1. Data controller
The controller for the processing described in this policy is 42MERGE, a French simplified joint-stock company (SAS) registered with the Paris Trade and Companies Register under number 913 592 986, whose registered office is at 229 rue Saint-Honoré, 75001 Paris, France ("ERHA", "we").
For any question about personal data: contact@erha.ai.
2. Data we process
We process the following categories of data:
- Account and contact data: name, business email, company, role;
- Files submitted to the service and produced results: they may contain personal data for which the customer remains the controller (see section 9);
- Usage data and technical logs: triggered runs, timestamps, IP addresses, connection data;
- Billing data: usage history, invoices. Card details are collected directly by our provider Stripe and never pass through our systems;
- Communications: messages via the site chat, emails, meetings booked online.
3. Purposes and legal bases
- Providing the service (processing runs, customer workspace, support) — performance of the contract;
- Billing and managing the commercial relationship — performance of the contract and legal obligations (accounting, tax);
- Securing the service and preventing fraud — legitimate interest;
- Improving the service and its features — legitimate interest;
- Answering enquiries and business-to-business prospecting — legitimate interest, with a right to object at any time.
4. Hosting
The www.erha.ai website is hosted by Vercel Inc. (United States), under a data-processing agreement including the European Commission's standard contractual clauses.
The service's production data — accounts, submitted files, results — is hosted with Upsun (Platform.sh SAS, 22 rue de Palestro, 75002 Paris, France), in a data centre located in France.
5. Recipients and processors
Data is accessible only to the ERHA team members who need it, and to our processors:
- Vercel (website hosting);
- Upsun / Platform.sh (production data hosting, in France);
- Stripe (payment and billing);
- Crisp (site chat);
- Google Calendar (meeting scheduling, embedded booking page);
- Artificial-intelligence model providers used to execute processing runs (in particular OpenAI, Anthropic, Google, Mistral AI): only the data needed to execute the requested run is sent to them.
Each processor is bound by a data-processing agreement (DPA). Where data is transferred outside the European Union, transfers are governed by the European Commission's standard contractual clauses or an equivalent mechanism. Your files are not used by ERHA to train artificial-intelligence models.
No data is sold or rented to third parties.
6. Retention periods
- Submitted files and results: kept in your workspace for the duration of the contract, then deleted within 90 days after termination;
- Account data: duration of the contract, then limited archiving for evidentiary purposes (5 years);
- Technical logs: 12 months;
- Invoices and accounting records: 10 years (legal obligation);
- Prospect communications: 3 years after the last contact.
7. Your rights
In accordance with the GDPR and the French Data Protection Act, you have the rights of access, rectification, erasure, restriction, objection and portability over your personal data.
You can exercise them by writing to contact@erha.ai. We reply within one month. You may also lodge a complaint with the CNIL, the French supervisory authority (cnil.fr).
8. Security
We implement appropriate technical and organisational measures: a dedicated workspace per customer with isolated data, encryption of data in transit, strict access control, logging and backups.
In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL and, where applicable, the data subjects, as provided for by the GDPR.
9. Customer files: ERHA as processor
Where files submitted to the service contain personal data, the customer acts as controller and ERHA as processor within the meaning of article 28 of the GDPR: we process such data only on the customer's instructions, to execute the requested runs.
A data-processing agreement (DPA) detailing these commitments is available on request at contact@erha.ai.
10. Cookies and trackers
The site uses cookies strictly necessary for its operation, as well as trackers set by the following third-party tools when you interact with them: Crisp (chat) and Google Calendar (meeting scheduling, embedded booking page).
The site does not use advertising cookies. If a consent-based audience-measurement tool were added, a consent banner would be put in place.
11. Updates to this policy
This policy may be updated, in particular to reflect changes in the service or in regulations. The date of the last update appears at the top of the page; substantial changes are notified to account holders.
The French version prevails; the English translation is provided for information only.