Datenschutzrichtlinie

1. Who we are and what this policy covers

This Privacy Policy explains how Corma SAS ("Corma", "we", "us") collects, uses, stores, shares, protects, retains and deletes personal data when you use the Corma web application, the Corma browser extension and the corma.io website (together, the "Service").

Corma SAS is a French company registered under SIREN 953 523 271, with its registered office at 90 Avenue Mozart, 75016 Paris, France. Corma develops and operates the Service, which automates license, identity and access management across the software applications used by organizations.

‍

By using the Service, you acknowledge the practices described in this policy. Where we rely on your consent, we ask for it separately and you can withdraw it at any time.

‍

2. Definitions

• Account: a unique account created for you or your organization to access the Service.
• Customer: the organization that subscribes to the Service and connects its software applications, including Google Workspace, to Corma.
• Google user data: any data obtained from a Google account or Google Workspace domain through Google APIs, after the user or a Google Workspace administrator has authorized access.
• Personal data: any information relating to an identified or identifiable individual, as defined by the GDPR.
• Sub-processor: a third-party company that processes personal data on Corma's behalf, under a written contract, only to help us provide the Service.
• Usage data: data collected automatically when the Service is used, such as pages viewed, timestamps and technical logs.
• You: the individual using the Service, or the organization on whose behalf that individual uses it.

3. Data we collect

Data you provide. Your name, work email address, company and role when you create an Account, request a demo or contact us.

Data from connected applications. When a Customer connects a software application to Corma, we collect identity and license metadata from it: user directory data (name, email, identifier, team, admin status), account creation and deactivation dates, permissions and roles, license types, last-activity timestamps and, where available, billing data. Data from Google specifically is described in Section 4.

Data from the Corma browser extension. When a Customer deploys the extension to its employees, it records the domains of software applications visited, visit timestamps, time on page and the authentication method used. It does not record page content, form inputs or passwords. This data is used only to detect the software applications in use within the Customer's organization.

Website and usage data. Our servers record the requested page, IP address, browser type, language and referring site. IP addresses are personal data under the GDPR. We use this data to operate, secure and troubleshoot the Service.

Corma as processor. For data collected from a Customer's applications and employees, Corma acts as a data processor on behalf of the Customer, under our Data Processing Agreement. The Customer is the data controller. We do not process special categories of personal data.

4. Google user data

Corma accesses Google user data only after you sign in with Google or a Google Workspace administrator authorizes the Corma integration. We access only the data needed for the features below, and use it only to provide and improve those features.

4.1 What Google user data we access

• Your basic profile (Google Sign-In: openid, email, profile). Your name, email address and profile picture, used to create your Account and sign you in.
• Workspace users (Admin SDK Directory API). Name, primary email, identifier, organizational unit, admin status, suspension status, creation date and last login time of users in your domain, used to build your organization's identity inventory and detect inactive or departed users.
• Groups (Admin SDK Directory API). Groups and group memberships, used to map access by team and to add or remove users from groups when your administrator requests it.
• Authorized third-party applications (Admin SDK Directory API, user security tokens). The name, client ID and granted scopes of applications users have authorized with their Google account, used to discover software in use (Shadow IT) and flag risky access.
• Audit events (Admin SDK Reports API). Login and application-access events (event type, timestamp, user, application), used to show last activity and detect unused licenses.
• License assignments (Enterprise License Manager API). Which users hold which Google Workspace licenses.
• Vendor invoices (Gmail API, read-only), only if you enable invoice detection. Sender, subject, date and attached invoice of emails from software vendors, used to detect software subscriptions and their cost.

Where a Customer's administrator asks Corma to provision or deprovision a user, Corma uses the Directory API to create, suspend or update that user account, or to change group membership, only as instructed.

We do not access the content of emails (other than vendor invoices, if enabled), Drive files, calendars, contacts or chats.

4.2 How we use Google user data

We use Google user data only to provide and improve the user-facing features of the Service:

• Signing you in and managing your Account
• Showing your organization's users, groups, applications and licenses in the Corma dashboard
• Detecting unused licenses, inactive accounts and unapproved applications, and alerting your administrators
• Running onboarding and offboarding workflows that your administrators configure
• Showing software spend, if invoice detection is enabled
• Security, fraud prevention and troubleshooting of the Service

Corma staff do not read Google user data, except with your explicit consent for a specific support request, when necessary for security purposes (such as investigating abuse), to comply with applicable law, or when the data has been aggregated and anonymized for internal operations.

4.3 What we never do with Google user data

We do not use, sell or transfer Google user data:

• For targeted, personalized, retargeted or interest-based advertising
• To data brokers or information resellers
• To determine creditworthiness or for lending purposes
• To create databases unrelated to providing the Service
• To develop, improve or train generalized or non-personalized AI or machine-learning models

4.4 With whom we share Google user data

We do not sell Google user data and do not transfer or disclose it to third parties for purposes other than those in Section 4.2. We share it only:

• With your organization's authorized administrators, who see it in the Corma dashboard.
• With our sub-processors, only to host and operate the Service, under written contracts that require confidentiality, security and GDPR compliance:
  • Amazon Web Services stores all Google user data held by Corma, including backups, in the Paris region (eu-west-3).
  • OpenAI and Mistral AI receive invoice documents only if invoice detection is enabled, solely to read vendor names, dates and amounts (see 4.5).
• When required by law, such as a valid court order, after verifying the request.
• In a merger, acquisition or sale of assets, only if the acquirer continues to comply with this policy and the Google API Services User Data Policy, and after notifying you.

4.5 AI and machine learning

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements, and the Google Workspace API User Data and Developer Policy. Corma does not use, transfer or sell Google user data, whether raw, aggregated or derived, to create, train or improve foundational or generalized artificial intelligence or machine-learning models. Corma does not use Google user data, including data obtained through Google Workspace APIs, to develop, improve or train generalized or non-personalized AI or machine-learning models.

If invoice detection is enabled, invoice documents may be sent to OpenAI or Mistral AI solely to extract vendor names, dates and amounts for your dashboard. This is inference only: the documents are processed in memory, are not stored by Corma after processing, and are not used by Corma or these providers to train models. Customers can choose which provider processes their data, or disable this feature.

4.6 How we store and protect Google user data

• Stored only on Amazon Web Services in the Paris region (eu-west-3). We do not replicate it outside the European Union; the only exception is invoice processing described in 4.5, if enabled.
• Encrypted at rest with AES-256, including backups, and in transit with TLS.
• OAuth access and refresh tokens are stored encrypted and never exposed in the Corma interface.
• Access limited to authorized Corma engineers on a least-privilege, role-based basis, with multi-factor authentication on all administrative systems.
• Each Customer's data is logically separated from other Customers' data.
• Production is separated from development and test environments, which contain no Customer data.
• Monitored with AWS intrusion detection and a web application firewall; access to data is logged.
• Corma's information security management system is certified to ISO/IEC 27001.

4.7 Retention and deletion of Google user data

• While connected: we keep Google user data for as long as the Google integration is active, refreshing it on each synchronization.
• When you disconnect: a Customer's administrator can disconnect Google Workspace from Corma at any time in the integration settings, or revoke Corma's access from the Google Admin console or Google account permissions. Corma then stops accessing Google data and deletes the stored OAuth tokens immediately.
• When the contract ends: all Customer data, including Google user data, is deleted within 90 days of contract termination, unless a longer period is required by law.
• Backups: encrypted backups are kept for 30 days and then permanently deleted.
• Invoice documents sent for AI processing are not retained after processing.
• On request: you or your organization can ask us to delete Google user data at any time by writing to contact@corma.io. We confirm deletion within 30 days.

5. How we use other personal data

For personal data that is not Google user data, we use it to:

• Provide, maintain and secure the Service, and manage your Account
• Perform our contract with the Customer, including billing and support
• Respond to your requests
• Improve the Service using aggregated, anonymized usage statistics
• Send you product and service updates if you are a business contact, with the option to unsubscribe at any time

None of these purposes apply to Google user data beyond what Section 4.2 allows.

6. How we share other personal data

We do not sell personal data. We share it only with sub-processors that help us run the Service (hosting, application deployment, support communication, HR-system integrations and compliance tooling), with your organization's administrators, when required by law, or in a business transfer under the conditions in Section 4.4. Our full list of sub-processors is available on request and in our Data Processing Agreement. All sub-processors must be GDPR compliant and are reviewed by Corma before use.

7. Legal bases for processing

Under Article 6(1) of the GDPR, we process personal data on these bases:

• Performance of a contract (Art. 6(1)(b)): providing the Service to the Customer, managing Accounts and synchronizing connected applications.
• Legitimate interest (Art. 6(1)(f)): securing the Service, preventing abuse and denial-of-service attacks, troubleshooting, and business contact with Customers.
• Legal obligation (Art. 6(1)(c)): keeping invoices and accounting records, and responding to lawful requests.
• Consent (Art. 6(1)(a)): non-essential cookies and marketing emails to non-customers. You can withdraw consent at any time.

8. International transfers

Corma hosts personal data in the European Union (AWS, Paris region). Where a sub-processor processes personal data outside the EU, such as OpenAI for invoice processing, we rely on the EU–US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission, with additional safeguards where needed.

9. Security of personal data

We apply the protections described in Section 4.6 to all personal data we hold. No method of transmission or storage is completely secure, but we maintain an ISO/IEC 27001-certified security program and notify affected Customers without undue delay if a personal data breach occurs.

10. Retention of other personal data

• Account and Customer data: kept for the duration of the contract, then deleted within 90 days.
• Browser extension data: kept for the duration of the contract, then deleted within 90 days.
• Server and security logs: kept for up to 1 year.
• Backups: kept for 30 days.
• Invoices and accounting records: kept for 10 years, as required by French law.
• Business contact and prospect data: kept for 3 years after the last contact.

When a retention period ends, we delete or anonymize the data.

11. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. Where Corma processes your data on behalf of your employer, we will pass your request to them or help them respond.

To exercise your rights, email contact@corma.io. We respond within one month. You may also lodge a complaint with the French data protection authority, the CNIL.

12. Children

The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

13. Cookies

The corma.io website uses strictly necessary cookies to operate, and analytics cookies only with your consent. You can refuse or delete cookies in your browser settings or through our cookie banner; some features may not work without necessary cookies.

14. Third-party websites

The Service may link to websites we do not operate. Their privacy practices are governed by their own policies.

15. Changes to this policy

We will post any change on this page and update the date at the top. If we change how we access, use, share or retain Google user data, or make any other material change, we will notify Customers by email or in-app notice before the change takes effect and, where required, ask for renewed consent.

16. Contact

Corma SAS, 96bis Boulevard Raspail, 75006 Paris, France

Email: contact@corma.io

Data Protection Officer: Samuel Bismut, samuel@corma.io