Connaissance Privacy Policy

1. Collection of personal data

We collect the following categories of personal data:

Personal data you provide to us directly

• Identity and contact data: Connaissance collects identifiers, such as your name, email address, and phone number when you register for a HeyJo.ai account or to receive information about our Services. We may also collect or generate indirect identifiers (e.g., "USER12345").
• Payment information: We may collect your payment information if you choose to purchase access to Connaissance products and services.
• Source Documents: Our AI services allow you to provide us with documents that you want our processing platform to take into account to provide you with answers to your questions.
• Input and Output: Our AI solutions allow you to request services on various media, including, but not limited to, text format, files and documents, photos and images, and other documents, as well as metadata and other information they contain ("Input"), which generate responses ("Output") based on your inputs. If you include personal data in your Inputs, we will collect this information and this information may be reproduced in your Outputs.
• Feedback on your use of our Services: We appreciate feedback, including ideas and suggestions for improvement or evaluation of an Output in response to an Input ("Feedback"). If you evaluate Output in response to an Input, for example, using the thumbs up/thumbs down icon, or the chatbot feedback function, we will store the associated conversation as part of your evaluation.
• Communication information: If you communicate with us, including via our social media accounts, we collect your name, contact details, and the content of any messages you send.

Personal data we receive automatically as part of your use of the Services

When you use the Services, we also automatically receive certain technical data (described below, collectively the "Technical Information"). This includes:

• Device and connection information. In accordance with your device or browser permissions, your device or browser automatically sends us information about when and how you install, access, or use our Services. This includes information such as device type, operating system information, browser information and web page referrers, mobile network, connection information, mobile operator or Internet Service Provider (ISP), time zone setting, IP address (including device location information derived from your IP address), identifiers (including device or advertising identifiers, probabilistic identifiers, and other unique personal or online identifiers).
• Usage information. We collect information about your use of the Services, such as access dates and times, usage history, search, information about links you click, pages you view, and other information about how you use the Services, as well as technology on devices you use to access the Services.
• Logging and troubleshooting information. We collect information about the performance of our Services when you use them. This information includes log files. If you or your device encounters an error, we may collect information about the error, the time the error occurred, the functionality being used, the state of the application when the error occurred, and any communication or content provided when the error occurred.
• Cookies and similar technologies. We and our service providers may use cookies, scripts, or similar technologies ("Cookies") to manage the Services and collect information about you and your use of the Services. These technologies help us recognize you, personalize your experience, offer you additional products or services, and analyze the use of our services to make them safer and more useful for you.
• Cross-border data collection considerations: Users should be aware that when accessing our Services from different countries, data collection practices may be subject to varying local requirements. We strive to comply with applicable local data protection laws while maintaining consistent service quality globally.

2. Uses of personal data authorized by applicable data protection laws

We will only use your personal data in accordance with applicable laws. We rely on the following grounds where data protection laws allow and in accordance with them, such as in the European Union (our "legal bases"):

• When we need it to perform a contract with you. For example, we process identity and contact data, inputs, outputs, and payment information to provide you with services. In cases where we do not have a contract with you, for example when you are an end user of our Commercial Services, we rely instead on our legitimate interests.
• When it is necessary for our legitimate interests (or those of a third party) and your interests and rights do not override our interests. Our legitimate interests include:
  • To provide, maintain, and improve our products and services;
  • To conduct research and development, including developing new products and features;
  • To market our products and services;
  • To detect, prevent, and enforce violations of our terms, including service misuse, fraud, abuse, and other trust and safety protocols; and
  • To protect our rights and the rights of others.
• When you have given us your consent. You have the right to withdraw your consent at any time.
• When we must comply with our legal obligations.

International legal compliance: Users in different jurisdictions may have different legal rights regarding their personal data. Connaissance commits to respecting the highest applicable standard among all relevant jurisdictions where we operate, ensuring consistent protection regardless of user location.

We will not use your Inputs or Outputs to train our models, except if: (1) your conversations are flagged for trust and safety review (in which case we may use or analyze them to improve our ability to detect and enforce our HeyJo Services Usage Policy, including training models for use by our trust and safety team, in accordance with Connaissance's safety mission), or (2) you have explicitly flagged the documents to us (for example via our feedback mechanisms), or (3) you have explicitly agreed to the use of your Inputs and Outputs for training purposes.

We use your personal data for the following purposes:

International processing considerations: The purposes and legal bases outlined above apply to all users globally. However, users should be aware that specific local laws may provide additional rights or impose additional obligations on data processing. We commit to complying with the most protective applicable standard.

3. How we disclose personal data

Connaissance will disclose personal data to the following categories of third parties for the purposes explained in this Policy:

• Corporate affiliates and partners. Connaissance discloses the categories of personal data described above between and among its affiliated companies and related entities.
• Service providers and business partners. Connaissance may disclose the categories of personal data described above with service providers and business partners for various business purposes, including website and data hosting, ensuring compliance with industry standards, research, auditing, and data processing.
• International service providers: Given our global operations, some of our service providers may be located in different countries. We ensure that all international service providers maintain adequate data protection standards through appropriate contractual safeguards and, where required, implement Standard Contractual Clauses or other approved transfer mechanisms.

Connaissance may also disclose personal data in the following circumstances:

• As part of a major corporate event. If Connaissance is involved in a merger, corporate transaction, bankruptcy, or any other situation involving the transfer of business assets, Connaissance will disclose your personal data as part of these corporate transactions.
• Third-party websites and services: Our services may involve integrations with, or may direct you to websites, applications, and services operated by third parties. By interacting with these third parties, you provide information directly to the third party and not to Connaissance and subject to the third party's privacy policy. If you access third-party services, such as social media sites or other sites linked through the Services, these third-party services will be able to collect personal data about you, including information about your activity on the Services. If we link to a site or service through our Services, you should read their data usage policies or other documentation. The fact that we link to another site or service does not mean we endorse it or speak on behalf of that third party.
• In accordance with regulatory or legal requirements, security, the rights of others, and to enforce our rights or terms. We may disclose personal data to government regulatory authorities as required by law, including for legal, tax, or accounting purposes, in response to their requests for information, or to assist with investigations. We may also disclose personal data to third parties in connection with claims, litigation, or disputes, where permitted or required by law, or if we determine that their disclosure is necessary to protect your health and safety or that of any other person, to protect us against fraud or credit risk, to assert our legal rights or the legal rights of others, to enforce contractual commitments you have made, or as otherwise authorized or required by applicable law.
• With individual consent. Connaissance will otherwise disclose personal data when an individual gives us permission or asks us to disclose such information.
• Cross-border disclosure considerations: Given the international nature of our operations and user base, disclosures may involve cross-border transfers of personal data. We ensure that all such transfers comply with applicable international data transfer requirements and maintain appropriate safeguards to protect your data regardless of its location.

4. Rights and choices

Subject to applicable law and depending on your place of residence, you may have certain rights regarding your personal data, as described below. We strive to respond to these requests. However, be aware that these rights are limited and the process by which we may need to respond to your requests regarding our training dataset is complex. Connaissance will not discriminate based on the exercise of privacy rights you may have.

To exercise your rights, you or an authorized agent may submit a request by emailing us at contact@heyjo.ai. After receiving your request, we may verify it by requesting sufficient information to confirm your identity. You may also have the right to appeal requests we refuse by emailing contact@heyjo.ai.

International rights variations: Please note that privacy rights may vary depending on your jurisdiction. We commit to honoring the most protective rights available under applicable law, regardless of your location.

• Right to information. You may have the right to know what personal data Connaissance processes about you, including the categories of personal data, the categories of sources from which it is collected, the business or commercial purposes of collection, and the categories of third parties to whom we disclose it.
• Access and data portability. You may have the right to request a copy of the personal data that Connaissance processes about you, subject to certain exceptions and conditions. In some cases and subject to applicable law, you have the right to transfer your information.
• Deletion. You may have the right to request that we delete personal data collected from you when you use our Services, subject to certain exceptions. You also have the option to delete individual conversations, which will be immediately deleted from your conversation history and automatically deleted from our backend within 30 days.
• Rectification. You may have the right to request that we correct inaccurate personal data that Connaissance holds about you, subject to certain exceptions. Please note that we cannot guarantee the factual accuracy of outputs. If Outputs contain factually inaccurate personal data about you, you may submit a correction request and we will make a reasonable effort to correct such information, but due to the technical complexity of our large language models, it is not always possible for us to do so.
• Objection. You may have the right to object to the processing of your personal data, including profiling performed on the basis of public or legitimate interest. In places where such a right applies, we will no longer process personal data in case of objection, unless we demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. If we use your information for direct marketing purposes, you may object and unsubscribe from future direct marketing messages using the unsubscribe link in those communications.
• Restriction. You have the right to restrict the processing of your personal data in certain circumstances.
• Withdrawal of consent. When Connaissance's processing of your personal data is based on consent, you have the right to withdraw your consent. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
• Automated decision-making: Connaissance does not engage in decision-making based solely on automated processing or profiling in a manner that produces a legal effect (i.e., affects your legal rights) or affects you significantly in a similar manner (e.g., significantly affects your financial situation or your ability to access essential goods or services).
• Cross-border rights enforcement: For users located outside the EU/EEA/UK/Switzerland, we commit to applying equivalent privacy protection standards and will work with local data protection authorities where applicable to ensure your rights are respected.

5. Data transfers

When you access our website or Services, your personal data may be transferred to our servers in France or the European Economic Area ("EEA"). This may be a direct provision of your personal data or a transfer that we or a third party makes (the latter being a "Transfer").

International data transfers: Given our global user base, your personal data may be transferred to and processed in countries outside your jurisdiction. For transfers outside the EEA/UK/Switzerland, we implement appropriate safeguards such as:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where available
• Binding Corporate Rules where applicable
• Other legally recognized transfer mechanisms

We ensure that all international transfers maintain adequate protection for your personal data regardless of the destination country.

6. Data retention and lifecycle

Connaissance retains your personal data for as long as reasonably necessary for the purposes and criteria described in this privacy policy.

When personal data collected is no longer necessary for us, we and our service providers will perform the necessary procedures to destroy, delete, erase, or anonymize it, as permitted or required by applicable laws.

International retention considerations: Retention periods may be subject to different legal requirements in various jurisdictions. We apply the most stringent applicable retention standards to ensure compliance across all jurisdictions where we operate.

Aggregated or anonymized information

We may process personal data in an aggregated or anonymized form to analyze the effectiveness of our Services, conduct research, study user behavior, and train our AI models, as permitted by applicable laws. For example:

• When you submit feedback and give us permission, we dissociate Inputs and Outputs from your username to use them for training and improving our models.
• If our systems flag Inputs and Outputs that may violate our usage policy, we dissociate the content from your username to train our trust and safety classification models and our internal generative models. However, we may re-identify documents in order to enforce our usage policy with the responsible user if necessary.
• To improve the user experience, we may analyze and aggregate general user behavior and usage data. This information does not allow identification of individual users.

7. Changes to our privacy policy

Connaissance may update this privacy policy from time to time. We will inform you of any significant changes to this privacy policy, where applicable, and update the effective date at the top of this page. We encourage you to check this page for updates when you access the Services.

International policy updates: When we update this policy, we ensure that changes comply with all applicable international data protection laws. Users in different jurisdictions will be notified according to local legal requirements.

8. Contact details

For users in the European Region (EEA/UK/Switzerland): If you reside in the European Economic Area (EEA), the United Kingdom, or Switzerland (the "European Region"), the data controller for your personal data is Connaissance SAS.

For users worldwide: Regardless of your location, Connaissance SAS serves as the primary point of contact for privacy-related matters and commits to applying consistent high standards of data protection globally.

If you have questions about this privacy policy, or if you have questions, complaints, or requests regarding your personal data, you can contact us as described below:

Connaissance, whose headquarters is located at 44 rue Puebla, 78 600 Maisons Laffitte, France

You can email us at contact@heyjo.ai.

Supervisory authority rights: Please note that under the laws of many countries, you have the right to file a complaint with the supervisory authority where you live or work.

For EU residents: The complete list of contact details for EU supervisory authorities is available here.

For UK residents: If you live or work in the United Kingdom, you have the right to file a complaint with the UK Information Commissioner's Office.

For users in other jurisdictions: We encourage you to contact your local data protection authority if you have concerns about our data processing practices. We commit to cooperating with all relevant authorities to ensure your privacy rights are respected.

International cooperation: Connaissance commits to cooperating with data protection authorities worldwide to ensure consistent privacy protection and will respond to cross-border privacy inquiries in accordance with applicable international frameworks and treaties.