Privacy Policy

Hivanced is a sovereign AI assistant for European business teams, hosted in Europe. The persons responsible for processing personal data (the data controllers) are:

Noémie Christien Deléage and Martin Geffrault

The Hivanced trademark is the subject of European Union trade mark application EUIPO 019374503550.

For any question about this policy or about your personal data, you can contact us at contact@hivanced.eu.

We collect only the data we need to provide and improve the service:

• Account data: name, professional email address, password (stored hashed), company and brand information, role and permissions.
• Content you provide: conversations with the AI assistant, prompts, documents and data sources you connect, and any content you create in the platform.
• Connected-source data: when you authorise a connector (for example Google Drive, Microsoft 365, Notion, Slack or HubSpot), we access the data you grant, on a read-only basis, to let the AI assistant answer questions grounded on your own data. We do not write back to those sources.
• Usage and technical data: log data, device and browser information, IP address, and product-analytics events (the latter only with your consent, see our Cookie Policy).
• Billing data: subscription, plan and invoice information processed through our payment provider.

Under Article 6 GDPR, we rely on the following lawful bases:

• Performance of a contract (Article 6(1)(b)): to create and manage your account, deliver the AI assistant and the features you subscribe to, and provide support.
• Legitimate interests (Article 6(1)(f)): to secure the platform, prevent abuse and fraud, and improve our service, where these interests are not overridden by your rights.
• Consent (Article 6(1)(a)): for non-essential cookies and product analytics, and for any optional feature you explicitly enable, including the use of a non-European AI provider. You can withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): to comply with accounting, tax and other legal requirements.

We do not sell your personal data, and we do not use the content of your conversations or your connected sources to train third-party foundation models.

Hivanced is built for the EU AI Act era. By default, AI processing is routed to a European provider (Mistral AI), and your data stays within the European perimeter. Every AI interaction is designed to be transparent and auditable, in line with the transparency principles of Article 50 of the EU AI Act. This is a design posture, not a compliance guarantee: the concrete obligations that apply depend on how you use the assistant.

If you explicitly enable a non-European AI provider, the corresponding processing leaves the European perimeter. This is always opt-in and never enabled by default.

We work with a limited set of carefully selected providers (subprocessors) who process data on our behalf and under contract:

• Scaleway (France, region fr-par): hosting and infrastructure.
• Mistral AI (European Union): default AI model provider.
• PostHog Cloud EU (Frankfurt, Germany): product analytics, used only with your consent.
• Connectors you authorise (Google Drive, Microsoft 365, Notion, Slack, HubSpot): accessed read-only as grounding sources for the AI assistant, never written back.

These European providers are not US companies and are therefore not subject to the US CLOUD Act. Data residence in Europe is one element of sovereignty, not a guarantee of full sovereignty on its own. Any non-European AI provider remains opt-in.

By default, your data is hosted and processed in the European Union and does not leave the European perimeter. If you choose to enable a non-European AI provider, the related transfer takes place only on the basis of your explicit instruction and the appropriate safeguards required by Chapter V GDPR (such as Standard Contractual Clauses).

We keep personal data only as long as necessary for the purposes described above:

• Account and content data: for the duration of your contract, then deleted or anonymised within a reasonable period after termination, subject to legal retention obligations.
• Billing and accounting records: for the legally required retention period.
• Technical logs and security events: for a limited period proportionate to the security purpose.

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data (the right to be forgotten), within legal limits.
• Restriction of processing in certain cases.
• Data portability, to receive your data in a structured, commonly used, machine-readable format.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time, without affecting prior lawful processing.

You can exercise these rights directly in the application, where account access and erasure flows are available, or by contacting us at contact@hivanced.eu. We respond within the time limits set by the GDPR (in principle one month).

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit and of sensitive data at rest, strict access controls, multi-tenant isolation so each customer's data is segregated, and a permission system that governs who can access what within an organisation.

If you believe your data protection rights have not been respected, you can lodge a complaint with the French supervisory authority, the Commission Nationale de l'Informatique et des Libertes (CNIL), at www.cnil.fr, or with the supervisory authority of your country of residence.

We may update this Privacy Policy to reflect changes in our service or in the law. We will indicate the date of the latest version at the top of this page and, where appropriate, inform you of significant changes.