Privacy Policy

1. Who we are

The controller of your personal data is HoraZora, a sole proprietorship of Jeffrey Correia-Melo, registered in Quebec, Canada (NEQ 2282607037), which operates horazora.com (the "Site"). HoraZora provides businesses with a free AI and automation audit, websites, automatic messages to missed callers, lead follow-up, review requests, customer reactivation, an AI voice receptionist and custom AI agents and automations (the "Services").

Privacy contact: Jeffrey Correia-Melo, jeffrey@horazora.ca. This policy applies the General Data Protection Regulation (GDPR) and applicable Portuguese law.

2. What we collect

Audit form. When you request the free audit, we collect your name, email, mobile number and company name. The page also sends your language (the language of the page you used).

Audit information. In the audit meeting we note what you tell us (for example how many calls you miss, the value of a typical job and how you handle calls and requests) and we look at public information about your business (website, Google profile and reviews), to prepare your one-page report, which we email to you.

Verification and company contacts. To confirm that the email you gave is valid, we send it to Hunter.io's verification service. We also send your email's domain to Hunter.io's domain search, which returns published business contacts at that organization (names, positions, seniority, whether the person is listed as a decision maker, and an email when no name is listed). We keep that note in our CRM to reach the right person at your business.

Messages. After you submit the form, we send an SMS to the number you gave (at most one a day) and an alert to our own phone with your name, company and number. We keep the messages exchanged with you.

Website chat. The Site has a chat window answered by an automated assistant. What you type is processed by BuildMyAgent, the chat platform, and by Anthropic, the AI model provider, to answer you. If you request the free audit in the chat, the assistant asks for your name, business name, mobile number and email, and asks whether you agree to be contacted about your request. Only if you agree does it send those four details to our CRM, exactly like the form. Please don't share health, legal or financial details in the chat.

Payments. When a client pays, the payment is handled by Stripe on its own secure page. We never see or store full card numbers. We receive the name, email, company name, billing address if given, the amount, the date, the payment method type and its last digits, and the subscription status.

Data we process for clients. When a business becomes a client, we process data about its own customers and contacts (for example name, number, email, the conversation with the assistant, website chat and Facebook messages, call recordings or transcripts when the plan includes the AI voice receptionist, bookings and history), only to deliver the Services and on the client's instructions. In that role we are a processor (GDPR Article 28) and the client is the controller; the terms are set out in the client's agreement.

3. Why we use data, and on what legal basis

• Answering your audit request, arranging the meeting and sending the report: steps taken at your request before a contract (Article 6(1)(b)).
• Sending you the example message from our automation: your consent, given when you submit the form (Article 6(1)(a)). You can withdraw it at any time by replying STOP.
• Checking the email and finding the right person at your business: our legitimate interest in avoiding fake requests and reaching the right person (Article 6(1)(f)).
• Delivering the Services, invoicing and meeting legal and tax obligations: performance of the contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).
• Improving the Services and the Site: legitimate interest (Article 6(1)(f)).

We do not sell personal data. We make no automated decisions with legal or similarly significant effects on you.

4. How we use artificial intelligence

The Services use AI and automation to reply by message to missed callers, answer basic questions and offer times and, in higher plans, send review requests, contact past customers and answer calls by voice. The first message names the business and says it comes from an automated assistant, and recipients can reply STOP at any time. We also use the AI assistant Claude (Anthropic) to prepare audit reports and manage our CRM. We do not use clients' contact data to train third-party AI models.

5. Who we share data with

Only with providers that help us run the Site and the Services:

• Site hosting: Vercel Inc.
• Background processing of the form: Trigger.dev
• CRM, messaging and calendar: GoHighLevel (HighLevel Inc.). Our account is provided through a third-party agency account, whose operator may have technical access to it
• Email verification and business contacts: Hunter.io
• Email: Google Workspace (Google LLC)
• Website chat: BuildMyAgent (chat platform) and Anthropic (AI model)
• Domain and DNS: Cloudflare, Inc.
• AI assistant and integrations: Anthropic (Claude) and Composio, which connects that assistant to our CRM
• Payments: Stripe
• Site fonts: Google Fonts (Google LLC), which receives your IP address and browser data when a page loads its fonts

6. Transfers outside the European Economic Area

HoraZora is established in Canada and several providers process data in the United States. Transfers to Canada benefit from a European Commission adequacy decision. Transfers to the United States rely on the EU-US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses approved by the European Commission. You can ask us for more information about these safeguards.

7. How long we keep data

Audit requests, website chat conversations, audit notes and reports and related correspondence: as long as reasonably needed to respond, and at most 24 months after the last contact, unless you become a client. Data processed for clients: for the length of the agreement plus 30 days, then deleted or returned on request. Payment records and invoices: six years after the end of the tax year they relate to, as tax law requires. Form data stays in Trigger.dev's run logs only for that provider's log retention period.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection, and you can withdraw consent at any time without affecting processing already done. To exercise them, write to jeffrey@horazora.ca; we reply within one month.

You can also lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or with the authority of the country where you live or work.

9. Cookies

The Site's own code sets no cookies, and the Site uses no advertising pixels or analytics tools. Loading Google's fonts sends your IP address to Google (see section 5).

10. Security

We use reasonable technical and organizational measures to protect data, including encrypted transmission (HTTPS), access controls and provider review. No system is 100% secure.

11. Minors

The Site and the Services are for businesses and adults. We do not knowingly collect data from anyone under 18.

12. Changes

We may update this policy. The effective date at the top shows the current version; material changes are posted on this page.

13. Contact

Jeffrey Correia-Melo, HoraZora: jeffrey@horazora.ca

HoraZora (sole proprietorship, NEQ 2282607037) — Quebec, Canada