Privacy Policy

Last updated: October 26, 2026

This English translation is provided for convenience only. The French version prevails.

1. Data controller

The controller for the processing described in this policy is 42MERGE, a French simplified joint-stock company (SAS) registered with the Paris Trade and Companies Register under number 913 592 986, whose registered office is at 229 rue Saint-Honoré, 75001 Paris, France ("ERHA", "we").

For any question about personal data: contact@erha.ai.

2. Data we process

We process the following categories of data:

  • Account and contact data: name, business email, company, role;
  • Files submitted to the service and produced results: they may contain personal data for which the customer remains the controller (see section 9);
  • Search index: the text of tickets, prepared emails, the Context page, files and conversations with agents, split into passages, and a summary of each conversation, so that agents can find information from the space. The details are on the "Your data" page of the console;
  • Usage data and technical logs: triggered runs, timestamps, IP addresses, connection data;
  • Billing data: usage history, invoices. Card details are collected directly by our provider Stripe and never pass through our systems;
  • Communications: messages via the site chat, emails, meetings booked online;
  • Data from a Google account you connect to the service: see section 11.

3. Purposes and legal bases

  • Providing the service (processing runs, customer workspace, support) — performance of the contract;
  • Billing and managing the commercial relationship — performance of the contract and legal obligations (accounting, tax);
  • Securing the service and preventing fraud — legitimate interest;
  • Improving the service and its features — legitimate interest;
  • Answering enquiries and business-to-business prospecting — legitimate interest, with a right to object at any time.

4. Hosting

The www.erha.ai website is hosted by Vercel Inc. (United States), under a data-processing agreement including the European Commission's standard contractual clauses.

The service's production data — accounts, submitted files, results — is hosted with Upsun (Platform.sh SAS, 22 rue de Palestro, 75002 Paris, France), in a data centre located in France.

5. Recipients and processors

Data is accessible only to the ERHA team members who need it, and to our processors:

  • Vercel (website hosting);
  • Upsun / Platform.sh (production data hosting, in France);
  • Stripe (payment and billing);
  • Google Calendar (meeting scheduling, embedded booking page);
  • Mistral AI (Paris, France): computing the embeddings of the search index, hosted in the European Union by default. Mistral AI may keep the texts it receives for up to 30 days to detect abuse, as the controller of that processing; they are not used to train its models;
  • Artificial-intelligence model providers used to execute processing runs (in particular OpenAI, Anthropic, Google, Mistral AI): only the data needed to execute the requested run is sent to them. Anthropic, which provides the default models of the agents and of the conversation summaries, stores this data in the United States and deletes it within 30 days, unless content is flagged for a violation of its usage policies (up to 2 years).

Each processor is bound by a data-processing agreement (DPA). Where data is transferred outside the European Union, transfers are governed by the European Commission's standard contractual clauses or an equivalent mechanism. Your files are not used by ERHA to train artificial-intelligence models.

No data is sold or rented to third parties.

6. Retention periods

  • Submitted files and results: kept in your workspace for the duration of the contract, then deleted within 90 days after termination;
  • Search index: each passage is kept as long as its source exists in the space, then deleted at most 24 hours after its source is deleted;
  • Account data: duration of the contract, then limited archiving for evidentiary purposes (5 years);
  • Technical logs: 12 months;
  • Invoices and accounting records: 10 years (legal obligation);
  • Prospect communications: 3 years after the last contact.

7. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the rights of access, rectification, erasure, restriction, objection and portability over your personal data.

You can exercise them by writing to contact@erha.ai. We reply within one month. You may also lodge a complaint with the CNIL, the French supervisory authority (cnil.fr).

8. Security

We implement appropriate technical and organisational measures: a dedicated workspace per customer with isolated data, encryption of data in transit, strict access control, logging and backups.

In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL and, where applicable, the data subjects, as provided for by the GDPR.

9. Customer files: ERHA as processor

Where files submitted to the service contain personal data, the customer acts as controller and ERHA as processor within the meaning of article 28 of the GDPR: we process such data only on the customer's instructions, to execute the requested runs.

A data-processing agreement (DPA) detailing these commitments is available on request at contact@erha.ai.

10. Cookies and trackers

The site uses cookies strictly necessary for its operation, as well as trackers set by the following third-party tool when you interact with it: Google Calendar (meeting scheduling, embedded booking page). The site chat is ERHA's own: it keeps a conversation identifier in your browser, without a cookie, to find the conversation again from one page to the next.

The site does not use advertising cookies. If a consent-based audience-measurement tool were added, a consent banner would be put in place.

11. Google account data

This section applies when you connect a Google account to ERHA: sign in with Google, Gmail, Google Calendar, Google Docs or the Google Workspace directory. Google shows you the requested access before you accept it, and you can withdraw it at any time.

Data ERHA accesses, and what for:

  • Sign in with Google (openid, email, profile): your email address, your name and your Google identifier, to create your account and sign you in;
  • Sending emails (gmail.send): ERHA sends from your Gmail address, in your name, the emails written in ERHA that you send, or that you allowed an agent to send without review. This access only allows sending: ERHA does not read the content of your Gmail mailbox;
  • Reading your calendar (calendar.events.readonly): ERHA reads your events from 90 days back to 60 days ahead, and cannot change them. They appear in your ERHA agenda, which only you can see. An event with a guest who is a contact of a customer of your space also appears on that customer's file, which the members of the space can see. Private, declined or guest-less events are never added to a customer file;
  • Reading documents (documents.readonly): ERHA only reads the notes document generated by Gemini and attached to a meeting with a customer, to add it to that customer's file. ERHA does not browse your other documents;
  • Google Workspace directory (admin.directory.user.readonly, admin.directory.domain.readonly), only if an administrator of your company connects it: the list of the company's users and domains, to remove access to the space for people who are no longer part of the company.

ERHA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy. In practice:

  • This data is only used for the features described above, which are visible in the ERHA console;
  • It is not sold, not used for advertising, and not used to assess creditworthiness or for lending purposes;
  • It is never used to develop, improve or train generalized artificial-intelligence or machine-learning models, neither by ERHA nor by its processors;
  • ERHA does not transfer this data, whether raw, aggregated, anonymized or derived, to any third-party AI service that uses it to develop, improve or train its models. The AI providers that process it for ERHA do so only to return the result you asked for, under terms that do not allow them to train on it;
  • When you ask an agent to work on a customer, the information needed (for example the date and notes of a meeting) is sent to the model provider that executes the request (see section 5), only to produce the answer. Events and notes added to a customer file are also indexed for the search of your space (see section 2);
  • No one at ERHA reads this data, except with your explicit consent (for example for a support request), for the security of the service (investigating abuse) or to comply with the law.

The use of raw or derived user data received from Google Workspace APIs (Gmail, Google Calendar, Google Docs) will adhere to the Google User Data Policy, including the Limited Use requirements: https://developers.google.com/workspace/workspace-api-user-data-developer-policy.

Retention and deletion:

  • Google access tokens are stored encrypted;
  • You can disconnect a Google account at any time in the console, from Profile then Connected accounts. ERHA then also removes the access at Google. You can also remove it from your Google account: https://myaccount.google.com/permissions;
  • Stopping the calendar import erases your ERHA agenda. Events already added to a customer file stay there as the history of the relationship, until the file is deleted or the contract ends (see section 6);
  • To have all data from your Google account deleted, write to contact@erha.ai.

12. Updates to this policy

This policy may be updated, in particular to reflect changes in the service or in regulations. The date of the last update appears at the top of the page; substantial changes are notified to account holders.

The French version prevails; the English translation is provided for information only.