Chamas TacosBlack & White BurgerB&B Hotels
Over 250 venues already trust us.
App StoreGoogle Play

Privacy policy

This privacy policy describes how HORRA collects, uses and protects personal data in the context of its showcase website horra.music and its application app.horra.music, a managed music broadcasting service (sound ambiance, audio messages and jingles) intended for professional venues. It is established in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertes).

1. Data controller

The data controller is HORRA, a simplified joint-stock company (SAS) with a share capital of 950 euros, registered with the Paris Trade and Companies Register under number 903 545 358, whose registered office is located at 135 avenue Victor Hugo, 75016 Paris, France.

  • SIRET (registered office): 903 545 358 00025
  • Intra-EU VAT: FR89903545358
  • APE code: 63.12Z (Web portals)
  • President and publication director: Amir Laieb
  • Chief executive officer: Manoel Hellio
  • Contact: hello@horra.fr

HORRA has not appointed a data protection officer (DPO). Any request relating to the protection of your personal data can be addressed to hello@horra.fr.

2. Data we collect

Depending on your relationship with HORRA (site visitor, prospect, client, invited collaborator, user of the application or of the player), we may process the following categories of data.

Identity and account

Last name, first name, email address, phone number, profile picture (optional), language, time zone and city.

Authentication and security

Password, activation of two-factor authentication (2FA, optional), session tokens and access tokens for the mobile and player applications.

Connection and technical logs

IP address, device and browser information, approximate location inferred from the IP address, connection timestamps, as well as the account activity history (logging for audit purposes). The approximate location is resolved locally from the IP address, using a local GeoIP database; the IP address is not sent to any external third party for this purpose.

Usage and listening

Service usage and listening data: plays, "likes", favorite playlists, broadcasting history by zone, notifications and preferences.

Establishments and zones

Company name, full postal address, SIRET number, VAT number and GPS coordinates of the establishments and zones declared by the client. As a reminder, in our model, the hierarchy is as follows: Client (Super Admin) > Brand > Establishment > Zone, with the subscription being taken out per zone.

Billing

Billing data managed through our payment provider Stripe: Stripe identifiers, last four digits and expiry date of the card, invoices. HORRA neither collects nor stores your full bank card number.

Invited collaborators

When a client invites collaborators (for example an Admin, an Employee or a player), we process their name and email address. The client is responsible for the invitations it issues and for the data of the persons it adds.

Support and audio message requests

Messages exchanged with support, requests for jingles or voice messages, including, where applicable, a voice recording provided by the user. We also keep diagnostic and incident logs.

Prospects (site contact form)

The contact form on horra.music collects your last name, first name, email address, phone number (optional), your message as well as data relating to your establishment (via Google Maps). This information is detailed in section 10.

3. Purposes and legal bases

We process your data for the following purposes, each relying on a legal basis within the meaning of the GDPR.

Performance of the contract

Creation and management of your account, management of your establishments and zones, subscription and management of subscriptions per zone, provision of the broadcasting service, billing and collection, management of invited collaborators and handling of your support and audio message requests. Legal basis: performance of the contract (or pre-contractual measures).

Security, fraud prevention, improvement and statistics

Security of accounts and infrastructure, logging and audit, prevention of misuse and fraud, continuous improvement of the service and compilation of usage statistics. Legal basis: legitimate interest of HORRA in securing and developing its service.

Legal obligations

Retention of invoices and accounting records, compliance with accounting and tax obligations. Legal basis: legal obligation.

Marketing communications and non-essential cookies

Possible sending of commercial communications and placement of non-essential cookies or services. Legal basis: consent, which you may withdraw at any time.

4. Recipients and processors

Your data is accessible to HORRA's authorized teams and to processors acting on our instructions, in the context of providing the service:

  • Stripe: processing of payments (bank card and SEPA direct debit) and billing.
  • Resend: sending of service and notification emails.
  • Cloudflare, Inc.: hosting of the site and R2 object storage of audio files and media.
  • Amazon Web Services: storage (depending on configuration).
  • ElasticSearch: catalog search engine.
  • Pusher / Laravel Reverb: real-time features.
  • Google Maps Platform: address entry and geolocation of establishments.
  • Spotify: source of music metadata and playlist import. Spotify is not used for broadcasting (streaming).
  • Slack: internal operational notifications.

On the showcase website, we also use Resend (transmission of contact form messages), Google Maps (address autocompletion) and Crisp (support chat).

HORRA uses no advertising audience measurement tool: neither Google Analytics nor Meta pixel.

5. Transfers outside the European Union

Some of our processors are located outside the European Union, in particular in the United States (for example Stripe, Google, Cloudflare, Slack). These transfers are governed by appropriate safeguards within the meaning of the GDPR, in particular the standard contractual clauses adopted by the European Commission and, where applicable, certification under the Data Privacy Framework. The back-end application infrastructure is hosted by OVH (France, European Union).

6. Retention periods

We keep your data for as long as necessary for the purposes described, then delete or anonymize it. The precise periods are being defined:

  • Account and usage data: kept for the lifetime of the account, then deleted or anonymized within 3 months of the account being closed.
  • Connection logs and technical logs: 12 months.
  • Activity and listening history: 13 months.
  • Support requests and voice recordings: for the duration of the contract plus 1 year.
  • Billing data and accounting records: kept in accordance with accounting and tax obligations, in principle 10 years.
  • Prospect data (contact form): 3 years from the last contact.

The deletion of your account is carried out upon request; the process is operated by HORRA.

7. Security

HORRA implements appropriate technical and organizational measures to protect your data, in particular:

  • encryption of exchanges in transit via HTTPS;
  • role-based access control (Super Admin, Admin, Employee, player);
  • two-factor authentication (2FA) available as an option;
  • access to audio files by means of signed URLs with a limited period of validity;
  • logging of access and activities for audit and security purposes.

As no system can guarantee absolute security, we strive to continuously improve these measures.

8. Your rights

In accordance with the applicable regulations, you have the following rights over your data: right of access, rectification, erasure, restriction of processing, objection, portability, withdrawal of consent at any time (without affecting processing already carried out), as well as the right to set directives regarding the fate of your data after your death.

You may exercise these rights by writing to hello@horra.fr. We may ask you for proof of identity in the event of reasonable doubt.

If you consider that your rights are not being respected, you may lodge a complaint with the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertes, CNIL), www.cnil.fr. If you are located in the European Union or the United Kingdom, you may also contact your own national data protection authority.

9. Cookies

HORRA uses no advertising cookie or third-party audience measurement cookie.

Application (app.horra.music)

  • Essential cookies: session cookie, XSRF-TOKEN security cookie, "remember me" cookie (if you enable it). They are necessary for the operation of the service.
  • Preference cookies (non-essential): interface preferences such as the theme, appearance and display of the sidebar.

Showcase website (horra.music)

Cookies and services related to the Crisp chat and to Google Maps.

You can configure your browser to accept or refuse non-essential cookies and delete those already placed; refusing essential cookies may degrade the operation of the service. As we use no third-party analytics or advertising cookies, only strictly necessary and preference cookies, no consent banner is required.

10. Contact form and prospects

When you use the site's contact form, we collect your last name, first name, email address, phone number (optional), your message as well as data relating to your establishment obtained via Google Maps. This information is transmitted by email to our teams via the Resend service in order to handle your request. The legal basis for this processing is our legitimate interest in responding to your inquiries and, where applicable, your consent for subsequent communications.

11. Changes to the policy

HORRA may amend this privacy policy, in particular to take account of legal, technical or service developments. The applicable version is the one published on this page. We invite you to consult it regularly; significant changes may be the subject of specific information.

12. Contact

For any question relating to this policy or to the exercise of your rights, you can contact us:

  • By email: hello@horra.fr
  • By post: HORRA SAS, 135 avenue Victor Hugo, 75016 Paris, France

13. Governing law

This privacy policy is governed by French law. This English text is a translation provided for convenience; in case of any discrepancy, the French version prevails.

Last updated: July 2026.