Privacy Policy

Harmate is operated by Enzo MARTIN, an active sole proprietor, under the ALL activity. He acts as controller for processing specific to the product.

Last updated: August 15, 2026.

1. Data Controller

Harmate is operated by Enzo MARTIN, an active sole proprietor, under the ALL activity. He acts as controller for processing specific to the product.

Current legal status:

  • active sole proprietor;
  • SIREN: 108 698 242;
  • SIRET: 108 698 242 00014;
  • business locality: Saint-Martin-d'Hères, France; detailed business address: [NOT PUBLICLY DISCLOSED].

The applicable VAT regime is specified, where necessary, in the Terms of Sale and in the checkout flow.

Privacy contact: contact@harmate.com.

2. Roles Over Data

Two situations coexist:

  • Account and platform usage data: Enzo MARTIN acts as data controller.
  • Data collected through customer questionnaires: the customer creating and distributing the questionnaire acts as data controller; Enzo MARTIN acts as technical data processor through the Harmate product.

3. Data Categories

Depending on usage, the Harmate product enables the processing of:

  • account identity and contact data (email, first name, last name, organization data when provided);
  • authentication and session data (session tokens in HttpOnly cookies on the authentication service);
  • platform content (questionnaires, responses, exports, preferences);
  • organization contacts shared explicitly (first name, last name, email and phone), audiences, identity links, final-submission snapshots and linked sourced personas; a personal contact note is never copied into the organization projection;
  • technical security and operations data (minimized logs);
  • internal analytics data only after explicit consent (see Cookie Policy).

Processing is performed to:

  • provide Harmate services (legal basis: contract performance);
  • let an authorized organization reuse shared contacts, apply an audience to a draft questionnaire, and read memory limited to final responses connected by a persisted identity link;
  • process a sourced persona only after an organization explicitly enables its instruction, in local mode; the instruction is disabled by default and does not send these data to an external LLM provider;
  • secure the platform, prevent abuse, and maintain service continuity (legal basis: legitimate interest);
  • provide user support and technical diagnostics (legal basis: legitimate interest and/or contract performance);
  • comply with legal obligations (legal basis: legal obligation);
  • measure audience and improve product analytics (legal basis: consent where required).

5. Data Recipients

Data is never sold.

Data may be accessed by:

  • authorized people contributing to ALL and the Harmate product;
  • technical providers required to operate the service (for example hosting, analytics tooling, authentication service);
  • customer organizations acting as controllers for questionnaires they manage.
  • the authorized organization space that owns the corresponding shared contacts, audiences, links and snapshots; another space cannot read them.

6. International Transfers

Primary hosting is operated in Europe (Infomaniak).

Some technical providers may process data outside the EU (including analytics tooling), only under applicable legal transfer mechanisms (for example adequacy decision, standard contractual clauses, or equivalent provider mechanism).

The audience and sourced-memory contract authorizes no transfer of contact data, notes, verbatim responses or final snapshots to an external LLM. Any future change would require a separate instruction and a documented provider, territory and safeguards in the subprocessor register before activation.

7. Retention

Current retention principles:

  • account data: kept while the account is active, then deleted upon account deletion request;
  • questionnaire data: kept while the customer organization keeps it in its workspace, unless deletion is requested;
  • analytics consent proof: eu-consent cookie retained for 180 days;
  • technical logs: retained only for operational security, diagnostics, and service continuity needs.

A more detailed per-category operational retention policy is currently being formalized.

8. Your Rights

You can exercise your rights of access, rectification, erasure, restriction, and objection.

Available in-app paths:

  • Settings > Personal Data > Harmate Export / Account Export / Combined Export;
  • Settings > Personal Data > Delete My Account.

You can also contact contact@harmate.com.

For questionnaire response data, requests should first be addressed to the organization that distributed the questionnaire (controller for that scope).

You may also lodge a complaint with the CNIL: https://www.cnil.fr/.

9. Cookies And Trackers

Details about necessary and analytics cookies are available in the Cookie Policy.

10. Updates

This policy may evolve with product and regulatory changes.

In case of material updates, notice will be published on the website or within the application.