Privacy Policy

1. Who is responsible for your data?

The data controller is [TO BE COMPLETED: company name, legal form, registered address, Belgian company number (BCE/KBO)], which operates the Horae service (hereinafter “Horae” or “we”).

For any question about your data or to exercise your rights: contact@horae.eu.

Horae acts in two capacities:

• Controller for user accounts, billing, the waiting list and the website.
• Processor (Article 28 GDPR) for the employee data our customers enter to build their schedules. In that case the customer organisation (the employer) is the controller: Horae processes this data only on its instructions, to provide the service.

2. The data we process

• Account: name, email address, password (never stored in plain text), role, language, organisation.
• Scheduling (entered by your organisation): employees, contracts and hours, skills, teams, absences and leave, wishes and preferences, generated schedules.
• Billing: subscription plan, invoice history, Stripe customer ID. We never see or store your card numbers.
• Waiting list: email address, language, sign-up page and date (see section 5).
• Technical data: IP address, connection and error logs, browser type.

Horae does not need health data: for an absence, a simple type (“sick leave”, “holiday”…) is enough. Do not enter medical details.

3. Why we process it

• Providing the service: creating your account, generating and publishing schedules, sending notifications. Legal basis: performance of the contract.
• Billing subscriptions: legal basis: performance of the contract and accounting obligations.
• Securing the service: preventing abuse, diagnosing errors. Legal basis: legitimate interest.
• Letting you know when Horae opens (waiting list): legal basis: your consent, which you can withdraw at any time.
• Meeting our legal obligations (accounting, requests from authorities): legal basis: legal obligation.

We do not sell your data, do not run targeted advertising, and never use one organisation's scheduling data for another, nor to train artificial intelligence models.

4. Where your data is hosted

Horae relies on a small number of providers, all bound by a GDPR-compliant data processing agreement:

• OVHcloudLondon, United Kingdom

  What it does for Horae : Application server: website, API, schedule computation, technical logs

• Supabase (AWS)Frankfurt, Germany (EU)

  What it does for Horae : Database and authentication: accounts, schedules, waiting list

• ResendIreland (EU)

  What it does for Horae : Sending emails: invitations, published schedules, notifications

• StripeIreland (EU)

  What it does for Horae : Subscription payments and invoicing

• OVHcloudFrance (EU)

  What it does for Horae : Domain name and mailbox (contact@horae.eu)

• Google (optional)See below

  What it does for Horae : Only if you choose “Continue with Google”: verifying your identity

Your persistent data (accounts, schedules, invoices) is stored in the database in Frankfurt, in the European Union.

United Kingdom: the server running the application is located in OVHcloud's London data centre. The United Kingdom benefits from an adequacy decision of the European Commission, which recognises a level of data protection equivalent to that of the EU.

Providers of US origin: Supabase, Resend, Stripe and Google belong to groups established in the United States. Even when data is stored in Europe, access from the United States cannot be entirely ruled out (technical support, US law). Any such transfers are covered by the European Commission's standard contractual clauses and, where applicable, by the EU–US Data Privacy Framework.

No audience measurement tools or third-party trackers: our technical logs and metrics are collected by our own tools, installed on our server, and shared with no one. Even fonts are served from our own server.

5. Waiting list

While sign-ups are closed, you can leave your email address to be notified when Horae opens.

• Data: email address, language, the page you signed up from, sign-up date and the date we notified you.
• Single purpose: announcing the opening of the service. No newsletter, no resale, no sharing.
• Legal basis: your consent.
• Hosting: in our database in Frankfurt (EU), with no public access.
• Retention: until the opening announcement is sent, then deleted no later than 3 months afterwards.
• Unsubscribing: email us at contact@horae.eu and we will delete your address without delay.

6. Cookies and local storage

Horae only uses cookies and local storage that are strictly necessary for the service to work. No advertising or audience measurement cookies, which is why no consent banner is shown.

• Login session: keeping you securely signed in.
• Language: displaying the site in the language you chose.
• Display preferences (browser local storage): light or dark theme, dashboard items you have hidden.

7. How long we keep it

• Account and scheduling data: for the whole duration of the subscription, then deleted within 90 days of the account being closed. Remember to export your schedules beforehand.
• Invoices and accounting records: 7 years, as required by Belgian accounting law.
• Technical logs (IP addresses, errors): 30 days.
• Waiting list: see section 5.
• Backups: automatic database backups are erased according to their rotation cycle.

8. Security

• All communications are encrypted (HTTPS), and data is encrypted on the database disks.
• Strict separation between organisations, enforced down to the database: an organisation can never read another's data.
• Passwords are never stored in plain text.
• Administrative access is limited and key-protected; internal tools are not exposed to the Internet.

9. Your rights

Under the GDPR, you can at any time:

• access your data and obtain a copy;
• have it corrected or erased;
• restrict its processing or object to it;
• retrieve it in a reusable format (portability);
• withdraw your consent (waiting list).

Email us at contact@horae.eu: we reply within one month. If you are an employee of a customer organisation, please contact your employer first, as the controller of that data; we will help them answer you.

You can also lodge a complaint with the Data Protection Authority (Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be) or with the authority of your country of residence.

10. Changes to this policy

This policy may change, for example when we change a provider or hosting location. The date of the last update is shown at the top of this page. In the event of a significant change, registered users will be notified by email.