Privacy Policy

HoraZora, a sole proprietorship based in Quebec ("HoraZora," "we," "us," or "our") operates the website horazora.ca (the "Site") and provides a free AI and automation audit, websites, automated missed-call text-back, lead follow-up, review requests, customer reactivation, an AI voice receptionist and custom AI agents and automations (the "Services") to business clients ("Clients"). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit the Site, request our free audit through the form on the Site, respond to one of our ads (including a Facebook or Instagram lead form), or when we process personal information on behalf of Clients as part of the Services.

This Policy is intended to comply with Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and, where applicable, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Information We Collect

Information you provide directly. When you request our free audit through the form on the Site, we collect your name, email address, phone number and company name. The page also sends your preferred language (the language of the page you used).

Audit information. If you book the free audit, we note what you tell us on the call (for example how many calls you miss, the value of a typical job and how you handle calls and requests) and we look at public information about your business (your website, Google Business Profile and reviews). We use this only to prepare your one-page audit report, which we send to you by email, and keep it as described in Section 5.

Website chat. Our Site has a chat window answered by an automated assistant. What you type in it is processed by BuildMyAgent, the chat platform, and by Anthropic, the AI model provider, to answer you. If you ask for the free audit in the chat, the assistant asks for your name, business name, phone number and email, and asks whether you agree to be texted and called about your request. Only if you say yes, it sends those four details to our CRM, exactly like the audit form. Please don't share health, legal or financial details in the chat.

Information from our ads (Meta lead forms). When you submit one of our lead forms on Facebook or Instagram, Meta Platforms sends us the information you entered: your name, phone number, email address, business name, and your answers to our questions (your role in the business, about how many calls you miss per week, and whether you have a website).

Information we look up. To check that an email address submitted on our form is valid, we send it to Hunter.io's email verification service. We also send the domain of your email address to Hunter.io's domain search, which returns publicly listed business contacts at that organization (names, positions, seniority, whether the person is listed as a decision maker, and an email address when no name is listed). We save them in our CRM to find the right person to talk to at your business.

Information collected automatically. Our Site uses the Meta Pixel, a tool from Meta Platforms, Inc., which records page visits, the fact that a form was submitted (not what you typed in it), and the browser and device information sent with them, using cookies and similar technologies. We use it to measure our Facebook and Instagram ads and to show them to people likely to be interested.

Payment information. When a Client pays us, the payment is handled by Stripe on its own secure page. Stripe collects the card or bank account details; we never see or store full card or bank account numbers. We receive the payer's name, email address, business name, billing address if provided, the amount, the date, the payment method type and its last digits, and the subscription status.

Information we process on behalf of Clients. When a business engages HoraZora as a Client, we process personal information about that Client's own callers, customers, website leads and contacts (e.g. name, phone number, email, the text conversation with the Client's assistant, website chat and Facebook messages, call recordings or transcripts where the Client's plan includes the AI voice receptionist, bookings and prior interaction history) solely to deliver the Services, as instructed by the Client. In this capacity, HoraZora acts as a processor/service provider, and the Client remains responsible for its legal basis to share that data (see Section 7).

2. How We Use Information

• Respond to audit requests and ad lead forms by calling you back. For requests sent through the form on our Site, we also send you a text message confirming that we received your request (at most one per day) and send your name, company and phone number to our own phone as an alert
• Prepare your free audit report and send it to you by email
• Check that the contact information you gave us is valid
• Deliver, operate, and improve the Services
• Communicate with Clients and prospective Clients about their account or our Services
• Measure and improve our ads, the Site and its content
• Comply with legal obligations and enforce our Terms of Service

We do not sell personal information.

3. How AI Is Used

Our Services use artificial intelligence and automation to reply by text message to a Client's missed callers and website leads, answer basic questions, offer appointment times, and, in higher plans, send review requests, contact past customers and answer calls by voice. Each first message names the Client's business and says it comes from an automated assistant, and recipients can reply STOP at any time. The assistant is configured and supervised by HoraZora on the Client's behalf; Clients review the messages and settings before they go live. We do not use Client-provided contact data to train third-party foundation models.

4. Third-Party Service Providers

We share personal information with the following categories of service providers, solely to operate the Site and Services:

• Hosting & infrastructure: Vercel Inc.
• Background processing of form submissions: Trigger.dev
• CRM, text messages and outreach platform: GoHighLevel (HighLevel Inc.). Our account is provided through a third-party agency account, whose operator may have technical access to it
• Website chat: BuildMyAgent (chat platform) and Anthropic (AI model)
• Domain name and DNS: Cloudflare, Inc.
• Email: Google Workspace (Google LLC), including the email that carries your audit report
• AI assistant and integrations we use to run our business: Anthropic (Claude), which helps us prepare audit reports and manage our CRM, and Composio, which connects that assistant to our CRM. They process the information we give them only to perform those tasks
• Email verification and business contact lookup: Hunter.io
• Advertising, ad measurement and lead forms: Meta Platforms, Inc. (Facebook, Instagram)
• Payments, subscriptions and invoices: Stripe (Stripe Payments Canada, Ltd. and its affiliates)
• Web fonts: Google Fonts (Google LLC), which receives your IP address and browser information when a page loads its fonts

These providers may store or process data on servers located outside Quebec and Canada, including in the United States. Where this occurs, we take reasonable steps to ensure a level of protection comparable to that required under Quebec and Canadian privacy law, including reviewing each provider's data protection safeguards before use.

5. Data Retention

We retain audit requests, website chat conversations, audit notes and reports, ad lead form submissions and related correspondence for as long as reasonably necessary to respond to the inquiry and pursue a business relationship, and in any case no longer than 24 months after last contact, unless a Client relationship begins (in which case retention is governed by our services agreement) or a longer period is required by law. Client-provided lead data processed as part of the Services is retained for the duration of the engagement plus 30 days, then deleted (or returned on request at termination), subject to any legal retention obligations. Form data handled by our background processing provider (Trigger.dev) stays in its run logs only for that provider's log retention period. Payment and invoice records are kept for six years after the end of the tax year they relate to, as tax rules require.

6. Your Rights

Subject to applicable law, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Withdraw consent or request deletion of your information, where applicable
• Request confirmation of, and details about, any automated decision-making that significantly affects you (see Section 3)
• File a complaint with the Commission d'accès à l'information du Québec (CAI) or, where applicable, the Office of the Privacy Commissioner of Canada

To exercise these rights, contact the person in charge of the protection of personal information at HoraZora, Jeffrey Correia-Melo (the owner), at jeffrey@horazora.ca. We will respond within the timeframes required by applicable law.

7. Client Obligations Regarding Contacts

If you are a Client, you represent and warrant that you have the legal right to share your contacts' personal information with us and that messages sent on your behalf comply with Canada's Anti-Spam Legislation (CASL), PIPEDA, the Quebec Privacy Act, and any other applicable law — including having an existing business relationship or valid consent with each contact. HoraZora processes this data only as instructed by the Client and does not independently verify the Client's legal basis for contacting each lead.

8. Cookies

The Site's own code doesn't set cookies. The Meta Pixel, which measures our ads, sets cookies and uses similar technologies (see Section 1). You can control cookies through your browser settings, and you can manage how Meta uses your information for ads in your Facebook or Instagram ad settings. Disabling cookies may affect Site functionality.

9. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, or misuse, including encrypted transmission (HTTPS), access controls, and vendor due diligence. No method of transmission or storage is 100% secure.

10. Children's Privacy

The Site and Services are intended for business use by adults and are not directed to individuals under 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective date" above reflects the most recent revision. Material changes will be posted on this page.

12. Contact Us

Questions or requests regarding this Privacy Policy, or about the personal information we hold, can be directed to the person in charge of the protection of personal information at HoraZora (the owner) at jeffrey@horazora.ca.

HoraZora (sole proprietorship, NEQ 2282607037) — Quebec, Canada