Privacy policy.

Scope and data controller

This policy explains how Hors des Sentiers (“HDS”, “we”, “us”) processes personal data through horsdessentiers.com, the HDS workspace and connected services, including authorised Instagram and WhatsApp Business integrations.

Hors des Sentiers, SIRET 447 595 687 00040, whose business address is 47 rue Vivienne, 75002 Paris, France, is the controller for the processing described here. Privacy contact: brief@horsdessentiers.com.

Data we collect

• Account and professional information: name, work email, role, company, profile details and authentication identifiers.
• Projects and business content: briefs, space requirements, dates, contacts, messages, files, proposals and information you choose to add to HDS.
• Public-site information: early-access applications, enquiries, shortlist choices and information submitted through HDS forms.
• Connected-channel data: when an authorised user connects a professional Meta account, HDS may process the Instagram Business or Professional account, Facebook Page or WhatsApp Business account identifiers and profile information made available by Meta, access tokens, conversations, messages, sender or recipient identifiers, timestamps, attachments and delivery metadata required for the enabled messaging features.
• Payments and signatures: transaction, invoice and signature-status information. Payment-card details are handled by the relevant payment provider and are not stored by HDS.
• Technical data: security logs, device and browser information, IP address and essential information needed to deliver and protect the services.
• Optional analytics: audience and campaign events collected only after consent across HDS websites and subdomains, including approximate location, device information and account activity associated with an internal identifier and role.

HDS processes connected-channel data only after an authorised user deliberately connects the relevant business account or sends content to HDS. HDS does not ask for or store a user's Facebook, Instagram or WhatsApp password.

How we use data

• Provide and secure HDS accounts, Projects, Spaces, Inbox and collaboration features.
• Bring authorised business conversations into one Inbox and let users read, organise and respond through the selected channel.
• Match project requirements with spaces and support professional enquiries, proposals and activations.
• Process requested payments, invoices and electronic signatures through specialist providers.
• Respond to support, early-access and rights requests.
• Prevent abuse, investigate incidents and comply with legal obligations.
• With consent, measure aggregate use of the public website and improve the experience.

Where HDS offers assisted or AI-enabled features, the relevant content is processed only to provide the feature requested by the user and subject to the access controls and provider safeguards applicable to that service.

Legal bases

Depending on the context, we rely on performance of a contract or steps requested before a contract, our legitimate interests in operating and securing a professional service and answering business enquiries, compliance with legal obligations, and consent where the law requires it, including optional website and Workspace analytics and the connection of certain third-party services.

Meta, Instagram and WhatsApp

Meta Platforms, Inc. and its affiliates provide the Instagram, Facebook and WhatsApp interfaces used by connected HDS features. Meta processes information under its own terms and privacy policy. HDS uses data received from Meta only to provide the connected functionality selected by the authorised business user, maintain security, troubleshoot the integration and comply with applicable law and Meta platform requirements.

HDS does not sell Meta user data, use message content for third-party advertising, or disclose it to unrelated data brokers. Permissions are limited to those required for enabled HDS features. A user may disconnect a Meta channel at any time from the relevant HDS integration settings or from Meta's own business integration settings.

Service providers and international transfers

We use specialist providers to operate HDS, including Cloudflare for hosting and security, Kinde for authentication, Meta for connected communication channels, Stripe for payments, Dropbox Sign for electronic signatures, Flodesk or form providers for requested communications, Amplitude for optional analytics, and carefully selected infrastructure or AI providers where a requested HDS feature requires them.

Providers act under their applicable contractual terms and, where they process data on our behalf, under appropriate data-protection obligations. Some processing may take place outside the European Economic Area. Where required, transfers rely on recognised safeguards such as adequacy decisions or standard contractual clauses.

Sharing and access

Data is available only to authorised HDS users, the organisations or collaborators involved in the relevant Project or conversation, HDS personnel who need access to provide the service, and providers necessary to operate it. We may disclose information where required by law or to protect users, HDS or third parties. We do not sell personal data.

Retention

We retain account, Project and connected-channel data for as long as the account or professional relationship remains active and afterwards only for the period needed to meet contractual, security, dispute-resolution and legal obligations. Early-access applications and professional enquiries may be retained for up to three years from collection or the last meaningful contact. Optional audience analytics are retained for no longer than 25 months.

When a connected Meta channel is disconnected, HDS stops collecting new data from that channel. Existing data is deleted or anonymised on request unless it must be retained for a legal obligation, the establishment or defence of legal claims, security, or a documented business record shared with another authorised participant.

Your rights and choices

Subject to applicable law, you may request access to, correction or deletion of your personal data, restriction of processing, portability, or object to certain processing. You may withdraw consent at any time without affecting earlier processing.

To exercise your rights, email brief@horsdessentiers.com. We may need to verify your identity and authority over a connected business account. You may also lodge a complaint with the French data protection authority, the CNIL.

Instructions specifically for deleting data received through a Meta integration are available on our Data deletion page.

Security

We use organisational and technical measures designed to protect personal data, including access controls, encrypted transport, restricted production access and service monitoring. No online service can guarantee absolute security.

Updates

We may update this policy as HDS services and connected features evolve. The revision date above identifies the current version. Material changes will be communicated through an appropriate HDS channel.