1. Who we are

HelloLeo is a product operated by Terros SAS, a French company registered under SIREN 890560436, headquartered in Paris, France. For any privacy-related inquiries, contact [email protected].

2. Information we collect

3. Sub-processors & third-party services

We use carefully selected sub-processors to deliver our Services. All have GDPR-compliant agreements in place.

Enterprise customers can request sovereign AI models (EU-hosted Mistral, self-hosted LLMs) and dedicated infrastructure in their region of choice. Contact [email protected].

4. How we use your data

1. Provide, operate, and improve the Services
2. Process payments and manage subscriptions
3. Provide customer support and service updates
4. Detect and prevent fraud, abuse, and security incidents
5. Comply with legal obligations
6. Improve our AI systems (see Section 11 on AI training & opt-out)

5. Legal basis for processing (GDPR)

• Performance of contract — account management, billing, service delivery
• Consent — cookies, analytics, optional AI training
• Legitimate interests — fraud detection, service improvement, security monitoring
• Legal obligations — tax records, legal compliance

6. Cookies & tracking

We use cookies and similar technologies to:

• Maintain authenticated sessions
• Store user preferences
• Analyze aggregated usage

We obtain consent before non-essential tracking. You can manage preferences via our cookie banner or browser settings.

7. Data hosting & international transfers

Our primary infrastructure is hosted in North America (OVHcloud Canada, Beauharnois QC) and Europe (OVHcloud France). Published customer applications are served through Cloudflare's global CDN for low latency worldwide.

Some sub-processors (Anthropic, Stripe, SendGrid, Pipedream) operate from the USA. Transfers outside the EEA are covered by Standard Contractual Clauses (SCCs) and, where applicable, Data Privacy Framework certifications.

8. Data retention

• Account data — retained while your account is active. Deleted within 30 days after account deletion.
• Project content — retained while the project exists. Backups kept for 7 days after deletion.
• Billing records — retained for 10 years (French legal obligation).
• Logs and analytics — retained for 90 days maximum.
• Chat history — retained for the lifetime of the project unless explicitly deleted.

9. Data sharing & disclosure

We share data only:

• With sub-processors listed in Section 3, under contract and only as necessary to provide the Services
• With your explicit consent
• To comply with legal obligations (court orders, law enforcement requests)
• To protect our rights, property, or safety

We do not sell personal data.

10. Your rights (GDPR)

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erasure ("right to be forgotten")
• Restrict or object to processing
• Data portability (export)
• Withdraw consent at any time
• Lodge a complaint with the CNIL or your local data protection authority

To exercise these rights, contact [email protected]. We respond within 30 days.

11. AI model training & transparency

We may use aggregated, anonymized usage data to improve our own AI systems and features. We do not share your code, prompts, or project content with third-party model providers for training purposes.

• Enterprise customers can opt out of any training-related data use
• Data from users under 18 is never used for AI training
• We comply with the EU AI Act, including transparency summaries for training data categories

12. Security

We implement industry-standard technical and organizational measures to protect your data. For details, see our Security page.

13. Children's privacy

Our Services are not intended for individuals under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete the data.

14. Updates to this policy

We may update this policy to reflect changes in practices, technology, or regulation. For material changes, we will notify you via email or in-app at least 30 days before the update takes effect.

15. Contact