Privacy Policy

Harvenci is operated by DATA MONTANA, a company registered in France at 60 Rue François 1er, 75008 Paris, France (“we”, “us”, “our”). Harvenci is an AI-powered WhatsApp commerce platform that enables businesses to automate customer interactions, process orders, and manage sales through WhatsApp.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our platform. We are committed to protecting your privacy and complying with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the French Loi Informatique et Libertés, and all applicable data protection legislation.

Data Controller: DATA MONTANA, 60 Rue François 1er, 75008 Paris, France

Contact: contact@harvenci.ai (general inquiries and Data Protection Officer).

We collect and process personal data from three categories of users:

2.1 Business Users (Merchants)

When you create a Harvenci account, we collect:

• Account Information: Email address, name, profile picture (via Google/OAuth sign-in)
• Business Information: Store name, business name, contact details, business address
• Product Data: Product listings, prices, descriptions, images you upload
• Financial Information: Payment details processed securely by Stripe; bank account details for payouts
• Phone Numbers: WhatsApp Business numbers purchased or connected through our platform
• Usage Data: Conversation logs, message counts, platform activity, feature usage patterns

2.2 End Customers (WhatsApp Users)

When customers interact with merchant AI agents via WhatsApp, we process:

• WhatsApp Phone Number: To identify and respond to conversations
• Conversation Content: Messages exchanged with AI agents, including text, images, and voice messages
• Order Information: Items ordered, delivery details, payment status
• Interaction Data: Timestamps, message types, session duration

2.3 Consultants (Partners)

If you join our consultant program, we collect:

• Company name, professional experience, website URL
• Commission and payout records
• Bank account details for commission payouts (processed via Stripe)

We use your personal data for the following purposes:

• Provide Services: Operate AI-powered WhatsApp agents, process orders, manage product catalogs, and facilitate customer communications
• Process Payments: Charge for subscription and usage-based services, process customer payments on behalf of merchants, and distribute commissions to consultants
• Improve AI: Train and improve our AI models using anonymized and aggregated conversation data to enhance response quality and accuracy
• Communicate: Send service updates, billing notifications, security alerts, and support responses
• Comply with Law: Meet legal and regulatory obligations, respond to lawful requests from authorities, and maintain required records
• Prevent Fraud: Detect, investigate, and prevent fraudulent or unauthorized activity on our platform

We process your personal data on the following legal bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the services you have signed up for, including account management, order processing, payment handling, AI agent operation, and WhatsApp messaging services.
• Legitimate Interest (Art. 6(1)(f)): Processing necessary for our legitimate interests, including improving our AI models with anonymized data, platform security, fraud prevention, and service analytics. We conduct balancing tests to ensure our interests do not override your rights.
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, including French tax and accounting regulations (Code de commerce, Code général des impôts), anti-money laundering requirements, and data protection legislation.
• Consent (Art. 6(1)(a)): Where required, we obtain your explicit consent for specific processing activities such as marketing communications, optional analytics, and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

We share personal data with the following service providers (sub-processors), each bound by data processing agreements:

SCCs = Standard Contractual Clauses approved by the European Commission for international data transfers. We do not sell your personal data to third parties.

Some of our service providers are located outside the European Economic Area (EEA). When we transfer personal data from the EU to non-EU countries, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): We use the European Commission’s approved SCCs with all non-EU sub-processors to ensure an adequate level of data protection.
• EU-US Data Privacy Framework: Where applicable, we rely on the EU-US Data Privacy Framework certification of our service providers as an additional safeguard.
• Transfer Impact Assessments: We conduct Transfer Impact Assessments (TIAs) for each international transfer to evaluate the legal framework of the recipient country and implement supplementary measures where necessary.

You may request a copy of the relevant safeguards by contacting us at contact@harvenci.ai.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

Upon expiry of a retention period, data is securely deleted or irreversibly anonymized.

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): Obtain confirmation of whether your personal data is being processed and request a copy of that data.
• Right to Rectification (Art. 16): Request correction of inaccurate personal data or completion of incomplete data.
• Right to Erasure (Art. 17): Request deletion of your personal data where there is no compelling reason for continued processing. See our Data Deletion Policy for details.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller. Available via your account Settings.
• Right to Restriction of Processing (Art. 18): Request limitation of processing in certain circumstances, such as when you contest the accuracy of your data.
• Right to Object (Art. 21): Object to processing based on legitimate interest, including profiling. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right Not to Be Subject to Automated Decision-Making (Art. 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

Harvenci uses artificial intelligence to power conversational agents on behalf of merchants. We want to be transparent about how AI is used on our platform:

• No automated decisions with legal or similarly significant effects: Our AI agents do not make decisions that produce legal effects or similarly significantly affect individuals. All AI interactions are assistive in nature.
• AI use cases: Customer service automation, product recommendations, order processing assistance, and conversational commerce facilitation.
• Human intervention: Users can request human intervention at any time during an AI-powered conversation. Merchants can configure their agents to escalate to human operators.

For business customers who use Harvenci to process end-customer personal data, a Data Processing Agreement (DPA) is available upon request. The DPA governs the processing of end-customer personal data and establishes the respective obligations of DATA MONTANA as a data processor and the merchant as a data controller.

• To request a DPA, contact us at contact@harvenci.ai.
• A list of sub-processors is maintained and available upon request.
• We provide 30 days’ advance notice of any changes to our sub-processor list, allowing you to object to new sub-processors.

We use essential cookies only, which are strictly necessary for the operation of our platform:

• Session Cookies: To maintain your authenticated session (via Clerk)
• CSRF Protection Cookies: To prevent cross-site request forgery attacks

We do not use:

• Advertising or marketing cookies
• Tracking pixels
• Third-party analytics

Cookie consent is managed via an on-site banner in compliance with CNIL guidelines and the ePrivacy Directive.

In the event of a personal data breach, we follow strict notification procedures in accordance with the GDPR:

• Supervisory Authority Notification (Art. 33): We will notify the Commission Nationale de l’Informatique et des Libertés (CNIL) within 72 hours of becoming aware of a breach that is likely to result in a risk to individuals’ rights and freedoms.
• Individual Notification (Art. 34): Where a breach is likely to result in a high risk to individuals’ rights and freedoms, we will notify affected individuals without undue delay, providing clear information about the nature of the breach and recommended protective measures.
• Incident Response: We maintain documented incident response procedures, including breach detection, containment, assessment, notification, and post-incident review.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• All data transmitted over HTTPS/TLS encryption
• Database encryption at rest
• Multi-tenant data isolation ensuring strict separation between merchant data
• Regular security audits and vulnerability assessments
• PCI-DSS compliance for payment processing via Stripe (we never store card details directly)
• Role-based access controls and strong authentication requirements

Harvenci is a business service intended exclusively for users aged 18 and older. We do not knowingly collect or process personal data from children under 18. If you believe we have inadvertently collected personal data from a minor, please contact us immediately at contact@harvenci.ai and we will promptly delete the data.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will notify you via email and through a prominent notice on our platform.
• We will provide at least 30 days’ advance notice before material changes take effect.
• Your continued use of Harvenci after the effective date of the updated policy constitutes acceptance of the changes.

We encourage you to review this page periodically. The “Last updated” date at the top of this policy indicates when it was last revised.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

If you are not satisfied with our response or believe our processing of your personal data does not comply with data protection law, you have the right to lodge a complaint with the relevant supervisory authority:

You may also use the EU Online Dispute Resolution platform: https://ec.europa.eu/consumers/odr