Privacy Policy

1. Who is responsible

Carreh SASU, Société par actions simplifiée unipersonnelle (SASU) with share capital of €100, registered office 122 rue Amelot, 75011 Paris, France, RCS Paris 106 275 290, VAT number FR 74 106 275 290 is the controller for the data of people who visit this website, create or use a Carreh for Business account, act as billing contacts or contact us.

For the content a company puts in its workspace (trips, bookings, receipts, expenses, approvals), the company is the controller and Carreh is its processor under the Data Processing Agreement. If you use Carreh for Business through your employer, questions about that content go to your employer; if you write to us, we pass your request on.

2. What we collect

• Account data: name, work email, company, role, department, and sign-in records (time, IP address, browser).
• Workspace content (as processor): travel requests, trips, bookings and travel documents, receipts, expenses, approvals and comments.
• Billing data: company name, address, VAT number, billing contact and invoices. Bank details are collected and held by our payment provider GoCardless; we receive a mandate reference and masked account details. Card details are collected and held by our card reseller; we never see or store card numbers.
• Support: the messages and files you send us.
• Website and security logs: IP address, browser, pages requested and time, used to keep the service secure. We use no advertising or analytics cookies.

3. Why we use it

• To provide accounts and the Service (performance of the contract).
• To secure sign-in, prevent fraud and abuse and keep an action log (our legitimate interest in a secure service, and legal obligations where they apply).
• To invoice and keep accounting records (performance of the contract and legal obligation: French law requires invoices to be kept for 10 years).
• To answer support requests and send service emails, such as sign-in codes and invitations (performance of the contract).
• To improve the Service with aggregated usage statistics (our legitimate interest). We never use workspace content to train AI models.
• To contact professionals about Carreh for Business, using professional contact details only, with our identity and an unsubscribe link in every message (our legitimate interest). You can object at any time.

4. AI processing

When a user uses an AI feature, the content needed for the result (for example a booking email or a receipt) is sent to our AI provider, Anthropic, to produce it. The provider does not use it to train its models and keeps it only for the limited time its terms allow for safety and abuse monitoring.

5. Who receives it

Our sub-processors (hosting, AI processing, payments), our accountant and legal advisers under professional confidentiality, and public authorities when the law requires it. We do not sell personal data.

6. Where it is stored and transfers

We store Carreh for Business data in the European Union. Some providers are based outside the European Economic Area, such as Cloudflare, Inc. and Anthropic PBC in the United States and GoCardless in the United Kingdom. These transfers rely on an adequacy decision (the United Kingdom, or the EU-US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses.

7. How long we keep it

• Account data: while the account is active, then deleted or anonymised within 90 days after the workspace closes.
• Workspace content: as the company instructs; deleted within 90 days after the contract ends.
• Sign-in codes: deleted within 24 hours after they expire.
• Security logs: 12 months. Action log entries: 3 years.
• Invoices and accounting records: 10 years, as French law requires.

8. Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Write to business@carreh.com with "Privacy" in the subject; we answer within one month. If your data is in your employer's workspace, we may refer your request to your employer. You can also complain to the CNIL (cnil.fr) or your local data protection authority.

9. Security

Carreh for Business uses one-time sign-in codes, separate data for each company, encryption and an action log. Carreh staff need two-step sign-in and your company's approval to open workspace content. Read more on our security page.

10. Cookies

We only use cookies that are strictly necessary to keep you signed in. See the cookie notice.

11. Children

Carreh for Business is for businesses and is not intended for people under 16.

12. Changes and contact

We tell account holders about material changes by email or in the product. For any privacy question, write to business@carreh.com or to Carreh SASU, 122 rue Amelot, 75011 Paris, France.