Privacy policy

klair is a French company (KLAIR AI, SAS) that works for businesses in two ways: it designs and develops custom software, which it can host and operate, and it publishes an applications platform — Agora, your organisation's agent-based assistant, and business applications — to which you can connect your tools (Gmail, Google Drive, Outlook, OneDrive, SharePoint…). klair is a business-to-business (B2B) service.

We are the data controller for our website, the Hermès intake assistant, accounts, billing and the commercial relationship. We are a processor for your organisation for everything you and your colleagues entrust to the platform — Agora and application content, data received through connectors, software we host for you —, your organisation remaining the controller.

Our databases and servers are in France. We rely on a small set of providers, named in section 08. We do not sell personal data, we do no targeted advertising, and neither we nor our AI providers train models on your content.

The controller is KLAIR AI, a société par actions simplifiée (SAS) with share capital of €1,000.00, registered with the Montpellier trade and companies register under number 107 073 769 (intra-community VAT number FR96107073769), with its registered office at Espace Entreprise Garosud, 48 rue Claude Balbastre, 34070 Montpellier, France. The company's full identification and that of its hosts are set out in our legal notice.

For any question about your personal data or to exercise your rights: privacy@klair.dev. klair is not required to appoint a data protection officer; this address is handled by the person in charge of data protection. Our supervisory authority is the French data-protection authority, the Commission nationale de l'informatique et des libertés (CNIL).

• Account data — name, work email address, optional profile photo, organisation, role, language and theme preferences, and technical sign-in identifiers. You sign in with a Google account, a Microsoft account (which then send us only your name, email address and profile photo) or a one-time code sent by email; we store no passwords. Purpose: opening and administering your access to klair.dev, Agora and the applications. Legal basis: performance of the contract.
• Hermès, the intake assistant — the messages you exchange with Hermès on klair-ai.fr and klair.dev, the documents you upload there, the specification prepared, a visitor identifier (cookie) and your IP address in hashed form. Hermès is an artificial-intelligence system, and it tells you so. Purpose: understanding your need and preparing a proposal. Legal basis: pre-contractual steps and legitimate interests.
• Projects and exchanges — quotes, messages, milestone sign-offs and attachments exchanged in the portal. Purpose: delivering the service. Legal basis: performance of the contract.
• Billing — legal name, billing address, VAT or SIREN number, history of subscriptions, seats, credits and payments. Card numbers and full bank details never touch our servers: they are collected by our payment provider. Purpose: invoicing and collection. Legal basis: performance of the contract and accounting and tax obligations.
• Platform usage — credit consumption per application and per person, number of seats, storage used, the organisation's activity log. Purpose: applying plans and limits, billing, ensuring transparency towards the organisation's owners. Legal basis: performance of the contract.
• Communications — emails, support requests, meetings, and service emails (end of trial, failed payment, security). Legal basis: performance of the contract and legitimate interests.
• Technical data and logs — IP address (hashed for rate-limiting), browser, timestamps, request and error logs. Purpose: securing the service, ensuring its availability, preventing fraud and abuse (in particular multiple trials). Legal basis: legitimate interests.
• Audience measurement — visit statistics for the klair-ai.fr and klair.dev websites through Google Analytics, only if you accept it in the cookie banner, and anonymous performance measurement. Legal basis: consent for Google Analytics; legitimate interests for anonymous performance measurement.
• Business communications — infrequent messages to business contacts, with an unsubscribe link in every message. Legal basis: legitimate interests, or your consent where the law requires it.

Some data is provided to us by your organisation (for example when a colleague invites you). Where we rely on legitimate interests, we have balanced those interests against your rights, and you may object.

When you use Agora, a klair application or software we host, your organisation is the controller and klair acts as processor, on its instructions and under section 14 of our terms of service, which constitutes the data-processing agreement (Article 28 GDPR). This covers:

• Agora content: messages, rooms, missions, instructions, files, outputs produced by the agents, the organisation's memory and the vector representations ("embeddings") computed for search;
• data received through connectors (section 05);
• the data of the applications and of hosted software, and the code and content of custom projects.

Each organisation has its own database. The individuals whose data appears in this content — for example the correspondents of a connected mailbox — exercise their rights with the client organisation; we help it respond.

Support access. An authorised member of klair's staff enters an organisation only to assist it or for the security of the service, for a limited time and for a written reason; each entry and each change is recorded in the organisation's activity log. klair's staff do not read data received from Google or Microsoft services, except in the cases set out in section 05.

A connector exists only if you authorise it yourself, on Google's or Microsoft's consent screen, and you can withdraw it at any time.

The permissions we request.

All these permissions are delegated: Agora acts on behalf of the user who connected their account, never with access to an entire domain or tenant. We request the narrowest permissions that enable the function.

Usage. The data received is used only to provide the features of Agora and of the applications that you use and see in the interface. It is never used for advertising, never sold, and never used to develop, improve or train generalized artificial-intelligence (AI) and/or machine-learning (ML) models.

Storage. Access tokens are stored encrypted in France and are never exposed to agents. By default, Agora reads data on demand without copying it; the excerpts an agent uses remain in the task history. When you ask for a folder to be synchronised or a document to be saved, a copy is kept in your organisation's database, in France, until your organisation deletes it or its subscription ends (section 09).

Transfers. Data is transmitted only to the processors needed for the requested function — our host and our AI model providers (section 08), under terms that prohibit them from using it to train their models —, or where the law requires it.

Human access. No member of klair's staff reads this data, except (i) with your express agreement for specific items, for example for support; (ii) where necessary for security, in particular to investigate abuse; (iii) to comply with the law; or (iv) in aggregated and anonymised form for the internal operation of the service.

Withdrawal. You can disconnect a connector from Agora, or withdraw access from myaccount.google.com/permissions or myapps.microsoft.com. Access stops immediately and the tokens are deleted. To have copies already imported deleted, use Agora's deletion features or write to privacy@klair.dev.

Google commitment. klair's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The other connectors (HubSpot, Slack, Notion, Confluence, Airtable…) follow the same rules on authorisation, usage, storage and withdrawal.

Agora, Hermès and the applications' AI features send to artificial-intelligence models the instructions and content excerpts needed for the requested task. We use them under our providers' business API and enterprise terms, which prohibit them from training their models on this data and limit its retention to abuse prevention.

• Agora agent models — Microsoft's Azure OpenAI Service, processed in the European Union ("EU Data Zone"). At a client's request, a Mistral AI (France) model or a model hosted by klair may be substituted for it.
• Specialised features (memory, embeddings search, reading documents and handwriting, drafting) — depending on the feature, OpenAI, Anthropic, Google (Gemini) or Mistral AI, through our AI gateway, which does not retain the content of exchanges.

Your content is not used to train any artificial-intelligence model, either by klair or by its providers. AI outputs are presented as such and remain under human control; we take no decision producing legal effects or significantly affecting you on the sole basis of automated processing.

We use strictly-necessary cookies (sign-in, security, preferences, conversation with Hermès) and, if you accept them, Google Analytics audience-measurement cookies. The detail — the name, purpose and lifetime of each tracker — and how to change your choice are set out in our cookies policy.

We disclose personal data only to the following processors, each bound by a contract compliant with Article 28 GDPR, and only to the extent necessary for their function:

The third-party services you connect (Google, Microsoft, HubSpot, Slack…) are not our processors: they are provided by their publishers to your organisation, under their own terms. Any change to this list is published on this page and notified to the owners of client organisations at least thirty days in advance.

We also disclose data, where strictly necessary, to our professional advisers (lawyers, accountants, auditors) bound by confidentiality, to competent authorities where the law requires it, and to a potential successor in the event of a corporate transaction. We do not sell personal data, we do not rent contact lists, and we carry out no behavioural advertising.

Where a recipient is located outside the European Union, the transfer is framed by a European Commission adequacy decision, by the EU–US Data Privacy Framework where the provider is certified under it, or by the Commission's standard contractual clauses (Decision 2021/914) supplemented by the necessary additional measures; a copy of these safeguards is available on request.

• Accounts — for the duration of the relationship, then twelve months after the last activity.
• Conversations with Hermès — erased ninety days after the last activity if they do not lead to an engagement; otherwise, kept with it.
• Agora content and connector data — for the duration of the organisation's subscription; at the end of a trial without a subscription, after a termination or a pause, ninety days, then deleted. A connector's access tokens are deleted as soon as it is disconnected.
• Application data — for as long as the organisation exists, then deleted within the same ninety-day period.
• Hosted software — for the duration of hosting; at its end, thirty days (without a production environment) or ninety days (with one), then purged, after the data has been returned (section 16 of the terms of service).
• Projects, invoices and accounting records — for the duration of the relationship, then ten years (Article L123-22 of the French Commercial Code).
• An organisation's activity log — for as long as the organisation exists.
• Technical and security logs — ninety days at most.
• Audience measurement — fourteen months at most.
• Business communications — until you unsubscribe, the record of the unsubscription then being kept to ensure it is honoured.

Encrypted backups expire at the latest forty-five days after their creation; deleted data therefore disappears from backups within that period, not instantly. You may request earlier deletion at any time; we comply unless a legal retention obligation applies.

We implement appropriate technical and organisational measures: a separate database per organisation; encryption in transit (TLS) and at rest; encrypted connector tokens and secrets kept in a dedicated vault; passwordless sign-in; least-privilege, justified and logged staff access; encrypted backups. As no system is perfectly secure, we review these measures regularly. In the event of a data breach likely to result in a risk to your rights, we notify the CNIL within seventy-two hours and, where the risk is high, the individuals concerned without undue delay; when we act as processor, we alert the client organisation within forty-eight hours. Security matters and responsible disclosures go to security@klair.dev.

Under the GDPR, you have the rights of access, rectification, erasure, restriction and objection, the right to data portability, and the right to withdraw your consent at any time where processing is based on it. You may also set instructions on the fate of your data after your death. Send your request to privacy@klair.dev; we respond within one month, extendable by two months for complex or numerous requests, of which we would inform you. For data we process on behalf of an organisation (section 04), preferably contact that organisation; we forward to it any request we receive. You may at any time lodge a complaint with the CNIL (cnil.fr), without prejudice to a judicial remedy.

We may update this policy. Any material change is signalled to you by appropriate means before it takes effect; minor changes are published on this page with a new effective date.

Questions about your personal data and exercise of your rights — privacy@klair.dev. Security and responsible disclosure — security@klair.dev. Legal notices — legal@klair.dev. Supervisory authority — the Commission nationale de l'informatique et des libertés (CNIL), cnil.fr.

The French version of this policy is authoritative. English and Spanish translations are provided as a courtesy; in the event of any discrepancy of interpretation, the French version prevails.