Privacy Notice

HarpyTech, a French simplified joint-stock company (SAS), is responsible for TheRightPlot. Its registered office is 34 allée des Damades, 92000 Nanterre, France. Privacy questions and rights requests can be sent to contact@harpytech.fr.

For accounts and authentication, we use your email, account identifier and authentication metadata. Your registration profile contains the identity, contact and property-preference information you provide to operate and personalise the service.

A search sends the query and relevant profile and catalogue context to Google Gemini. Each completed search also creates a restricted operational audit event containing the typed query, the response actually returned, the result outcome and count, the time, a broad actor class (anonymous, registered or admin), and whether personal history was enabled. The audit event is not linked to an account identifier, email address or raw IP address, but its query text can contain personal information entered by the searcher. It is not part of personal search history. Administrators use these events for security, reliability and service review. Separately, an authenticated user can choose whether to save personal history for their own account.

The content visible in Langfuse operational traces may include the typed query, AI response, relevant profile preferences, custom search instructions, and catalogue candidate context. This content is visible for anonymous searches and authenticated searches by default so we can diagnose and improve the service. An authenticated search is redacted from Langfuse when you explicitly disable saved history (private mode), and we also redact it if we cannot resolve that preference. Langfuse trace visibility, personal history and the restricted platform audit are separate forms of processing.

Contact enquiries contain the details and message you submit. If you request an introduction, we use your account details and chosen project to arrange it with the identified developer. Catalogue reports contain your message and relevant page or project context.

Personal saved search history expires after 365 days and can be deleted earlier. Restricted platform search audit events that are not linked to an account or IP address also expire after 365 days, including when personal history is disabled; personal-history controls do not delete the separate audit copy. Contact-intent records expire three years after the user-originated contact. Catalogue reports expire after 12 calendar months, pseudonymous visit records after 120 days, monthly quota records after the relevant month plus seven days, and managed application logs after 30 days.

Amazon Cognito refresh tokens are configured for up to 30 days. Account and profile records otherwise remain while the account exists. Backup and service-provider deletion may complete later than deletion from active systems.

HarpyTech uses Amazon Web Services for hosting, authentication, storage and email delivery; Google Gemini for search processing; Langfuse for operational AI tracing; and Google Workspace for the contact mailbox. Google Maps receives network and browser information only if you choose to load a map.

When you ask for an introduction, the intended UAE developer is identified before confirmation and receives the information needed to respond. Providers or developers may process data outside the European Economic Area, including in the United Arab Emirates.

Depending on the processing, you may request access, correction, deletion, restriction or portability, object to processing, and withdraw a choice without affecting earlier processing. Contact contact@harpytech.fr. You may also complain to the CNIL.

TheRightPlot has not appointed a data protection officer. Maps preferences can be changed in the Legal Notice. Disabling saved history stops new personal-history records without hiding existing personal history, which remains available for deletion. It does not prevent the separate restricted platform audit described above.