Privacy policy

1. Who is responsible

Two situations are distinct:

• for the website, accounts, company sign-up, invoicing and sales exchanges, (SIREN , , ) is the controller;
• for what a customer company's space contains (messages, files, presence, meetings, recordings, transcripts, meeting notes), that company is the controller and the publisher acts on its behalf, under a data processing agreement (GDPR article 28).

For any question or request: . [To be confirmed: contact details of the data protection officer, if one is appointed.]

2. The data we process

Data you give us:

• account: display name, e-mail address, avatar, status, language and preferences;
• customer company: company name, SIREN or VAT number, address, billing contact, optional answers to the sign-up questions;
• contact form: name, company, e-mail address, team size, subject and message;
• content of a space: messages, files, reactions, decoration and, if the company turns it on and you agree, the sound and picture of meetings, their transcripts and their meeting notes.

Data produced by use:

• presence and position in the virtual office, while you are in it;
• technical logs (IP address, browser, errors) and the log of administration actions;
• consents and refusals to record given in meetings.

Data received from third parties, at your initiative: the identity and e-mail address that Microsoft, Google or your company's identity provider sends at sign-in; the events and contacts of your calendar if you connect it.

3. Why, and on what basis

• providing Agora and its features, managing accounts and access: performance of the contract;
• recording and transcribing a meeting: each participant's consent, asked in Agora and revocable at any time;
• invoicing and keeping the accounts: legal obligation;
• securing the service, preventing fraud and abusive sign-ups (captcha, one trial per company): legitimate interest;
• answering a contact request and sending account messages (sign-in codes, invitations, trial reminders, invoices): pre-contractual measures and performance of the contract.

Agora does no advertising, sells no data and does not use it to train artificial intelligence models.

4. For how long

• account: as long as you are a member of a space; a sign-in session lasts 30 days at most;
• meeting recordings: 30 days, then automatic deletion (adjustable by the company);
• transcripts and meeting notes: 12 months, then automatic deletion (adjustable by the company);
• working sound used for the end-of-meeting transcription: encrypted during the meeting, erased as soon as the transcription is done, and at once if you withdraw your consent;
• content of a closed space: deleted at the end of the offer's retention period (90 days after locking by default);
• e-mail delivery feedback (rejected address, complaint): 90 days;
• invoices and accounting records: 10 years (article L. 123-22 of the French Commercial Code);
• contact form: sent by e-mail to the sales team, not kept on the website.

[To be confirmed: retention of the administration log and technical logs.]

5. Who receives your data

The publisher's authorised staff, as far as their duties require, and, in a space, the members its administrator admits. The publisher's support enters a space only with the customer company's consent.

The service providers working for the publisher:

• Hostinger: server hosting, in the European Union [To be confirmed: data centre country];
• Cloudflare: Turnstile captcha at sign-up and on the contact form;
• Resend, or the mail server chosen: sending e-mails;
• Stripe: card or direct debit payment, if you choose it;
• the language model provider chosen by the platform or by your company, for meeting notes and the assistant, after names, e-mail addresses and phone numbers are masked;
• the European Commission (VIES), to check a VAT number.

Meeting transcription runs on Agora's servers, with no outside provider. Microsoft and Google are involved only if you sign in with their account or connect your calendar to it.

[To be confirmed: up-to-date list of sub-processors, published with the data processing agreement.]

6. Transfers outside the European Union

Agora's data is hosted in the European Union. Where a provider listed above processes data outside the Union, the transfer is covered by a European Commission adequacy decision or its standard contractual clauses. [To be confirmed: provider by provider.]

7. Data from Google services

When you connect your Google account, Agora uses information received from Google APIs only for the features you turned on: signing you in, showing and creating your meetings, suggesting colleagues when inviting. This use complies with Google's API Services User Data Policy, including its Limited Use requirements: this data is not sold, not used for advertising, and not read by a person without your consent, except as required by law or for security.

8. Cookies

The presentation website sets no cookies: no audience measurement, no advertising, no social networks.

The application sets one strictly necessary cookie: that of your sign-in session, valid for 30 days at most. It also keeps your display preferences in your browser. Neither requires your consent, since they only serve to run the service you are using.

9. Security

Communications are encrypted; files and recordings are encrypted before being stored; secrets (integration, language model and calendar keys) are encrypted and never shown again; access is role-based and administration actions are logged.

10. Your rights

You may access your data, have it corrected or erased, restrict its processing, object to it, ask for its portability, withdraw a consent at any time and set instructions for what happens to it after your death.

For the content of a space, first contact the company that opened it: it decides how it is processed, and the publisher helps it answer you. For anything else, write to . You will receive an answer within one month.

You may also lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, or at cnil.fr.

11. Minors

Agora is a professional tool and is not intended for people under 16. The publisher does not knowingly collect their data.

12. Changes to this policy

This policy may change with the service or the law. The date of its version is shown at the top; a significant change is announced in Agora.