Home/Privacy Policy

Privacy policy

YOUVANNA — Registered office: 54 avenue Ambroise Yzeux, 72000 Le Mans, France — SAS with capital of €1,000.00 — 990 812 505 RCS Le Mans

Last updated: September 2026

1. Purpose

YOUVANNA, as data controller (hereinafter “YOUVANNA”, “We” or the “Data Controller”), pays particular attention to the protection of the personal data that you provide to it or that it may collect.

YOUVANNA undertakes to guarantee the confidentiality and security of your personal data in accordance with Regulation 2016/679 of 27 April 2016 on data protection and with French Law No. 78-17 of 6 January 1978, as amended, relating to information technology, files and freedoms (hereinafter referred to as the “Regulations”).

This privacy policy (hereinafter referred to as the “Privacy Policy”) is intended to inform you about the processing of your personal data carried out by YOUVANNA.

You are invited to read this document before submitting your personal data to Us.

2. Definitions

Personal data (hereinafter referred to as “Data”): Any information relating to an identified or identifiable natural person by reference to an identification number or to one or more elements specific to them (the “Data Subject”);
Recipient: A natural or legal person, public authority, agency or any other body authorized to receive Data recorded in a file or processing by reason of its functions;
Data Subject: A natural person identified or identifiable directly or indirectly;
Data Controller: A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing;
Processor: A natural or legal person, public authority, agency or other body to which the Data Controller entrusts Processing operations on its behalf;
Processing: Any operation or set of operations performed or not by automated means and applied to Data or sets of Data carried out on behalf of the Data Controller, such as collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or interconnection, restriction, erasure or destruction.

3. Identity of the Data Controller

YOUVANNA, a simplified joint-stock company, registered with the Trade and Companies Register of Le Mans under number 990 812 505, whose registered office is located at 54 avenue Ambroise Yzeux, 72000 Le Mans, is the Data Controller of your Data.

When you provide Us with Data as part of using the “adrevia” solution (accessible from the following URL: https://adrevia.com/en) (hereinafter referred to as the “Solution”), you are the Data Subject.

You can contact our DPO regarding the protection of your Data at the following email address: dpo@adrevia.com.

4. What personal Data is collected? When is it collected?

We collect and process the following Data:

Identification data: last name, first name, photo, email address, mobile phone number;
Professional life: professional email address, company name, company website, logo, brand, professional social media profile;
Connection data: (administrator) username and password for connecting to the Solution, OAuth tokens;
Usage and origin data: where your sign-up came from (ad, campaign, keyword, landing page, click identifiers), pages viewed and actions in the app (with your “Analytics” consent), errors encountered, meetings booked with our team;
Data relating to Solution customer support: history of your support requests.

We collect and process your Data in particular when:

You create your account on the Solution;
You connect your account on the Solution to your third-party social media accounts;
You use the WhatsApp conversational agent¹;
You arrive on the website from an ad or a link, then sign up;
You book a meeting with our team;
You contact Us via the Solution's customer support.

¹ The WhatsApp conversational agent uses artificial intelligence (AI) technologies.

5. What are the purposes? How long is the Data kept?

Below you will find the legal bases and retention periods that We apply to the Processing carried out on your Data:

Processing	Purpose(s) of the processing	Legal basis(es)	Retention
Account management on the Solution	Management of the creation of your account on the Solution — Management of your login to your account on the Solution — Update of your account information on the Solution	Contract (Subscription)	Duration of your contractual relationship with YOUVANNA plus 5 years for evidentiary purposes
Connection to third-party social networks	Management of the connection of your account on the Solution to your third-party social network accounts (Facebook, Instagram, LinkedIn and Google Business Profile) via the “OAuth 2.0” authentication protocol	Legitimate interest	Validity period of the Token plus 30 days
Conversation with the WhatsApp conversational agent	Management of conversations with the WhatsApp conversational agent — Management of requests made to the WhatsApp conversational agent	Contract	Duration of your contractual relationship with YOUVANNA plus 5 years for evidentiary purposes
Billing	Issuing invoices — Sending invoices	Legal obligation (Article L. 123-22 of the French Commercial Code)	10 years from the end of the financial year
Customer support of the Solution	Management and follow-up of customer support requests for the Solution	Contract	Kept in our support inbox, with no automatic deletion — Deletion on request at dpo@adrevia.com
Requests to exercise rights	Responses to requests to exercise rights — Follow-up and documentation of requests to exercise rights	Legal obligation	Time needed to handle the request plus 5 years for evidentiary purposes
Commercial follow-up of accounts created without a subscription	Messages sent by a member of the team about the account created on the Solution and about the Solution itself, as long as no Subscription has been taken out — Tracking of replies, objections and clicks on the meeting booking link	Legitimate interest (Article 6(1)(f) GDPR) and Article L. 34-5 of the French Postal and Electronic Communications Code: prospecting aimed at professionals about the service for which the account was created — Objection at any time, through the link in every message or by writing to dpo@adrevia.com	3 years from the last contact — The objection is kept without time limit so that it is honoured
Audience measurement of the public website (adrevia.com)	Anonymous counting of page views, sections seen and button clicks on the public website, with no cookie or storage on your device and no persistent identifier — Website improvement	Legitimate interest (Article 6(1)(f) GDPR) — No cookie or tracker is set (exemption under Article 82 of the French Data Protection Act); the IP address is discarded on receipt by our processor PostHog (hosted in the European Union, anonymisation enabled) and only the browser and operating-system family is kept, for counting purposes	Kept by our processor PostHog for the duration of our plan, with no identifier that could single you out and nothing linked to an account — Deleted on request to dpo@adrevia.com
Trial follow-up message	One message from our team to the workspace owner, in French and only if they use the Solution in French, once, ten to twelve days after the trial started if the subscription is still live, to ask how getting started is going and to offer a meeting — Measurement of whether it was opened (an image in the message tells us) and of clicks on its links, as for the invoice and end-of-subscription emails	Legitimate interest (Article 6(1)(f) GDPR: supporting our customers) — Objection at any time, through the opt-out link at the foot of the message (which also stops the commercial follow-up) or by writing to dpo@adrevia.com	As long as the workspace exists: the message and its measurement are erased with it
Direct messages from our team	A message written by a member of our team from our inbox to a person registered on the Solution, about the Solution: their email address, their name, the subject and text of the message and, if they reply, their reply	Legitimate interest (Article 6(1)(f) GDPR) and Article L. 34-5 of the French Postal and Electronic Communications Code: prospecting aimed at professionals about the service for which the account was created — Objection at any time: by replying to the message, through the opt-out link of our follow-up emails, or by writing to dpo@adrevia.com	Kept in our inbox, with no automatic deletion — Deletion on request at dpo@adrevia.com; the objection is kept without time limit so that it is honoured
Measuring the opening of our service emails	Knowing whether our service emails are read: the email of your invoice, the end-of-subscription notices (upcoming and effective), the monthly report of your social networks, the ideas of your editorial plan and, for the store of an agency network, the connection link the agency sends you contain a small image specific to each sending; when your email client displays it, we record the date of the first opening and the number of openings of that sending, linked to your workspace	Legitimate interest (Article 6(1)(f) GDPR: checking that our service emails arrive and are read) — To prevent it, block the display of images in your email client	As long as the workspace exists: the sending and its measurement are erased with it
Meeting booking	Booking a meeting with our team from a message or the website: the booking goes through Cal.com, which collects your name, your email address, the chosen slot and anything you add to the form; we receive the booking or cancellation notice and link it to the message it came from	Pre-contractual steps taken at your request, or performance of the contract if you are a customer (Article 6(1)(b) GDPR)	3 years from receipt of the booking notice
Analytics of the app (app.adrevia.com)	Understanding how the app is used in order to improve it: pages viewed and actions, linked to your account (identifier, email address, name, sign-up and last sign-in dates, subscription plan); when an error occurs in your browser, recording of the session from that moment on, with input fields masked	Your consent (“Analytics” category of the cookie banner), which you can withdraw at any time with the “Manage cookies” link	Kept by our processor PostHog (hosted in the European Union) for the duration of our plan — Deleted on request to dpo@adrevia.com
Error monitoring of the Solution	Detecting and fixing errors: when an action of the Solution fails, our server sends PostHog the details of the error, your identifier, your email address, your name, your subscription plan and an excerpt of the data sent by the action	Legitimate interest (Article 6(1)(f) GDPR: keeping the Solution working and secure) — No cookie or tracker on your device	Kept by our processor PostHog (hosted in the European Union) for the duration of our plan — Deleted on request to dpo@adrevia.com
Measuring the effectiveness of our ads	Knowing where your account came from (ad, campaign, ad group, keyword, landing page, referring site, Google or Meta click identifier, _fbp browser identifier), recorded on your account at sign-up; if we had prepared a personalised demo for your company, your sign-up is linked to it by your email address — With your “Advertising” consent, reporting your sign-up and trial start to Meta, and your sign-up, the end of your onboarding, your trial start, the sending of a contact form, a click on our phone number and, if you came from one of its ads, your payments to Google, in order to measure and optimise our campaigns — this consent also lets Google and Meta show you our ads in a personalised way (retargeting); on the public website, the Meta Pixel also reports page views to Meta. Meta receives (Conversions API): the event and its time, the address of the page where it happens (the sign-up page or the app), an internal reference, a conventional value (1 for the sign-up, 2 for the trial start), your email address and an account identifier, hashed (SHA-256), the Meta click identifier and the _fbp identifier if they exist and, for the sign-up, your IP address and your browser. Google receives, from your browser, the event with your hashed email address (SHA-256), an internal reference (except for the click on our phone number) and the address of the page, without what we remove from it (see the Google tag below), and, if you came from one of its ads, from our server (Google Data Manager): the click identifier, the time of the event, an internal reference and its value in euros (the amount paid, for a payment)	Recording the origin on your account: legitimate interest (Article 6(1)(f) GDPR: measuring the effectiveness of our campaigns), including when you have not yet answered the cookie banner — the landing page, kept in memory by your browser without writing anything to it, then comes with your sign-up, and is removed from your sign-in profile as soon as your account has recorded it (the sign-in token already issued keeps a copy until it is renewed, one hour at most); a sign-up never confirmed may keep it in that profile until that sign-up is deleted, without it being sent to Meta or Google — Reports to Meta and Google: your consent (“Advertising” category of the banner), checked at the time of each report and withdrawable at any time with the “Manage cookies” link; a refusal or a withdrawal erases the click identifiers, the _fbp identifier and the referring site from your account; a withdrawal made on adrevia.com applies to your account on your next visit to the app	Click identifiers, _fbp identifier and referring site: 13 months after they were recorded on your account, at sign-up, then erased — Ad, campaign, ad group, keyword and landing page: for the lifetime of your account
Google tag without cookies (Consent Mode)	On adrevia.com and app.adrevia.com, the Google tag loads even without your consent, but then neither reads nor writes any cookie. It then sends Google, without cookies: the address of each page viewed and that of the page you came from, from which we remove payment identifiers, tokens, codes and the name of your workspace, and the name of the page, taken from that address (never its title); the time, your browser's user agent, the state of your consent, information about the site's consent platform and a random number drawn for each page; and four steps — the click on the phone number of the Contact page, the sending of the contact form, the end of your onboarding and the start of your trial —, each with an internal reference (that of your contact request or of your account), except the click on the phone number. Your sign-up is reported to it only with your “Advertising” consent. On these occasions, Google sees your IP address; the tag also carries the click identifier of a Google ad in the address of the website's pages. Google uses them to estimate the conversions of its ads, in aggregate	Legitimate interest (Article 6(1)(f) GDPR: measuring the effectiveness of our ads without any tracker on your device) — Refusing the “Advertising” category does not stop these signals: to prevent them, block the googletagmanager.com scripts in your browser	Set by Google; these signals are not returned to us individually

6. Who are the recipients of the Data?

Your personal data may be transmitted to:

Internal recipients: your Data may be transmitted to the authorized departments and personnel of YOUVANNA, to achieve the purposes defined in the Privacy Policy. Only the Data strictly necessary to achieve these purposes is transmitted to them;
External recipients: your Data may be transmitted to external services, Processors, providers, suppliers or partners of YOUVANNA, to achieve certain purposes defined in the Privacy Policy. Only the Data strictly necessary to achieve these purposes is transmitted to them;
Advertising platforms and measurement providers: Meta Platforms Ireland Ltd and Google Ireland Ltd receive, with your “Advertising” consent, the reports described in section 5, and Google the cookieless signals of its tag; PostHog (hosted in the European Union) measures the app's audience and monitors its errors; Cal.com handles meeting bookings.

7. What protection applies if the Data is transferred outside the European Union?

Your Data may be transferred outside the European Union. YOUVANNA implements all necessary safeguards to protect your Data, either by transferring it only to countries that the European Commission has recognized as offering an adequate level of protection, or by framing its transfer through the European Commission's standard contractual clauses.

8. What are your rights?

In accordance with the Regulations, you have the rights of access, rectification, erasure and portability of your Data, restriction and objection to the processing of your Data, and the right to issue directives concerning the storage, erasure and communication of your Data after your death.

When the Processing is based on your consent, you have the right to withdraw your consent at any time without affecting the lawfulness of the Processing carried out before the withdrawal of your consent.

You also have the right to lodge a complaint with the French Data Protection Authority (CNIL). For more information about your rights, consult the CNIL website accessible from the following URL: cnil.fr.

Rights may be exercised:

By email at the following address: dpo@adrevia.com;
By post at the following address: YOUVANNA, 54 avenue Ambroise Yzeux, 72000 Le Mans, France.

When exercising your rights, you must prove your identity by any means. In case of doubt about your identity, YOUVANNA reserves the right to ask you for additional information it deems necessary for your identification, in particular a photocopy of your identity document.

If you believe, after having contacted Us, that your rights under the French Data Protection Act are not respected, you can address a complaint to the CNIL.

See also our Terms of Service and our Cookie Policy.