Privacy Policy
Version 2026-10 · Last updated: October 6, 2026 · Effective date: September 25, 2026
This English version is provided for convenience. In case of discrepancy, the French version prevails.
1. Identity of the Data Controller
This Privacy Policy is published by:
Hatch OS, a simplified joint-stock company (société par actions simplifiée, SAS) with a share capital of €1,000
Registered office: 104 rue de la Folie-Méricourt, 75011 Paris, France
Registered with the Paris Trade and Companies Register (Registre du Commerce et des Sociétés) under number 103 890 893
President: Patrick Rakotondrajao
DPO contact: cesar@gethatch.io
Hatch OS (hereinafter “Hatch OS”, “we” or “our”) publishes and operates the SaaS platform accessible from the gethatch.io domain and its subdomains (hereinafter the “Solution”), designed for franchise networks and their staff.
Roles under the GDPR. Hatch OS acts as data controller for the data required to manage its relationship with its customers: account requests, administrator accounts, billing, proof of acceptance of the terms, security of the Solution. For the data that its customers integrate into the Solution and the data of their users and staff, Hatch OS acts as processor on behalf of the customer, who is the data controller for such data, under the conditions set out in the Terms of Sale or in the subscription agreement signed with the customer.
2. Personal Data Collected
We collect and process the following categories of data:
2.1 Data provided directly by the User
- Last name, first name, professional email address
- Phone number (mandatory when requesting an account, optional afterwards)
- Company / franchise data (name of the concept, number of locations, role, location)
- Proof of acceptance of the Terms of Use and the Terms of Sale: document and version accepted, date and time, email address and name of the concept at the date of acceptance
- Content created in the platform (messages, templates, uploaded documents)
2.2 Data collected via Google OAuth
When you connect your Google account to Hatch OS, we request the following permissions (“scopes”):
| Google scope | Data accessed | Purpose |
|---|---|---|
https://www.googleapis.com/auth/userinfo.email | Primary email address of your Google account | Creation and authentication of your Hatch OS account |
https://www.googleapis.com/auth/userinfo.profile | Last name, first name, profile photo | Personalization of your user profile |
https://www.googleapis.com/auth/drive.readonly | Google Drive files you choose to connect | Reading the selected documents to feed the AI agent (RAG) |
https://www.googleapis.com/auth/drive.metadata.readonly | Drive file metadata (name, type, date, folder structure) | Display of the file picker in the Hatch OS interface |
2.3 Technical data
- IP address, browser type, operating system
- When requesting an account: bot verification (Cloudflare Turnstile), which processes the IP address and technical signals from the browser
- Connection and platform usage logs
- Technical and session cookies (see section 9)
2.4 Billing data
When the customer subscribes to a plan, we transmit to our payment provider Stripe the name, email address, billing address and, where applicable, the VAT number of the account administrator. Payment card data is entered directly on Stripe’s pages and processed by Stripe alone: Hatch OS has no access to it and does not store it. We retain the subscription status, the number of locations billed and the billing due dates.
2.5 Visitors of the gethatch.io website
- Audience measurement. The website measures its traffic with PostHog (servers in the European Union, in Germany) and Vercel Web Analytics: pages viewed, clicks on call-to-action buttons, traffic source, device and browser type, page load speed. This measurement works without any cookie or storage in your browser: visits are grouped by an anonymous identifier computed on the server side and renewed every day, and the IP address is not retained. It is used only to produce statistics on the use of the website and does not allow you to be tracked on other websites.
- Demo request. Booking a meeting on the demo page goes through Cal.com, embedded in the page. You provide your name, your email address and, where applicable, your company and your answers to the booking form. This data is used to organize the meeting and to contact you again.
3. Purposes of Processing
We process your personal data for the following purposes:
- Providing the service: account creation, authentication, access to the platform’s features
- Reviewing account requests: verification of the information provided and fraud prevention before an account is activated
- Feeding the AI agent (RAG): indexing the documents you choose to connect (Google Drive, direct uploads) so that the AI assistant can answer your staff’s questions based on your content
- Customer support: responding to your support requests
- Service improvement: aggregated and anonymized statistical analyses. Our customers’ data and content are never used to train or fine-tune artificial intelligence models, and our AI model providers are contractually bound not to use them to train their own
- Security: detection of fraud, abuse and security incidents, bot protection of the account request form
- Billing and payment: management of the subscription, payments and invoices
- Proof: retention of proof of acceptance of the Terms of Use and Terms of Sale
- Legal obligations: invoicing, accounting, regulatory compliance
- Website audience measurement: traffic statistics for gethatch.io
- Demo meetings: organization of the meeting and sales follow-up
4. Use of Google Data: Limited Disclosure (Google API Services Limited Use)
Hatch OS’s use of information received from Google APIs, and its transfer to any other application, adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In practice, this means that:
- The Google Drive files we access are used solely to feed your AI agent (RAG) in order to answer your users’ questions within the Hatch OS platform
- We never transfer your Google data to third parties, except where strictly necessary to provide or improve user-facing features (subprocessors listed in section 6), to comply with the law, or as part of a merger, acquisition or sale of assets, with your consent
- We never use your Google data for advertising purposes
- We never use your Google data to train, fine-tune or improve generalized artificial intelligence models or third-party models
5. Legal Basis for Processing (GDPR)
| Purpose | Legal basis |
|---|---|
| Providing the service, creating and managing your account | Performance of the contract (Art. 6(1)(b) GDPR) |
| Reviewing an account request | Pre-contractual measures (Art. 6(1)(b) GDPR) |
| Payment and subscription management | Performance of the contract (Art. 6(1)(b) GDPR) |
| Bot protection, proof of acceptance of the terms | Legitimate interest (Art. 6(1)(f) GDPR) |
| Google OAuth connection and Drive access | Explicit consent (Art. 6(1)(a) GDPR) |
| Support and service communications | Performance of the contract |
| Invoicing, accounting | Legal obligation (Art. 6(1)(c) GDPR) |
| Statistical analyses, security | Legitimate interest (Art. 6(1)(f) GDPR) |
| Audience measurement of the gethatch.io website | Legitimate interest, cookieless (Art. 6(1)(f) GDPR) |
| Demo meetings | Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) |
You may withdraw your consent to the Google connection at any time from your Hatch OS account or from your Google account settings (https://myaccount.google.com/permissions).
6. Recipients and Subprocessors
Your data is hosted and processed by the following subprocessors, chosen for their level of security:
| Subprocessor | Service | Location | Transfer mechanism |
|---|---|---|---|
| Supabase | Database hosting, authentication, storage | EU (France) | Not applicable |
| Generation of responses by artificial intelligence (Gemini) and Google Drive connection | United States | DPF + SCC | |
| Twilio | Message routing | United States | DPF + SCC |
| Meta Platforms | Delivery of WhatsApp messages | Outside the EU (global infrastructure) | DPF + SCC |
| Vercel | Hosting of the interface (ephemeral processing, without persistent storage), hosting and visit statistics of the gethatch.io website | EU (France) | Not applicable |
| Railway | Content synchronization processing | EU (Netherlands) | Not applicable |
| Hostinger | Hosting of a technical orchestration component | EU (France) | Not applicable |
| Resend | Sending of transactional emails | United States | DPF + SCC |
| PostHog | Product audience measurement (pseudonymized) and gethatch.io website audience measurement (cookieless) | EU (Germany) | Not applicable |
| ElevenLabs | Transcription of voice messages | United States | SCC |
| Stripe | Subscription payment and billing | United States / EU (Ireland) | DPF + SCC |
| Cloudflare | Bot protection of the account request form (Turnstile) | United States | DPF + SCC |
| Cal.com | Booking of demo meetings from the gethatch.io website | United States | SCC |
Data is stored and backed up within the European Union or the European Economic Area. Certain ancillary processing operations (artificial intelligence generation, message routing, email sending, payment) involve subprocessors established outside the European Economic Area. These transfers are governed by an adequacy decision (Data Privacy Framework, “DPF”), by Standard Contractual Clauses (“SCC”) approved by the European Commission, or by any other GDPR-compliant mechanism.
We never sell your personal data.
7. Retention Period
- Account data: duration of the contract + 3 years after termination (commercial statute of limitations)
- Indexed Google Drive documents (RAG): for as long as you maintain the Google connection; deleted within 30 days after disconnection or upon request
- Technical logs: 12 months
- Billing data: 10 years (legal accounting obligation)
- Proof of acceptance of the Terms: retained, including after the account is deleted, for the period necessary to prove the contractual relationship
- Customer data processed as processor: returned upon request within 30 days following the end of the subscription, then deleted, subject to legal obligations and backup purge cycles
- Demo requests: 3 years after the last contact
8. Your Rights (GDPR)
In accordance with Regulation (EU) 2016/679 (GDPR), you have the following rights:
- Right of access to your personal data
- Right to rectification of inaccurate data
- Right to erasure (“right to be forgotten”)
- Right to restriction of processing
- Right to portability of your data
- Right to object to processing
- Right to withdraw your consent at any time
- Right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr)
To exercise these rights, contact our DPO: cesar@gethatch.io. We respond within a maximum of one month from receipt of your request.
8.1 How to revoke Google access
You can revoke Hatch OS’s access to your Google account at any time:
- From Hatch OS:
Paramètres → Intégrations → Google → Déconnecter - From Google:
https://myaccount.google.com/permissions
After revocation, the documents indexed from Drive are deleted from our systems within 30 days.
9. Cookies
The Solution uses only cookies that are strictly necessary for its operation (session, authentication, preferences). No advertising or third-party tracking cookie is set without your explicit consent.
On the gethatch.io website, audience measurement sets no cookie and writes nothing to your browser (see 2.5): this is why no consent banner is displayed. The Cal.com calendar embedded in the demo page may set the cookies necessary for its operation when you use it.
10. Security
We implement appropriate technical and organizational measures to protect your data: encryption in transit (TLS 1.2+) and at rest, access controls, logging, regular backups, security testing, and the principle of least privilege for internal access.
11. Minors
The Solution is not intended for minors under the age of 16. We do not knowingly collect data from minors.
12. Changes
We may update this Privacy Policy. Any substantial change will be notified to users by email and by a visible notice in the Solution at least 30 days before it takes effect.
13. Contact
For any question regarding this policy or your personal data:
Hatch OS, Data Protection Officer
Email: cesar@gethatch.io
Address: 104 rue de la Folie-Méricourt, 75011 Paris, France