Privacy Policy
Last updated: October 12, 2026
This is a translation. In case of discrepancy, the French version prevails.
1. Data controller
IWCORP, a French EURL with a share capital of €500, registered in Bourg-en-Bresse under number 939 891 313, 106 chemin de la Grande Terre, 01390 Civrieux, France (“Horair”, “we”). Contact for any question about your data: [email protected].
We have not appointed a Data Protection Officer (DPO), as this is not mandatory for our activity.
This policy covers website visitors, users of the Service and the professionals we contact for prospecting. For the data our customers process through the Service (for example review authors), Horair acts as a processor on the customer’s behalf (see article 15 of the Terms of Service).
2. Data collected, purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your account, provide the Service | Name, email, password (hashed), Google or Facebook ID if you sign in with them, company, locations, invited members | Performance of contract |
| Sync your hours and reviews | Access tokens for connected platforms, location listings, hours, reviews and replies (including review authors’ names and text) | Performance of contract |
| WhatsApp and MCP assistant | Linked WhatsApp number, content of messages exchanged with the assistant, access tokens of authorized apps | Performance of contract |
| Billing | Plan, number of locations, invoices, payment identifiers (card data is processed by Lemon Squeezy, never by us) | Performance of contract, legal obligation (accounting) |
| Security, fraud prevention, technical logs | IP address, browser, connection and error logs | Legitimate interest, legal obligation |
| Audience measurement | Anonymized page views and usage events, without cookies (Umami, self-hosted) | Legitimate interest (exempt from consent) |
| Error diagnostics | Error reports and, for a small share of sessions, a session recording with text and media masked (Sentry) | Legitimate interest |
| Communication and support | Emails exchanged, service notifications | Performance of contract, legitimate interest |
| B2B prospecting | Name, job title, business email, phone and public information about the business (Google listing, website, published hours) | Legitimate interest |
3. B2B prospecting
We may email professionals (shops, restaurants, chains…) to introduce Horair, in connection with their business. The data comes from public sources: business listings, websites and professional directories. Every message contains a link to stop being contacted. Your objection is applied immediately and kept in a suppression list. You can also write to [email protected].
4. Recipients and sub-processors
Your data is never sold. It is accessible to the Horair team and to our sub-processors, within the limits of their tasks:
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting | European Union |
| Cloudflare, Inc. | CDN, protection, media storage | Global (USA) |
| Lemon Squeezy (a Stripe company) | Payment, invoicing, taxes (merchant of record, also an independent controller for payments) | USA |
| Sentry (Functional Software, Inc.) | Error tracking | USA |
| Twilio Inc. | Sending and receiving WhatsApp messages | USA |
| OpenRouter, Inc. and Anthropic, PBC | Processing assistant messages with an AI model | USA |
| Instantly | Sending prospecting emails | USA |
Platforms you connect. At your request, we exchange data with Google (Business Profile, Google sign-in), Meta (Facebook, WhatsApp), Apple (Business Connect), Microsoft (Bing Places) and any other platform you connect. Their own privacy policies apply.
We may also disclose data to authorities when required by law.
5. Transfers outside the European Union
Some providers are located in the United States. These transfers rely on the EU–US Data Privacy Framework when the provider is certified, or otherwise on the European Commission’s Standard Contractual Clauses.
6. Retention periods
| Data | Retention |
|---|---|
| Account and Service data | For the life of the account, then deleted within 3 months of closure (30-day export window) |
| Trial account never converted and inactive | 3 years after last activity |
| Messages exchanged with the assistant | For the life of the account |
| Unused WhatsApp links and access tokens | Revoked after 180 days of inactivity |
| Invoices and accounting records | 10 years (French Commercial Code, art. L123-22) |
| Connection logs | 1 year |
| Error reports (Sentry) | 90 days maximum |
| Prospects who did not reply | 3 years after last contact |
| Prospecting suppression list | 3 years after the objection |
7. Cookies and local storage
Horair uses no advertising cookies and no tracker that requires consent.
- Authentication: your session is stored in your browser’s local storage. It is strictly necessary for the Service.
- Audience measurement: Umami, hosted on our servers, works without cookies, does not store your IP address and does not track visitors across websites.
- Payment: the Lemon Squeezy checkout page may set its own cookies needed for payment and fraud prevention.
8. Data from Google APIs
When you connect your Google account, Horair accesses your Google Business Profile listings to read and update your locations, hours and reviews, solely to provide the features you use. Horair’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is not used for advertising or to train AI models, and is not read by humans except with your consent, for security purposes or to comply with the law. You can revoke this access at any time from Horair or from your Google account.
9. Security
Encryption in transit (HTTPS), hashed passwords, platform access tokens never exposed by the API, access control per company and role, logging of opening-hours changes.
10. Your rights
You have the right to access, rectify, erase, restrict and port your data, and to object to its processing (including to prospecting, without giving a reason). You may also give instructions about your data after your death. To exercise these rights, write to [email protected]. We reply within one month.
You may lodge a complaint with the French data protection authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (cnil.fr), or with the authority of your country.
11. Minors
The Service is for professionals only and is not intended for anyone under 16.
12. Changes
We may update this policy. If we make a significant change, we will notify you by email or in the Service before it takes effect.