Privacy policy

Last updated: May 21, 2026.

This policy explains how EACHR collects, uses and protects your personal data when you use eachr.co and the app.eachr.co application.

Data controller

EACHR, 15 rue de Sully, 21850 Saint-Apollinaire, France.

Contact: contact@eachr.co.

Data we collect

The following categories of data are processed:

  • Account data: first and last name, email address, password (stored hashed), role, company.
  • HR data entered through the service: names of employees, expense reports (amounts, dates, categories, receipts), leave and absences.
  • Billing data: company name, address, billing email, payment history. Card numbers and banking details are never stored by eachr; they are handled directly by Stripe.
  • Technical data: IP address, browser type, connection logs, session identifiers.

Purposes

  • Provide, operate and maintain the service.
  • Manage accounts, authentication and security.
  • Bill subscriptions and pay commissions to partners.
  • Respond to support requests.
  • Comply with legal and accounting obligations.

Legal basis

  • Performance of the contract (GDPR art. 6.1.b) for delivering the service and billing.
  • Legal obligation (GDPR art. 6.1.c) for retaining accounting records.
  • Legitimate interest (GDPR art. 6.1.f) for security and fraud prevention.

Retention

  • Account data: for the duration of the subscription, then up to 3 years after the last activity.
  • Expense receipts and accounting records: 10 years (legal obligation).
  • Billing data: 10 years (French Commercial Code, art. L.123-22).
  • Technical logs: 12 months maximum.

Subprocessors and recipients

EACHR relies on the following subprocessors to deliver the service:

  • Hosting: Vercel Inc., United States.
  • Database and authentication: Supabase Inc., European Union servers.
  • Payments: Stripe Payments Europe, Limited, Ireland.
  • Transactional emails: Resend Inc., United States.

Transfers outside the European Union

Some subprocessors are located outside the EU (United States). Transfers are framed by the Standard Contractual Clauses adopted by the European Commission and, where applicable, by the EU-US Data Privacy Framework.

Your rights

You have a right to access, rectify, erase, port, object to and restrict the processing of your data.

You can exercise these rights at any time by writing to contact@eachr.co.

You also have the right to lodge a complaint with the French data protection authority (CNIL, www.cnil.fr).

Cookies

eachr uses only cookies that are strictly necessary for the service (authentication, session). No advertising cookie or third-party tracker is set without your consent.

Minors

The service is designed for professional use and is not intended for individuals under 16.

Changes

This policy may be updated. The date at the top of the page indicates the last revision.

ENFR