Privacy Policy — Korsio

1. Who we are

For any question regarding this policy or your data: [email protected].

2. Two distinct contexts

For any question regarding this policy or your data: [email protected].

3. Data processed through the website

We never sell your data and never disclose it to any data broker.

Cookies and audience measurement

The site uses Google Tag Manager and audience measurement tools. A consent banner lets you accept or refuse non-essential cookies. Strictly necessary cookies (session, security, theme preference) are set without consent. You can change your choices at any time from the cookie management link in the footer.

4. PrestaShop data processed by the module

For the operation of our website and billing, we use the following service providers:

None of your business data or Google data from the module is transferred to these providers: Korsio has no access to it (see §4 and §5). These sub-processors are involved only in the operation of the website and billing.

We never handle your card details: they are collected and processed directly by Stripe, and Korsio never has access to them at any point.

Any transfer of data outside the European Union by one of our sub-processors is governed by the European Commission's Standard Contractual Clauses or an equivalent safeguard mechanism.

5. Google data (Google Ads, Google Analytics 4, Search Console)

5.1 Permissions (scopes) requested

When you connect your Google account, the Reporting Pro module for PrestaShop asks for your explicit consent for the following permissions, and only these:

No other permission is requested. The module does not access your email, your files, your contacts, your calendar, or any other Google data.

5.2 Where does this data go?

Nowhere but your own screen.

The module, installed on your PrestaShop server, queries the Google APIs directly using your OAuth credentials and displays the results in your back office. The data travels from Google to your server, and stops there.

• Korsio receives none of your Google data.
• It is not stored on any Korsio infrastructure.
• It is not transmitted to any third party.
• It is not used for advertising, nor sold, nor used to train artificial intelligence models, nor read by humans (except with your express agreement in the context of a support request).

5.3 Limited Use (Google API Services User Data Policy)

5.4 Access tokens — storage and security

To maintain the connection without asking for authorisation each time you view your data, the module stores a refresh token as well as the Google Cloud project credentials (client_id, client_secret) that you created.

These elements are stored in your shop's database, on your own server — never at Korsio — and are exchanged exclusively over encrypted HTTPS connections. They are accessible only to your shop's administrators. Encryption at rest for these credentials is currently being rolled out.

5.5 Revoking access at any time

You can withdraw the authorisation granted to Reporting Pro at any time:

1. From within the module, using the « Disconnect » button in the Google configuration tab — the token is immediately deleted from your database;
2. From your Google account: https://myaccount.google.com/permissions

Revocation takes effect immediately and does not affect the other features of the module.

6. Sub-processors and transfers

For the operation of our website and billing, we use the following service providers:

None of your business data or Google data from the module is transferred to these providers: Korsio has no access to it (see §4 and §5). These sub-processors are involved only in the operation of the website and billing.

We never handle your card details: they are collected and processed directly by Stripe, and Korsio never has access to them at any point.

Any transfer of data outside the European Union by one of our sub-processors is governed by the European Commission's Standard Contractual Clauses or an equivalent safeguard mechanism.

7. Security

We implement appropriate technical and organisational measures: encryption of communications via HTTPS/TLS; encryption at rest of sensitive credentials (AES-256-GCM), currently being extended to Google access tokens; prepared SQL statements; CSRF protection, input escaping, CORS restriction; passwords hashed with bcrypt; principle of least privilege (read-only access to the Google APIs).

As no system is infallible, we undertake to notify you and the competent supervisory authority of any data breach likely to result in a risk to your rights, within the time limits set out by the GDPR.

8. Your rights

Under the GDPR, you have — for the data that Korsio processes about you (§3) — the rights of access, rectification, erasure, restriction, objection, portability, and consent withdrawal at any time.

To exercise these rights: [email protected] — we respond within one month.

If you believe your rights are not respected, you may lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr, or with the supervisory authority of your Member State.

9. Changes

This policy may evolve (legal developments, new features). The last update date is shown at the top of the page. In case of substantial change, you will be informed by email or by a notification in the module.

10. Contact

Korsio Email: [email protected] Website: https://korsio.io