Personal data
Privacy Policy
Last updated: 9 September 2026
Karavela processes personal data when you browse this website, contact us through the contact form, or register on the waitlist of the Cephalonauts One study. This policy describes that processing and the rights available to you under the General Data Protection Regulation (GDPR).
Scope
This policy covers only the processing carried out through this website. No health data and no brain imaging data is collected here. Data collected from volunteers enrolled in a research study is governed by the applicable research protocol and by the informed consent form signed by the participant, and its use is described in our Transparency Portal.
Data controller
Karavela, a simplified joint stock company registered with the Paris Trade and Companies Register under number 944 250 448, with registered offices at 198 avenue de France, 75013 Paris, FRANCE.
Data Protection Officer: dpo@karavela.ai
Processing activities
Browsing this website
- Data
- IP address, pages requested, date and time of each request, browser and device information, and the language preferences sent by your browser.
- Purpose
- Delivering the requested pages, maintaining the availability of the website, and detecting and preventing abuse. The language preference is used to direct you to the English or French version and is not stored.
- Legal basis
- Legitimate interest in operating and securing the website (Article 6(1)(f) GDPR).
- Retention
- Technical and security logs: maximum 30 days.
- Recipients
- Vercel.
Audience measurement
- Data
- Pages viewed, referring page and approximate country. No identifier is stored on your device.
- Purpose
- Producing aggregate statistics on the use of the website.
- Legal basis
- Legitimate interest in measuring the audience of the website (Article 6(1)(f) GDPR). The measurement uses no cookie and does not track visitors across websites.
- Retention
- Aggregate statistics only: maximum 12 months.
- Recipients
- Vercel.
Contact form
- Data
- First name, last name, email address, subject and content of your message.
- Purpose
- Processing and responding to your request.
- Legal basis
- Legitimate interest in responding to a request addressed to us (Article 6(1)(f) GDPR).
- Retention
- Maximum 3 years from the last exchange.
- Recipients
- Proton.
Cephalonauts One waitlist
- Data
- First name, last name, email address, country and city of residence, native language, age range, number of sessions you are willing to attend and, optionally, content suggestions. The country of connection is recorded by the form provider.
- Purpose
- Constituting the list of candidate volunteers for the Cephalonauts One study and contacting candidates about their participation.
- Legal basis
- Explicit consent (Article 6(1)(a) GDPR), which may be withdrawn at any time.
- Retention
- Until the close of recruitment or withdrawal of consent, and no longer than 3 years from the last contact.
- Recipients
- Tally.
Cookies
This website sets no cookies. It stores no identifier in your browser, uses no local storage, no advertising tag, no social media plugin and no cross-site tracking.
Recipients
The service providers below process personal data on our behalf, under an agreement containing the obligations required by Article 28 of the GDPR.
- Vercel
- Website hosting, content delivery and audience measurement. United States; pages are served from a data centre in the Paris region.
- Tally
- Operation and storage of the Cephalonauts One waitlist form. Belgium; responses are stored in the European Union.
- Proton
- Hosting of the mailbox receiving contact form messages. Switzerland.
- Sanity
- Content management system serving the published articles. Norway and United States.
- Webflow
- Delivery of one partner logo displayed on the home page. United States.
International transfers
Waitlist responses are stored in the European Union. Contact form messages are stored in Switzerland, which benefits from an adequacy decision of the European Commission. Transfers to providers established in the United States are governed by the Standard Contractual Clauses of the European Commission, together with the data processing agreement concluded with each provider.
Security
This website is served exclusively over HTTPS. Access to the systems listed above is restricted to authorised personnel and protected by multi-factor authentication.
Your rights
Subject to the conditions set out in the GDPR, you have the following rights in respect of your personal data.
- Access
- Obtain confirmation of the processing and a copy of your personal data.
- Rectification
- Have inaccurate or incomplete data corrected.
- Erasure
- Have your data deleted, where no legal obligation requires its retention.
- Restriction
- Obtain the restriction of processing in the cases provided for by law.
- Objection
- Object to processing based on our legitimate interest.
- Portability
- Receive the data you provided in a structured, commonly used and machine-readable format.
- Withdrawal of consent
- Withdraw your consent at any time, where the processing is based on consent.
- Post-mortem instructions
- Provide instructions regarding the processing of your data after your death.
To exercise these rights, contact our Data Protection Officer at the address above, or write to Karavela, 198 avenue de France, 75013 Paris, France. We respond within one month. Proof of identity may be requested where there is reasonable doubt as to the identity of the applicant.
You may also lodge a complaint with the CNIL, the French data protection authority, at cnil.fr or by post to 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
Changes to this policy
This policy may be updated to reflect changes in the processing carried out through this website. The date of the latest version is indicated above.