Privacy Policy

H Company

8 rue Sainte-Cécile, 75009

Paris, Île-de-France, France

Last Updated: June 24, 2026

Introduction

This Privacy Policy ("Policy") constitutes a comprehensive document that governs the collection, use, disclosure, retention, and protection of personal information by H Company ("H Company," "we," "us," or "our") in connection with the services and AI agents as defined on our website and through H Company’s Terms and Conditions, including all associated services, backend infrastructure, and technical operations (collectively referred to as the "Services").

This Policy applies without limitation to all Users (as defined in the Terms of Services (“ToS”) and the Terms of Use (“ToU”)) worldwide who access, install, or otherwise utilize the Services. H Company maintains an unwavering commitment to protecting user privacy through responsible data stewardship, implementing industry-leading technical and organizational measures designed to minimize data processing risks while ensuring seamless service delivery.

By ordering and/or installing one or several Service(s), accessing its functionality, submitting task instructions, or otherwise engaging with the Services, you expressly acknowledge that you have carefully read, fully understood, and unconditionally accept the terms and conditions set forth in this Policy. Should you find any provision unacceptable or disagree with our data practices, you are respectfully requested to immediately cease all use of the Services and uninstall them.

For the purposes of this Policy, “Personal Data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); An “identifiable natural person” is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the natural person’s physical, physiological, genetic, mental, economic, cultural, or social identity.

For any privacy-related inquiries, rights exercise requests, data subject access demands, or clarification regarding our processing activities, please contact us directly at privacy@hcompany.ai. H Company responds to all legitimate inquiries within statutory timeframes and maintains detailed records of all communications as part of our comprehensive accountability framework.

1. Data Controller Identification and Legal Framework

H Company, duly incorporated and maintaining its registered office at 8 rue Sainte-Cécile, 75009 Paris, Île-de-France, France, acts as the data controller with respect to all Personal Data processed through the Services. 

Data Protection Officer: H Company's designated Data Protection Officer can be reached exclusively at dpo@hcompany.ai for matters pertaining specifically to GDPR compliance, data protection impact assessments, or cross-border data transfer documentation.

Users physically located within jurisdictions maintaining dedicated data protection supervisory authorities retain the right to lodge formal complaints with their competent local authority. By way of non-exhaustive example, residents of France may contact the Commission Nationale de l'Informatique et des Libertés (CNIL) at www.cnil.fr, while Users in other Member States should refer to their respective national supervisory bodies as listed on the European Data Protection Board's official registry.

H Company maintains comprehensive internal records documenting all processing activities pursuant to GDPR Article 30, conducts regular data protection impact assessments for high-risk processing operations, and implements appropriate technical and organizational measures to ensure ongoing compliance with evolving regulatory requirements across all jurisdictions served by the Services.

For the sake of clarity, it is hereby clarified that this Privacy Policy applies to the User’s Personal Data that H Company processes in its capacity as data controller (within the meaning of applicable regulations, including the GDPR), for the purposes listed below, excluding processing carried out by H Company on Personal Data included in content uploaded by the User who uses the Service for professional purposes. In the latter case, H Company processes the Personal Data contained in the content uploaded or processed by the User via the Service in accordance with the addendum on the protection of personal data. 

2. Processing description

2.1 Personal Data categories

H Company may process the following data for the purposes described below and in accordance with the legal bases set forth below:

• User and Account Data: includes User’s registration data (including first name, last name, email address, credentials including login and password, User ID, logs)

• Order Data: includes subscribed Services designation, options, billing address, payment made, payments information, and reclamations if any

• Input Data: includes all input data, including prompts and instructions, comprising content of any kind - including, but not limited to, text, images, videos, screenshots from websites, etc. - uploaded by You to the Service or used by You in connection with the Service. In connection with the use of the Services, the Input Data collected by H Company comprises natural language task instructions voluntarily authored and submitted by User through the Services’ interface. These prompts typically consist of concise directives such as "summarize the visible content on this page" "populate the adjacent form fields with the following information" "extract and compile key data points from the current document" or "navigate sequentially through this multi-step workflow." Such prompts represent the User's explicit instruction to initiate automated task execution and constitute the foundational input for all Services processing activities. In addition to natural language instructions, Users may provide the following inputs to H Company's execution environment infrastructure: Vault credentials (encrypted references to login credentials ((usernames and passwords)) stored in the User's vault, enabling the agent to authenticate to third-party interfaces on the User's behalf. Such credentials are provided to H Company's environment systems and are not transmitted to the AI model as part of prompt processing); browser profiles (Chrome profile data uploaded by the User, including cookies and active session tokens, enabling the agent to operate within the same browsing context as the User. Such profiles are injected at the environment level and are not processed as model input). These environment-level inputs are handled exclusively by H Company's infrastructure layer and do not form part of the instructions submitted to the AI model for processing.

• Output Data: includes all output data resulting from the use of the Service on an Input in response to your instructions

• Technical Data: includes limited processing traces comprising exclusively non-identifying operational metadata, including precise UTC timestamps marking task initiation and completion; binary success/failure status codes; non-identifying browser user-agent strings; browser extension version identifiers; high-level performance metrics (execution latency, resource utilization); and aggregated statistical measures across user cohorts (feature adoption rates, error classifications). These traces enable critical functions such as real-time system monitoring, root cause analysis of technical failures, capacity planning, and proactive security incident detection without compromising individual User anonymity or enabling re-identification.

• Website Contact Data: includes first name, last name, professional email address, company name, job title, and the specific text/notes voluntarily provided by You when submitting a contact or demonstration request form on our website.

2.2 Purposes

The purposes for which H Company may process your Personal Data are as follows:

• Account creation and management: enabling Account creation and management, User connection and authentication

• Services provision pursuant to the Agreement: providing the agreed Services pursuant to ToCs, including hosting, options and ordered additional services until the Service termination. This includes real-time interpretation and fulfilment of User-submitted natural language instructions (prompts) through advanced language model inference. This also includes non-marketing emails and in-app communications to help the User to use the Service and to discover its features, and transaction emails strictly linked to contract management and credit consumption.

• Services support and corrective maintenance: providing Services corrective maintenance pursuant to ToCs, and User support

• Customer relationship management, billing and payments management: managing the business relationship between the User and H Company, issue invoices for Services and/or track the User's credit usage, collect payments,

• Terms of Services monitoring and enforcement: enabling H Company to check that the User complies with applicable ToCs and ToUs, suspend Services in the event of a breach

• Services security: Ensure the security and integrity of the Services' infrastructure and components; prevent risks of compromise to H Company's infrastructure, AI agents, and software, as well as risks of data compromise. This includes systematic analysis of processing traces to identify, diagnose, and remediate technical anomalies, optimize inference latency, prevent service degradation, and maintain contractual service level commitments, as well as monitoring for anomalous patterns indicative of malicious activity, unauthorized access attempts, or potential service abuse, enabling proactive risk mitigation.

• Services improvement and development of new services (excluding AI model training), internal research, analytics and aggregated anonymous usage statistics: enabling H Company to conduct research or to make aggregated and anonymous statistics providing H Company with information on Services are used and can be improved in general.

• H Company’s AI models training: enabling H Company to train its own AI models, notably to answer questions, generate text, translate, compare, summarize and correct inputs, classify information, etc. according to context, inputs and outputs.

• Marketing communications: enabling H Company to send marketing messages, newsletters and proposals for new products or services (subject to prior consent, except for active users who may receive marketing communications pursuant to H Company’s legitimate interest and subject to the User's right to object).

• Disputes management: enabling H Company to protect and defend its rights, particularly in the event of a dispute, and to provide evidence of its compliance with its obligations.

• H Company’s accounting and financial activities: enabling H Company to comply with its legal, tax, financial audit and accounting obligations. This includes documentation and retention necessary to demonstrate compliance with applicable regulatory frameworks (including H Company's accounting and tax obligations and the AI agents’ oversight and monitoring obligations), anti-fraud efforts, evidence of the User’s contractual obligations and actions (and to defend H Company’s interests in the event of a dispute), and respond appropriately to lawful authority requests.

• Personal Data requests management: enabling H Company to respond to requests from Users to exercise their rights regarding their data, in accordance with the obligations set forth in applicable data protection regulations.

• Contact and Demo Requests: managing, scheduling, fulfilling, and responding to inquiries, questions, or product demonstration requests submitted via our website forms.

H Company conducts no behavioral advertising, individual profiling, automated decision-making producing legal effects, or any form of data monetization.

2.3 Legal Basis

Each distinct processing purpose benefits from an independently assessed lawful basis, rigorously documented through H Company's internal Records of Processing Activities (ROPA) and, where required, formal Legitimate Interests Assessments (LIA) conducted pursuant to GDPR Article 6(1)(f):

• Contractual Necessity (GDPR Art. 6(1)(b), equivalent provisions): Processing User-submitted task prompts constitutes the indispensable means of (i) creating Users accounts and allowing their access and authentication to use the Services, managing accounts, and performing the agreement including invoicing by H Company as the case may be, and (ii) fulfilling H Company's contractual obligation to execute the precise automation services requested by each User upon extension installation and activation.

• Legitimate Interests (GDPR Art. 6(1)(f)): Temporary retention and analysis of processing traces serves H Company's well-established legitimate interests in maintaining service availability, ensuring operational continuity, detecting and mitigating security threats, resolving technical incidents, suspending the Services in case of emergency or non-contractual use, and iteratively improving service quality through data-driven optimization – balanced against and demonstrably not overriding individual privacy rights through comprehensive safeguards including data minimization, pseudonymization (where anonymization is not achievable), and strict access controls.

• Legal obligations (GDPR Art. 6(1)(c): Processing and store User Data in connection with the legal, tax, and accounting obligations applicable to H Company, and to respond to any request for disclosure from a legal authority duly authorized to access the data in accordance with applicable regulations.

2.4 Which Personal Data are used for each Purpose?

The following table lists which Personal Data are processed by H Company within the framework of each Purpose, as well as the legal basis for such processing:

Purpose of processing 

(section 2.2)

Categories of Personal Data (section 2.1)

Legal basis 

(section 2.3)

Account creation and management

• User and Account Data

Agreement between you and H Company

Services provision pursuant to the Agreement (ToS/ToU)

• User and Account Data

• Order Data

• Input Data

• Output Data

• Technical Data 

Agreement between you and H Company

Services support and corrective maintenance

• User and Account Data

• Order Data

• Input Data

• Output Data

• Technical Data

Agreement between you and H Company

Customer relationship management, billing and payments management

• User and Account Data

• Order Data

Agreement between you and H Company

Terms of Service monitoring and enforcement

• User and Account Data

• Order Data

• Input Data

• Output Data

• Technical Data

Agreement between you and H Company

Services security

• User and Account Data

• Order Data

• Input Data

• Output Data

• Technical Data

H Company’s legitimate interest

Services improvement and development of new services (excluding model training)

• User and Account Data

• Input Data

• Output Data

• Technical Data

H Company legitimate interest (in case you do not opt-out such processing) 

Internal research, analytics and aggregated anonymous usage statistics

• Input Data

• Output Data

• Technical Data

H Company legitimate interest (in case you do not opt-out such processing) 

H Company’s AI models training

• Input Data

• Output Data

• Technical Data

H Company’s legitimate interest (in case you do not opt-out such processing) 

Marketing communications

• User and Account Data

User’s prior consent

Disputes management

• User and Account Data

• Order Data

• Input Data

• Output Data

• Technical Data

H Company’s legitimate interest

H Company’s accounting and financial activities

• User and Account Data

• Order Data

H Company’s legal obligations

Personal Data requests management

• User and Account Data

• Order Data

• Technical Data Any other personal data included in your privacy request

H Company’s legal obligations

Contact and Demo Requests 

Website Contact Data

H Company's legitimate interest (for inquiries) / Pre-contractual steps at your request (for demo scheduling)

2.5 Details on the Processing of Inputs

H Company implements data minimization practices by processing screenshots only transiently during task execution – while retaining solely User prompts and agent actions as pseudonymized processing traces for Services improvement purposes. This architecture ensures transient handling of visual data while preserving essential operational records necessary for service optimization, error resolution, and quality assurance.

To use the Services, the User may apply them to Inputs that themselves may contain Personal Data (including images, audio or video files) belonging to third parties. In such cases, the User is responsible for ensuring that they are legally permitted to use the Services on such Personal Data. It is the User’s responsibility to ensure that the content does not contain any sensitive data as defined by applicable regulations, such as health data, or any data related to areas in which the use of the Services is prohibited under the Terms of Use.

3. Data Retention and Deletion Framework

User and Account Data: To use the Services, Users must provide certain information such as their email address, name - which are encrypted and protected, and used for authentication, notifications, and account management. No additional profile fields are required beyond what is strictly necessary to operate the account and associated Services. Such Personal Data is retained only for the duration of the User’s use of the Services until the User’s account is deleted, plus (i) in the case of a paid Service, for the duration of H Company’s accounting and tax obligations (in France, 10 years from the closing of the considered financial year), (ii) any periods lawfully required by the statute of limitations regarding the proof of obligations (in France, 5 years after account deletion), and, in the event of a dispute, (iii) for the duration of the dispute. User and Account Data is retained for the periods mentioned above in a secure archive, to which production teams no longer have access. Once the legal retention periods have expired, H Company will permanently delete these categories of Personal Data.

Input & Output Data: From a technical standpoint, H Company must process visual information displayed in the User’s device in order to perform the requested tasks. The extension captures and analyzes visual elements of the active tab (including screenshots or equivalent visual representations) solely for the time strictly necessary to interpret the context and execute the User’s instructions. Input and Output are deleted thirty (30) days for Users in the European Economic Area after the operation, for service improvement, debugging, and security purposes and traceability of agents by Users, except where explicitly decided otherwise by Users in accordance with the data minimization and storage limitation principles applicable to our Service; in any case, they are not retained, logged, or stored in any persistent form. For non-European Economic Area Users, these are kept for ninety (90) days for service improvement, debugging, and security purposes and traceability of agents by Users, in accordance with the data minimization and storage limitation principles applicable to our Service..

Technical Data: Technical Data is retained for the minimum period strictly necessary to fulfil each processing purpose. For the purposes of Services improvement and development of new services (excluding model training), Technical Data is retained for six (6) months following the operation on a pseudonymized basis, enabling statistically relevant analysis while limiting re-identification risks inherent to pseudonymized datasets. For internal research, analytics, and aggregated anonymous usage statistics, Technical Data is retained for one (1) year following contract termination; analysis is performed on non-identified, aggregated cohorts using an anonymous identifier that is not linked to User and Account Data from production systems. For H Company's AI model training purposes, Technical Data is retained for six (6) months following the operation on a pseudonymized basis; training is primarily conducted on synthetic data to ensure stability and prevent regression. Where a User has exercised their right to opt out of any of the above processing purposes, Technical Data shall not be retained beyond what is strictly necessary for the remaining lawful purposes, and shall be deleted in accordance with the timelines applicable to those purposes.

Marketing Data: If the User has given consent, or upon termination of the User’s account by the User, H Company may retain the User’s contact information for the purpose of sending the User marketing messages for a maximum period of three (3) years from the User’s last active action, unless the User submits a request to object to such processing in accordance with section 7 below.

Website Contact Data: Personal Data collected through our website contact and demonstration forms is retained for a maximum period of three (3) years from our last active contact with you, unless a commercial contract is subsequently concluded (in which case the data is handled in accordance with the User and Account Data retention framework).

4. Comprehensive Technical and Organizational Security Measures

H Company implements appropriate technical and organizational security measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction, in accordance with GDPR Article 32 and applicable standards. These measures include:

1. Technical protections: Transport Layer Security (TLS) encryption for data transmissions between the Services and our servers; access controls limiting data availability to authorized personnel only; regular software updates and patching; and basic monitoring for unusual activity.

2. Operational safeguards: Internal policies governing data access and usage; password protection for administrative systems; secure development practices during extension updates; and procedures for responding to potential security incidents.

3. Continuous improvement: H Company regularly reviews and enhances security practices based on industry developments, threat intelligence, and lessons learned from operational experience.

While no system can guarantee absolute security, H Company maintains proportionate protections given the limited scope of data processed (User prompts and anonymized traces only) and implements prompt deletion protocols to minimize exposure.

5. Subprocessors, Third-Party Disclosures, and Accountability Chain

H Company may use processors which are then bound by data protection commitments ensuring that Personal Data is protected under conditions at least equivalent to those set forth in this Privacy Policy, for the sole duration necessary for the processing and to the exclusion of any other use.

For Users outside the EEA, screenshots are deleted immediately after processing while User prompts and processing traces are retained for a maximum of ninety (90) days to support service improvement, troubleshooting, and security monitoring. Data transmissions to our U.S.-based infrastructure are protected by end-to-end encryption both in transit (TLS) and at rest. Our cloud service providers maintain standard security commitments through their commercial terms of service, including data protection warranties and confidentiality obligations.

When necessary, H Company may share stored Personal Data with competent courts, mediators, accountants, auditors, lawyers, bailiffs, and debt collection agencies, as well as any legal authority requiring an access to such Personal Data, subject to section 6 hereinafter.

H Company makes no disclosures for marketing, advertising, or commercial partnerships. Data is never sold, licensed, or shared with third parties except as contractually required by our service providers or compelled by lawful authority. In enterprise deployments, customers receive only non-personal, aggregated service metrics.

6. International Data Transfers and Equivalence Guarantees

In case of cross-border transfer, H Company and its subcontractor have implemented the safeguards required by applicable regulations (such as Standard Contractual Clauses with service providers), the details of which H Company makes available to the User. In addition, data transmissions to our U.S.-based infrastructure are protected by end-to-end encryption both in transit (TLS) and at rest. Our cloud service providers maintain standard security commitments through their commercial terms of service, including data protection warranties and confidentiality obligations.

For Users outside the EEA, data is transmitted to U.S.-based infrastructure protected by industry-standard encryption protocols both in transit and at rest. While H Company has not executed specific Standard Contractual Clauses with service providers in such cases, applicable commercial terms of service incorporate confidentiality and security commitments, supplemented by technical safeguards including time-limited retention (90 days maximum for prompts and traces) and immediate screenshot deletion post-processing. H Company continues to monitor evolving transfer requirements and stands ready to implement additional measures as regulatory guidance develops.

7. Individual Data Subject Rights

Pursuant to applicable data protection legislation conferring such rights upon data subjects, Users of the Services may exercise the following prerogatives through written request directed to privacy@hcompany.ai:

a) Right of access to Personal Data processed concerning them and, where applicable, related processing details, including transmission of a copy of Data Subject’s Personal Data;

b) Right to rectification of inaccurate, outdated or incomplete Personal Data;

c) Right to erasure of Personal Data under the conditions and limitations established by law;

d) Right to restriction of processing in the circumstances contemplated by regulation;

e) Right to data portability in a structured, commonly used, and machine-readable format, where technically feasible, if the processing is based on your consent or the execution of the Agreement and is automated;

f) Right to object to processing based on legitimate interests, subject to the controller's compelling grounds, without affecting the lawfulness of prior processing;

g) Right to withdraw consent where processing relies on such legal basis, without affecting the lawfulness of prior processing.

h) Right to provide your instructions for processing of your Personal Data after your death.

H Company shall provide substantive response within one (1) calendar month of receipt of complete request, extendible by two (2) months for manifestly complex or numerous demands upon prior notification to the data subject. Verification of requester identity may be required to prevent unauthorized disclosures.

If you have any unresolved issues, you may lodge a complaint with the competent supervisory authority, which is in France the National Data Protection Authority (CNIL).

8. Protection of Minors’ data

The Services constitute professional-grade automation software intended exclusively for Users having attained the age of majority or legal adulthood as determined by their jurisdiction of residence. H Company does not knowingly solicit, collect, or process Personal Data from minors under sixteen (16) years of age.

In the event a parent, legal guardian, or authorized representative becomes aware of inadvertent minor data processing, such party may immediately request comprehensive deletion by contacting privacy@hcompany.ai. H Company shall effectuate permanent erasure within statutory timeframes and furnish confirmation of compliance.

9. Cookies

Please refer to H Company’s Cookie Policy.

10. Policy Amendment Procedures

Material Modifications: Amendments affecting processing purposes, categories, recipients, or retention necessitate minimum thirty (30) days advance notice delivered through persistent in-extension notifications, email (where contact information registered), and Chrome Web Store updates. Continued service utilization post-notification constitutes complete and unconditional acceptance.

Administrative Updates: Clarifications, formatting improvements, or contact details published immediately without individual prior notice.

11. Governing Law and Jurisdiction

This Policy constitutes an integral component of H Company's contractual terms, governed exclusively by French law with all disputes subject to the mandatory, non-exclusive jurisdiction of the Paris Commercial Court (Tribunal de Commerce de Paris), without prejudice to data subjects' rights to pursue remedies through competent supervisory authorities or mandatory consumer forums.

12. Comprehensive Contact Framework

H Company

8 rue Sainte-Cécile, 75009 Paris, Île-de-France, France

-