H Company

GDPR overview

GDPR implementation is concrete and documented rather than merely asserted. H Company is a French company under French law, names a Data Protection Officer, Julie Martinez, reachable at dpo@hcompany.ai, and keeps Article 30 records of processing plus impact assessments for high-risk operations, with Article 32 security measures. Eight data subject rights are listed and exercised at privacy@hcompany.ai, answered within one calendar month, extendable by two; the CNIL is named as the supervisory authority. A data processing agreement is published with Standard Contractual Clauses and a named list of eight sub-processors. The enterprise page states GDPR compliant alongside SOC 2 Type I and II certification and ISO 27001 in audit. One caveat deserves attention: for users outside the EEA, H Company acknowledges it has not signed specific Standard Contractual Clauses with those providers.

Who owns the data?

H Company operates in two distinct capacities. For the data of its own service users it acts as data controller, from its registered office at 8 rue Sainte-Cécile in Paris. For content that a professional user uploads and runs through the service, it acts as a processor, governed by the published data processing agreement. Customers remain responsible for holding the right to use the service on third-party personal data and for keeping sensitive categories out of their inputs. H Company states that data is never sold, licensed or shared with third parties, except where its own service providers contractually require it or a lawful authority compels it, and that it makes no disclosures for marketing, advertising or commercial partnerships.

Reuse rights

The privacy policy sets out thirteen processing purposes, each tied to a legal basis: running accounts and the service, support, billing, terms enforcement, security, product improvement, internal research, training H Company's own AI models, marketing, dispute handling, accounting and rights requests. Training on customer inputs, outputs and technical data rests on legitimate interest and is explicitly conditioned on the user not opting out, so an opt-out exists; training is described as running mainly on synthetic data. The Models API behaves differently, applying zero data retention by default and storing neither prompts nor responses, and the enterprise FAQ states there is no training on client data. Screenshots are handled transiently and never stored persistently. Credentials held in the vault and uploaded Chrome profiles are injected at infrastructure level and never reach the model. H Company runs its own models, so no input or output is shared with third-party model providers, and there is no behavioural advertising, individual profiling or data monetisation.

Data retention & training

Hosting summary

Production infrastructure and data storage sit in the European Union, in the AWS Europe region. The United States is used only residually and transiently, when specific GPU inference clusters are not available in the EU. For users outside the EEA, the privacy policy describes transmission to US-based infrastructure, encrypted in transit over TLS and at rest. Sub-processor locations are published individually: PostHog in Germany on its EU Cloud, Axeptio in Ireland via AWS, Brevo across France and Germany, Y3A in France, Stripe in the United States, Datadog in the EU with a residual US read-only footprint purged within ninety days, and HubSpot in Germany or Ireland and/or the United States. Transfers rely on the Data Privacy Framework and Standard Contractual Clauses, with no transfer at all for the three EU entities. H Company states it owns the entire inference chain, so data does not pass through third-party models, and the enterprise offer adds on-premise and sovereign cloud deployment assessed case by case.