Skip to content
Eridia

Privacy Policy

Politique de Confidentialité

1. Data Controller

VAULTAI, a simplified joint-stock company (société par actions simplifiée) with a share capital of €1,000, registered office located at 3 RUE DE TANGER, 31400 TOULOUSE, France, registered with the Toulouse Trade and Companies Register under number 995 400 041, represented by Mr. Hugo Dorus, acting in his capacity as President.

  • Company Name: VAULTAI SAS
  • Share Capital: €1,000
  • Registered Office: 3 RUE DE TANGER, 31400 TOULOUSE, France
  • SIREN: 995 400 041
  • Legal Representative: Hugo Dorus (President)
  • Data Protection Contact: hello@eridia.ai

Last updated: 23 September 2026

2. Information Processing Models

2.1 Cloud Platform (Hosted by Eridia)

For users of our managed platform, customer content is hosted in the European Union and AI model processing takes place there. Eridia acts as a data processor on behalf of its customers. Some optional integrations may involve separate technical providers, as explained in Section 11.

  • Customer content is hosted on EU-based servers
  • End-to-end encryption for data in transit and at rest
  • Regular security audits and updates
  • Eridia administrators may access data for maintenance purposes (under NDA when required)

2.2 Self-Hosted Solution

For our self-hosted solution deployed on customer infrastructure:

  • All data remains within your infrastructure
  • Eridia does not have access to your data unless explicitly granted for support purposes
  • You are the data controller for all information processed within your instance
  • We may collect minimal telemetry data for license validation and service monitoring (see Section 10)

3. Data We Collect

3.1 Application Usage Data

  • Account information (name, email address)
  • Usage logs and platform interactions
  • Technical information (browser type, device information)
  • Payment information (processed by our payment provider)

3.2 User-Uploaded Files

Documents and files you upload to Eridia for analysis and processing, including but not limited to:

  • PDFs, Word documents, Excel spreadsheets
  • Images and presentations
  • Text files and code
  • Any other files you choose to upload

3.3 Third-Party Integrations (OAuth Connections)

When you authorize Eridia to connect to third-party services, we access data with your explicit consent:

  • Google Drive: User files (read-only access)
  • Notion: User pages and databases (read-only access)
  • SharePoint / OneDrive: User files (read-only access)
  • Google Calendar: Events, participants, meeting links (read-only access)
  • Gmail: Emails, within the permissions granted by the user
  • Outlook Calendar: Events and meetings, within the permissions granted by the user

Important: Integrations are read-only by default. Actions that modify a connected service require the permissions granted for that service and an explicit confirmation in Eridia.

3.4 Meeting Recordings

When you use our meeting transcription feature, we collect:

  • Video recordings (configurable — can be disabled)
  • Audio recordings (configurable — can be audio-only or disabled)
  • Automatic transcriptions
  • AI-generated summaries and action items

You have full control over recording settings and can choose to capture video + audio, audio only, or transcription only.

3.5 AI Conversational Memory

To provide personalized assistance, Eridia stores:

  • User preferences and settings
  • Project context and notes
  • Conversation history with the AI assistant
  • Custom instructions and prompts

You have full control over this memory and can view, modify, or delete any stored memories at any time.

3.6 Web Search Data

When you use web search features within Eridia, we process:

  • Search queries submitted through our interface
  • Search results retrieved from standard search engines

3.7 Third-Party Public Data Sources

For certain features (especially the Legal Module), Eridia may access public data sources:

  • Pappers: French company data (paid API — Pappers is the data controller for this data)
  • Judilibre: French case law database (public database)
  • Légifrance: French laws and regulations (public database)

4. Purposes of Processing

We process your data for the following purposes:

  • Meeting Transcription and Summarization: Converting audio/video recordings into searchable text and generating summaries
  • Unified Document Search (RAG): Enabling intelligent search across your documents and connected data sources
  • Contextual AI Assistance: Providing personalized AI responses based on your data and preferences
  • Content Generation: Creating documents, diagrams, code, images, and other content based on your requests
  • Legal Analysis: Providing legal research and analysis features (Legal Module only)
  • Billing and Account Management: Managing subscriptions, tracking usage (number of users, active modules), and processing payments
  • Service Improvement: Analyzing usage patterns to improve our platform and user experience
  • Security and Compliance: Protecting our systems and ensuring compliance with applicable laws
  • Marketing Communications and Product Updates: Sending existing customers relevant information about new features, product updates, and services similar to those they have already purchased or used. Every marketing email includes an unsubscribe link allowing you to opt out at any time.

5. Legal Basis for Processing

We process your personal data based on:

  • Contract Performance: Processing necessary to provide our services as outlined in our Terms of Service
  • Consent: Where you have given explicit consent, particularly for third-party integrations and optional features
  • Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention and service improvement
  • Legitimate Interest — Soft Opt-In (Marketing): For existing customers, we rely on our legitimate interest to send marketing communications about products or services similar to those you have already purchased or used, in accordance with Article L.34-5 of the French Postal and Electronic Communications Code and Recital 47 of the GDPR. You can opt out at any time via the unsubscribe link included in every email.
  • Legal Obligations: Processing required to comply with applicable laws and regulations

6. Data Sharing

6.1 AI Model Providers

For managed deployments, AI requests are processed by models hosted in the European Union. For self-hosted deployments, the customer controls which model endpoints are configured.

Important: Eridia does not use data obtained through Google Workspace APIs to develop, improve, or train generalized AI and/or ML models. Data accessed via Google Workspace APIs is used solely for providing the specific functionalities of our application as described in our Terms of Service.

6.2 Service Providers

We may share data with essential service providers:

  • Cloud hosting providers (EU-based)
  • Technical providers for optional third-party integrations
  • Payment processors
  • Analytics services (anonymized data only)

6.3 No Commercial Data Sharing

We do not sell, rent, or share your personal data with third parties for commercial or advertising purposes.

6.4 Legal Requirements

We may disclose data when required by law, court order, or to protect our legal rights.

7. Data Retention

7.1 Active Accounts

We retain your data for as long as your account is active and as needed to provide our services.

7.2 After Account Termination

After account termination or subscription cancellation:

  • Your data is retained for 90 days to allow for data export and account reactivation
  • After 90 days, all personal data is permanently deleted from our active systems
  • Backup copies may be retained for up to 180 days for disaster recovery purposes

7.3 Immediate Deletion

You may request immediate deletion of your data at any time by contacting us at hello@eridia.ai. We will process such requests within 30 days.

8. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR) and applicable French data protection laws, you have the following rights:

  • Right of Access: Request a copy of all personal data we hold about you
  • Right to Rectification: Request correction of inaccurate or incomplete data
  • Right to Erasure: Request deletion of your personal data ("right to be forgotten")
  • Right to Data Portability: Receive your data in a structured, machine-readable format
  • Right to Restrict Processing: Request limitation of how we process your data
  • Right to Object: Object to processing based on legitimate interests
  • Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

8.1 Disconnecting Third-Party Integrations

You can disconnect any third-party integration (Google Drive, Notion, SharePoint, etc.) at any time through your account settings. Upon disconnection:

  • Access tokens are immediately revoked
  • Indexed data from that integration is deleted within 24 hours
  • You can reconnect at any time with a new authorization

8.2 AI Memory Control

You have full control over the AI conversational memory:

  • View all stored memories in your account settings
  • Modify or correct any memory
  • Delete individual memories or clear all memory
  • Disable memory feature entirely

8.3 Exercising Your Rights

To exercise any of these rights, please contact us at hello@eridia.ai. We will respond to your request within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the French data protection authority (CNIL):

  • CNIL — Commission Nationale de l'Informatique et des Libertés
  • 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
  • Website: www.cnil.fr

9. Data Security

  • End-to-end encryption for data in transit (TLS 1.3)
  • Encryption at rest (AES-256)
  • Regular security audits and penetration testing
  • Access controls and authentication mechanisms
  • Secure data centers within the European Union
  • Regular backup and disaster recovery procedures

10. Telemetry and Monitoring

For both Cloud and Self-Hosted deployments, Eridia may collect minimal telemetry data for license validation and service monitoring:

  • Automatic reports are sent hourly from each Eridia instance
  • Data collected:
    • Number of active users
    • Active modules (enabled features)
    • Application version
    • Basic health metrics
  • Data NOT collected:
    • IP addresses of end users
    • Document contents or file names
    • Conversation contents
    • Search queries
    • Any personally identifiable information

For Self-Hosted deployments, you may request a fully air-gapped configuration with no external telemetry. Contact us for details.

11. International Data Transfers

Customer content is stored in the European Union, and managed AI model processing takes place there. Some optional third-party integrations may route the data needed to execute a request through a technical provider outside the European Union. This transit is a transfer. Under our non-retention agreement, the provider does not retain request or response content. Authorization credentials and technical audit metadata may still be retained to operate the integration. Such transfers are governed by appropriate safeguards, including:

  • Standard Contractual Clauses (SCCs)
  • Additional technical and organizational measures

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes through:

  • Email notification to registered users
  • Prominent notice on our platform
  • Update to the "Last updated" date at the top of this policy

13. Contact Information

For any privacy-related questions, data requests, or concerns, please contact us:

  • Email: hello@eridia.ai
  • Address: VAULTAI SAS, 3 RUE DE TANGER, 31400 TOULOUSE, France
  • Data Protection Officer: Hugo Dorus

We strive to respond to all requests within 30 days.