and export your notes at any time; if you close your account, they are erased.
What you say to the Office — you speak and Korem writes in your place. For that, and for that alone, two things leave Korem for a processor: the sound recording, to be turned into text, then that text, to be broken into what was said and about whom. That processor is Mistral AI, a public limited company registered in Paris (RCS 952 418 325), and we use its European endpoint: the processing takes place in the European Union. It undertakes contractually not to train its models on what is sent to it, and the corresponding option is turned off in our account. It acts on our instructions, with one exception we would rather state: it keeps what is sent to it for thirty days in order to detect abusive use of its service, and for that purpose alone it acts as controller of its own processing. What is never sent to it: your relations of value and the ties between people, the history of your attentions and your dates, and what you make of what Korem understood. The sound recording is never kept, neither by Korem nor by us: it is transcribed then destroyed. Speaking to the Office is part of the service you subscribe to: this transmission rests on the performance of your contract, not on a separate agreement you gave. Nothing leaves Korem outside the moments when you speak to it: you decide when, and the microphone stays under your device's control.
What the Office learns for you — when one of your relations lives for a subject you have no words for, Korem gives them a daily lesson: vocabulary, questions to ask. To do that, a subject label, never a person's name, is sent to Mistral AI, which may search the web to enrich it. What this produces, the content learned and, where applicable, the source consulted, is kept by Korem for as long as the subject stays active for your relations.
What someone says of you — if one of your relations describes you in a way you report to the Office ("they introduced me as…"), that sentence is kept, dated and attributed, without any note or judgement. It serves only to help you gauge what that person might still hold of you, given what they know.
Payment data — when you subscribe, payment is handled by Stripe. We never store your card number; we keep the billing email address, the amount, and the technical identifiers of the transaction.
Attribution data — when you subscribe, we keep an anonymous, aggregated record of where you came from (source, medium, campaign), with no link to your identity. If you consent to it, those parameters are additionally attached to your subscription so we can understand its precise origin.
Internal audience measurement — on each page viewed, we increment an aggregated, anonymous counter (page, day, source channel), with no cookie or identifier and no link to your identity. It serves only to measure traffic statistically.
Audience and advertising performance measurement (Google) — if you consent to it, a Google tag places a cookie to measure the page's traffic (Google Analytics) and signals to Google Ads that a subscription took place, with its amount, in order to measure how effective our advertising is. No data of this kind is transmitted without your consent.

Purposes and legal bases

Processing	Purpose	Legal basis
Account and access (Opale ID)	Authenticate and give access to the service	Performance of the contract (art. 6.1.b)
Your notes (contacts, attentions, milestones)	Keep and give back what you record, warn you of dates	Performance of the contract (art. 6.1.b)
What you say to the Office (transcription and analysis)	Turn what you dictate into notes, calling on a processor	Performance of the contract (art. 6.1.b): the feature is part of the service subscribed to
Data concerning the people among your relations	Give back to you what you yourself recorded about them, within your personal use	Legitimate interest (art. 6.1.f) — the member's interest in keeping the memory of their relationships, balanced against the rights of the people concerned
Suggestion drawn from a tie between two of your relations	Point out that a date or milestone concerning one of your relations may also concern another, based on a tie you yourself declared between them	Legitimate interest (art. 6.1.f) — yours, in keeping the memory of your relationships, balanced against the rights of the person the suggestion concerns; nothing is kept until you confirm it
Teaching a subject specific to a relation	Give you vocabulary and questions on a subject one of your relations practises, drawing where needed on a public search	Legitimate interest (art. 6.1.f) — yours, in understanding a relation's field, balanced against the rights of the person whose field is thus documented
What someone says of you, and where you stand yourself	Let you gauge what someone might still hold of you, against what you have become	Legitimate interest (art. 6.1.f)
Recommendations and occasions the Office proposes	Gather and prioritise what deserves your attention, from what you yourself recorded	Performance of the contract (art. 6.1.b)
Subscription	Perform and manage the subscription, contact you about it	Performance of the contract (art. 6.1.b)
Invoicing	Issue invoices, accounting obligations	Legal obligation (art. 6.1.c)
Named attribution (parameters linked to the subscription)	Understand the precise origin of a subscription	Consent (art. 6.1.a / art. 82 French Data Protection Act)
Aggregated origin (anonymous)	Measure the volume of subscriptions per channel	Legitimate interest (art. 6.1.f)
Internal audience measurement (anonymous, no cookie)	Aggregated traffic statistics per page and per channel	Legitimate interest (art. 6.1.f)
Audience measurement (Google Analytics)	Traffic statistics	Consent (art. 6.1.a / art. 82 French Data Protection Act)
Advertising performance measurement (Google Ads)	Measure and improve how effective our advertising campaigns are (conversion tracking)	Consent (art. 6.1.a / art. 82 French Data Protection Act)
Feedback on cancellation	Understand why people leave, in order to improve the service	Legitimate interest (art. 6.1.f)

Recipients

Your data is shared only with the providers required for the service to work. Opale ID is not one of them: we publish it ourselves, under the same entity, so your data is passed to nobody there. The providers are: Mistral AI (transcription and analysis of what you say to the Office, European endpoint), Stripe (payment), Supabase (database, hosted on AWS in the eu-west-1 region, Ireland, within the European Union), Resend (email delivery, eu-west-1 region, Ireland) and, subject to your consent, Google (Google Analytics for audience measurement and Google Ads for advertising performance measurement). We never sell your data.

Transfers outside the European Union

Your identity and account data — identifier, email address, subscription, payment — as well as all the contacts, attentions and milestones you record, are processed and hosted within the European Union. The same holds for what you say to the Office: the processor that transcribes and analyses it is established in France, and we use its European endpoint so the processing takes place within the Union. It may nonetheless call on processors of its own; the list is kept up to date by it and we are informed of its changes.

Audience and advertising performance measurement

If you consent to it, Google services (Google Analytics and Google Ads) may transfer certain browsing data to the United States. Nothing you record in Korem is passed to them: not your contacts, not the attentions, not the milestones. That transfer is framed by the EU–US adequacy decision (Data Privacy Framework), Google LLC being certified under that framework. Should that adequacy decision be invalidated or suspended, the transfers would rest on the standard contractual clauses adopted by the European Commission (decision 2021/914), together with the additional technical and organisational measures put in place by the provider.

If you refuse measurement cookies, no data leaves the European Union.

How long we keep it

Data	Duration
Transcript of what you said	90 days, then erased. That period allows the quality of the transcription to be checked and improved; it does not apply to the notes that came out of it, which you keep like any other
What Korem understood and you did not confirm	21 days, then let go
What a subject has learned (vocabulary, source consulted)	For as long as the subject stays active for your relations, then erased
Payment and invoicing	10 years (accounting obligation)
Account and subscription	Term of the contract + 5 years
Attribution and audience measurement	25 months for the data; the cookie has a lifetime of about 13 months (CNIL recommendation)

The people among your relations

The people you record in Korem hold no account there and are not informed by us of their presence in your space: we have neither their address nor any means of reaching them, and informing them would mean contacting them about a private space that is no concern of theirs (art. 14.5 b) GDPR). What you set down about them belongs to your private sphere and is accessible to you alone. We never contact them, send them nothing, cross-reference them with no other source, and build about them no profile, no score, no ranking. Should one of them write to us to exercise their rights, we answer them and inform you, and give you the assistance required. This policy stands as the information required by article 14 for anyone who comes to read it.

When you have declared a tie between two people among your relations (for instance, that they are related to one another), Korem may point out that a date concerning one of them could also concern the other. This connection is computed at the moment it is shown to you and is kept nowhere until you confirm it: a suggestion you ignore or decline leaves no trace. If you confirm it, the suggestion becomes data you have yourself validated, attached solely to the tie that produced it; it is never read outside that tie and never becomes a standalone profile of the person it concerns. It is deleted as soon as that tie, or either of the two people it links, is removed from your space.

Korem may notice on its own, from what you have already told it, that an introduction you made has paid off, and suggest you let the person who made it possible know. This suggestion is drafted at the moment it is shown to you and is never kept or passed on to that person: only the date on which the introduction paid off is kept, like any other date you have declared.

Your rights

Under the GDPR, you have a right of access, rectification, erasure, restriction, objection and portability of your data. To exercise them, write to privacy@opalecrest.com. We answer within one month (extendable by two months where the matter is complex, art. 12.3 GDPR); proof of identity may be requested. You may also lodge a complaint with the CNIL (cnil.fr).

Notification of a data breach

In the event of a breach of your data likely to create a risk to your rights, we notify the CNIL within 72 hours and inform you directly where the regulation requires it (art. 33-34 GDPR).

Managing your consents

The consents attached to your account are held centrally in Opale ID, where they are kept with a timestamp and can be changed at any time from your account. Speaking to the Office does not appear there: the feature is part of the service subscribed to, and so does not rest on a consent you could withdraw separately. The audience and advertising preferences you express on this site (banner) are attached to it as soon as you hold an account.

Cookies

The consent banner covers Google audience and advertising performance measurement (Google Analytics and Google Ads, which place a cookie) and the named attribution of your subscription. Absent consent, only anonymous, aggregated statistics are kept: page traffic and the origin of subscriptions, with no cookie or identifier. No non-essential tracker is activated without your agreement.

← Back