Privacy Policy

1. Who is the data controller?

The data controller is:

Licorne Society SAS
19A rue du Rocher, 75008 Paris, France
RCS Paris 890 811 193
Email: contact@leonar.app

Data Protection Officer: dpo@licornesociety.com

2. Scope of this policy

This Privacy Policy covers the personal data that Leonar processes as a data controller, namely:

• data of visitors to our website (www.leonar.app);
• data of users who create an Account on the Platform;
• data of persons who contact us (support, sales, demos).

This policy does not cover candidate or prospect data processed by Leonar on behalf of its customers (as a data processor). That processing is governed by the Data Processing Agreement (DPA) entered into between Leonar and each customer. If you are a candidate or prospect whose data has been processed through the Platform by a Leonar customer, please contact that customer directly to exercise your rights.

3. What data do we collect and why?

3.1 Website visitors

3.2 Account holders (Users)

3.3 Prospects and demo requests

3.4 Data we do NOT process as controller

To be clear, the following data is processed by Leonar only as a data processor on behalf of its customers, and is not covered by this Privacy Policy:

• Candidate and prospect profiles (names, professional information, LinkedIn URLs, CVs)
• Messages and communications managed through channels connected to the Platform (email, WhatsApp, SMS), and communication history the User records on candidate profiles
• AI-generated scores, match percentages, and recommendations
• Contact lists imported by the User from external sources

For information on how this data is processed, please refer to the DPA between Leonar and the relevant customer. The handling of calendar data from a connected Google or Microsoft account, and of email data from a connected Gmail account, is also described in Section 12.

4. Who has access to your data?

Your personal data is accessible only to:

• Leonar staff who need access to perform their duties (support, engineering, sales, management), bound by contractual confidentiality obligations;
• Service providers (sub-processors) acting on our behalf, listed in Section 5 below;
• Legal and regulatory authorities, where disclosure is required by applicable law or a binding court order.

We never sell or rent your personal data to third parties. We never share your data with third parties for their own marketing purposes.

5. Service providers and sub-processors

The following service providers process personal data on our behalf as a controller:

Note: The sub-processors listed above relate only to data processed by Leonar as controller (your Account data, website analytics, etc.). Sub-processors involved in processing candidate data on behalf of customers (including Anthropic, Google Gemini, and Unipile) are listed in the DPA.

This list may be updated from time to time. Material changes will be communicated via our website.

6. International data transfers

We make every effort to host and process your personal data within the European Union. Where transfers outside the EU are necessary, we ensure that appropriate safeguards are in place:

• EU-US Data Privacy Framework (DPF): For transfers to US-based providers certified under the DPF, we rely on the European Commission's adequacy decision of 10 July 2023.
• Standard Contractual Clauses (SCCs): Where the DPF does not apply or is invalidated, we rely on Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), supplemented by additional technical and organizational measures where necessary.
• Adequacy decisions: For transfers to countries benefiting from an adequacy decision, no additional safeguards are required.

You may request a copy of the applicable transfer mechanisms by contacting our DPO.

7. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): obtain confirmation of whether your data is being processed and, if so, a copy of it.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your data when it is no longer necessary, when you withdraw consent, or when processing is unlawful.
• Right to restriction (Art. 18): request that processing be limited in certain circumstances (e.g., while the accuracy of data is being verified).
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object (Art. 21): object to processing based on legitimate interest, including for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to provide guidelines on post-mortem data: under French law, you may provide instructions regarding the storage, erasure, and communication of your data after your death.

How to exercise your rights

Contact our Data Protection Officer at dpo@licornesociety.com. We may request proof of identity if there is reasonable doubt. We will respond within one (1) month, extendable to three (3) months for complex requests.

If you believe your rights have not been respected, you may lodge a complaint with the CNIL:

Commission nationale de l'informatique et des libertes (CNIL)
3 place de Fontenoy — TSA 80751
75334 Paris Cedex 07
Phone: +33 1 53 73 22 22
Website: www.cnil.fr

8. Cookies and tracking technologies

8.1 What are cookies?

Cookies are small text files stored on your device when you visit our website. They help us understand how you use our site, improve your experience, and measure the effectiveness of our communications.

8.2 Types of cookies we use

8.3 Managing your preferences

When you first visit our website, a cookie consent banner allows you to accept or refuse non-essential cookies. You can change your preferences at any time by clearing this site's cookies in your browser, which displays the banner again on your next visit.

Google Analytics: We use Google Analytics with IP anonymization enabled. You can opt out by installing the Google Analytics Opt-out Browser Add-on.

9. Data security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access control and row-level security at the database level
• Hashed passwords stored separately from user identifiers
• Automated daily backups with point-in-time recovery
• Logging and monitoring of access for security audit purposes
• Staff training on data protection at least twice per year
• Incident response procedures with defined escalation processes

No system is completely secure. If you become aware of any security vulnerability, please report it to contact@leonar.app.

10. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by applicable law. Specific retention periods are set out in the tables in Section 3.

When retention periods expire, data is irreversibly deleted or anonymized. Anonymized data may be retained indefinitely for statistical and product improvement purposes.

In the event of litigation or a pending legal claim, relevant data may be retained for the duration of the proceedings, even beyond the standard retention periods.

11. Children

The Platform is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us and we will take steps to delete it.

12. Connected Google and Microsoft accounts

This section describes how the Platform accesses and uses data from the Google or Microsoft account that a User chooses to connect. It applies to that data whether Leonar acts as data controller or as data processor on behalf of the customer.

12.1 Calendar data (Google Calendar and Microsoft Outlook)

Leonar accesses a User's calendar only when the User explicitly enables the calendar in Leonar and authorizes that access from their Google or Microsoft account. Calendar access is a separate, optional authorization, distinct from email access.

Purpose. Leonar reads the User's meetings in order to display them in Leonar next to the User's CRM contacts: on a "Meetings" page and on contact and company records. Only when the User asks, Leonar also creates calendar invitations on the User's behalf from Leonar.

Permissions requested.

• Google: the https://www.googleapis.com/auth/calendar.events scope, used to read events and to create events on the User's primary calendar.
• Microsoft (Microsoft Graph): the Calendars.Read permission, used to read events, and, only when the User enables Outlook invitations, the Calendars.ReadWrite permission, used to create invitations.

Data stored. For each synchronized event, Leonar stores the time slot (start and end, all-day flag, time zone), the title, the location, the video meeting link, the organizer, the attendees' email addresses, display names and response status, and the event identifiers assigned by Google or Microsoft. Leonar does not store event descriptions in its meeting records. For Microsoft Outlook, the Microsoft integration also receives from Microsoft a short preview of the event description, which it keeps with the synchronized event data for the operation of the integration only; it is not displayed in Leonar and is deleted at the latest 30 days after the event is removed from the calendar. For events marked as private in the calendar, Leonar keeps only the time slot, displayed as "Busy", and stores no title, location, meeting link or attendees.

Period covered and retention. For Google Calendar, Leonar synchronizes meetings from the last 30 days and the next 90 days. For Microsoft Outlook, the Microsoft integration synchronizes meetings from the last 37 days and the next 12 months. Meeting records displayed in Leonar are deleted 30 days after the meeting ends. When the User disables the calendar in Leonar or disconnects the account, the synchronized events are deleted.

Linking meetings to contacts. Leonar matches attendees' email addresses with the contacts already present in the User's Leonar workspace, in order to link a meeting to the right CRM record. Meeting details are visible only to the User who owns the calendar. Other members of the same workspace can see, on a contact or company record, that a teammate has a meeting with that contact. They see only the teammate's name and the time slot, without the title or any other detail.

Invitations. Leonar creates a calendar invitation only following an explicit action by the User. Google or Microsoft delivers the invitation email to the attendees.

Meeting recording. If the User's workspace uses Leonar's call transcription add-on, the User may choose, meeting by meeting, to send the Leonar notetaker to a scheduled meeting. The User may also set automatic recording rules (for example, for meetings with external participants); the notetaker then joins the meetings that match those rules, unless the User turns recording off for a given meeting. The notetaker is operated by Recall.ai, which acts as a subprocessor for meeting recording and transcription.

Legal basis. Calendar data is processed to provide the feature that the customer (the Leonar workspace) uses, on the basis of the customer's legitimate interest in managing its business relationships, and only after the User has explicitly authorized calendar access from their Google or Microsoft account.

Use and sharing restrictions. Leonar does not use calendar data for advertising and does not sell it. Leonar does not transfer calendar data to third parties, except to the service providers needed to operate this feature: Google or Microsoft, as providers of the connected calendar, Recall.ai when the User chooses to record a meeting, and the hosting providers listed in Section 5. Disclosures required by law remain governed by Section 4. Leonar does not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.

Disabling and revoking access. The User can disable the calendar at any time from the Leonar settings. The User can also revoke Leonar's access at any time from their Google account or Microsoft account.

12.2 Email data (Gmail)

Leonar accesses a User's Gmail account only when the User connects it from the Leonar settings and authorizes that access from their Google account.

Purpose. The User sends emails to their candidates and clients from Leonar through their own Gmail account, either individually or as part of email sequences that the User has set up. Leonar also reads the User's email exchanges with their existing contacts in order to display them on the matching contact record, alongside the emails sent from Leonar, and to detect replies (for example, to stop a sequence when the contact replies).

Permissions requested.

• The https://www.googleapis.com/auth/gmail.send scope, used to send emails from the User's Gmail account at the User's request.
• The https://www.googleapis.com/auth/gmail.readonly scope, used to read the messages exchanged with the User's contacts. Leonar does not modify, move or delete any email in the User's mailbox.

Messages synchronized. Leonar synchronizes only messages exchanged with email addresses that already exist as contacts in the User's Leonar workspace. To determine this, Leonar checks the sender and recipients of new messages; messages that do not involve an existing contact are neither imported nor stored by Leonar. Drafts, spam and trash are ignored. When the account is connected, Leonar looks back over the last 30 days, then follows new messages through Gmail notifications.

Data stored. For each synchronized message, Leonar stores the subject, the sender and recipients (To, Cc, Bcc, Reply-To), the date, the message body (text and HTML), the Gmail message and thread identifiers and threading headers, its Gmail labels and read status, and the name, type and size of any attachments. Leonar does not store attachment files. Leonar also stores the authorization tokens issued by Google for the connection, in encrypted form, and the sending addresses configured in the User's Gmail account.

Emails sent from Leonar. Emails sent through Leonar are recorded in the conversation with the contact. They may include a tracking pixel and tracked links so that the User can see whether the email was opened and whether its links were clicked.

Retention. Synchronized messages become part of the contact's conversation history in the customer's Leonar workspace and are retained according to the customer's instructions, as set out in the DPA. Temporary technical records used to process Gmail notifications are deleted within 90 days.

AI features. When the User asks Leonar's AI assistant about a conversation, the assistant may read the relevant messages in order to answer; this processing is carried out by the AI provider used for that feature. The same applies when the User connects a third-party AI application to their Leonar account and asks it to read their conversations. Leonar does not use Gmail data to develop, improve or train generalized artificial intelligence or machine learning models.

Legal basis. Email data is processed to provide the feature that the customer (the Leonar workspace) uses, on the basis of the customer's legitimate interest in managing its business relationships, and only after the User has explicitly authorized Gmail access from their Google account.

Use and sharing restrictions. Leonar does not use Gmail data for advertising and does not sell it. Leonar does not transfer Gmail data to third parties, except to the service providers needed to operate this feature (Google, the AI provider mentioned above when the User uses an AI feature, and the hosting providers listed in Section 5) or at the User's direction. Disclosures required by law remain governed by Section 4. Leonar personnel do not read Gmail data, except with the User's explicit consent (for example, to resolve a support request), when necessary for security purposes, or to comply with applicable law.

Disconnecting and revoking access. The User can disconnect Gmail at any time from the Leonar settings. Leonar then stops synchronization, revokes its access with Google and deletes the stored authorization tokens. Messages already synchronized remain in the contact's conversation history, where the customer can delete them. The User can also revoke Leonar's access at any time from their Google account.

12.3 Google API Services User Data Policy

Leonar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This applies to all information received from Google APIs, including Gmail and Google Calendar data.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email or in-app notification at least thirty (30) days before they take effect.

We encourage you to review this page periodically.

14. Contact

For any questions regarding this Privacy Policy or your personal data, please contact:

Licorne Society SAS
19A rue du Rocher, 75008 Paris, France
Email: contact@leonar.app

Data Protection Officer: dpo@licornesociety.com