Privacy policy

Last updated: September 15, 2026

1. Who we are

This policy explains how Homr collects, uses, shares and protects your personal data when you use the homr-studio.com website and the app.homr-studio.com application.

The data controller is Brendan Viale, sole trader (entrepreneur individuel, EI), SIREN 808 716 450, ESF Isola 2000, 06420 Isola, France. For any question about your data, email contact@homr-studio.com.

Homr complies with Regulation (EU) 2016/679 (GDPR) and the amended French Data Protection Act of 6 January 1978. We only collect the data needed for the uses described below.

2. The data we process

• Your account. Name, email address, profile picture and password, stored in an irreversible (hashed) form and never in plain text. If you sign in with Google, Google sends us your name, email address and profile picture.
• Your content. What you create in Homr: projects, atlases and their steps, whiteboards, uploaded documents and files, comments, conversations with Ulyss and with the brainstorming assistant, courses you create or follow (progress, notes, quiz answers, trading journal and its screenshots), badges earned.
• Your payments. Subscription plan and its status, purchases and sales on the marketplace, amounts. Your billing country and postal code are passed to Stripe to calculate VAT. Your card details are entered directly with Stripe: Homr never sees or stores them.
• Your seller account. If you sell on the marketplace, Stripe verifies your identity and bank details in its own onboarding flow. Homr only keeps the status of your payment account.
• Technical data. IP address and browser type at each sign-in, to secure your account. IP address, temporarily, to limit abuse. Technical error reports, linked to your user ID but never to your name or email address.
• Agora Academy application. First name, last name, email address, situation, areas of interest and motivation entered in the website form. Your application is sent to us by email and is not stored in the Homr app.

3. Why we use it

• Providing the service. Creating and managing your account, saving your projects, running collaboration, courses and the marketplace. Legal basis: performance of the contract between us, set out in our terms of use.
• Running Ulyss. Sending your request and the relevant project details to the artificial intelligence model, then saving the answer in your project. Legal basis: performance of the contract.
• Collecting payments and invoicing. Managing subscriptions, purchases and payouts to sellers. Legal bases: performance of the contract and our accounting and tax obligations.
• Securing Homr and fixing errors. Protecting accounts, preventing fraud and abuse, diagnosing outages. Legal basis: our legitimate interest in providing a safe and reliable service.
• Reviewing your Agora Academy application. Legal basis: pre-contractual steps taken at your request.
• Answering you. Handling your messages and your requests to exercise your rights. Legal bases: our legitimate interest and our legal obligations.

Homr does not sell your data, does not use it for advertising and sends you no marketing without your consent.

4. Artificial intelligence

When you use Ulyss or the brainstorming assistant, your message and the project details needed for the answer are sent to Mistral AI, a French company whose servers are located in the European Union. Homr only sends them to produce the answer you asked for.

Do not share sensitive data with Ulyss (health, opinions, bank details), or data about other people without their consent. Generated answers may contain errors: review them before using them.

5. Who can see your data

• Other users. Only what you choose to share: members of a project see its content and the names of the other members; when you publish an atlas or a course on the marketplace, your name and profile picture appear as its author.
• Our processors. They process data on our behalf, only on our instructions and under a contract that complies with Article 28 of the GDPR. They are listed below.
• Stripe. For its own obligations (verifying sellers' identity, fighting fraud and money laundering), Stripe acts as a separate data controller.
• Authorities. Only on a lawful request.

6. Transfers outside the European Union

Your data is hosted in the European Union. Some providers whose parent company is American (Supabase, Stripe, Google, Sentry) may access it from the United States or process some data there. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified under it, or otherwise by the European Commission's standard contractual clauses.

7. Cookies and browser storage

The homr-studio.com website sets no cookies and does not measure its audience. The application uses no advertising or audience-measurement cookies: the only cookies it sets are essential to its operation and therefore do not require your consent.

• Session. A cookie keeps you signed in on homr-studio.com and its subdomains, together with a technical cookie that lasts a few minutes. It is removed when you sign out and expires after 7 days without use.
• Payment. On payment pages only, Stripe sets cookies used to prevent fraud.
• Resuming a generation. For as long as the tab is open, the application keeps the ID of an ongoing Ulyss generation in your browser, so it can resume if the page is reloaded.
• Error monitoring. When an error occurs, Sentry may record, one time in ten, the last minutes of browsing before it, with text and input fields masked.

When a course contains a YouTube video, its thumbnail is loaded from YouTube's servers, which then receive your IP address. When you start playback, the player is loaded from youtube-nocookie.com, YouTube's privacy-enhanced mode; Google's own privacy policy then applies.

8. Retention periods

• Account and content. For as long as your account exists. An account inactive for 3 years is deleted.
• Billing data. 10 years, the period required by the French Commercial Code for accounting records.
• Sign-in sessions. Until they expire or you sign out.
• IP addresses used to limit abuse. In memory, one hour at most.
• Error reports. 90 days at most.
• Agora Academy applications. 1 year in our mailbox, then deleted.

Some data may be kept longer, in restricted-access archives, where a legal obligation requires it or to defend our rights in the event of a dispute.

9. Security

Traffic with Homr is encrypted (HTTPS), passwords are hashed, your project files are stored in a private space, and access to data is limited to what running the service requires. Cover images you add to a project, an atlas or a course are public: anyone with their address can view them.

10. Minimum age

Homr is reserved for people aged 15 or over. Subscribing, buying or selling on the marketplace is reserved for adults.

11. Your rights

You have the right to access, rectify, erase, restrict and object, the right to data portability, and the right to set instructions for what happens to your data after your death. Where processing is based on your consent, you can withdraw it at any time.

To exercise these rights, including to delete your account or get a copy of your data, email contact@homr-studio.com from your account's email address. We reply within one month at most.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at www.cnil.fr.

12. Changes

We may change this policy as Homr or the law evolves. If we make a significant change, we will let you know in the application or by email. The date of the last update is shown at the top of this page.