Hangar

Privacy policy

Last updated: 19 October 2026.

This page describes the personal data processed by Hangar: the hangarmobile.com website, the app.hangarmobile.com customer workspace, the twelve services of the family (Déclic, Tactile, Go/No-Go, Recette, Sentinelle, Pouls, Friction, PanierCheck, Essaim, Baromètre, Hexagone Lab, Accusé, on *.hangarmobile.com) and the Hangar Compagnon Android app.

Data controller

Hangar — France. Contact: [email protected]. See also the legal notice.

Data we collect

  • Account: email address; first name and company if you provide them at sign-up; organisation name; addresses of the members you invite.
  • Sign-in: the link and code sent by email (stored as a hash, valid for 15 minutes) and a session cookie.
  • Technical test data: what you give us (page addresses, APK files, scenarios, settings) and what our phones produce (screenshots, videos, Android logs, reports); your API keys (we only keep their hash) and your usage.
  • AI agents: if you connect an assistant through MCP, the permissions granted and a log of the requested actions.
  • Contact requests: name, email, request and, if you provide them, your company and preferred service; campaign parameters from the landing address.
  • Server logs: IP address, date, requested page, browser, errors.
  • Audience measurement: visit statistics for public pages (page viewed, referring site, device type, country), with no cookie or identifier, using self-hosted Umami; nothing is shared with third parties.
  • Payment: processed by Stripe. We never receive your card number; we keep the customer identifier, the payment status and invoices.

Cookies

Technical cookies only: hangar_session (keeps you signed in, 30 days at most), hm_lang (chosen language, 1 year), hm_compagnon (set only inside the Android app, to adapt the display, 1 year). Cloudflare may set a bot-protection cookie. No advertising or audience-measurement cookies.

Purposes and legal basis

  • Creating and managing your account, signing you in, running the tests you request and returning the results: performance of the contract.
  • Security, abuse and fraud prevention, troubleshooting (logs, attempt limits): legitimate interest.
  • Invoicing and accounting: legal obligation.
  • Answering a contact request: your consent, given in the form.

We do not sell your data, we do not run targeted advertising, and the screenshots, videos and reports produced for you are neither used nor published by us.

Processors

  • OVHcloud: hosting of servers and databases, in France.
  • Cloudflare: domain names, routing and protection of traffic between your browser and our servers.
  • Resend: sending emails (sign-in, welcome, alerts).
  • Stripe: payment processing.
  • Tailscale: encrypted private network between our servers and the machines that drive the phones; content stays end-to-end encrypted.

Tests run on our own phones. If you set up an alert to a third-party tool (Slack, webhook), we send the alert there at your request. Cloudflare, Resend and Stripe may process data outside the European Union, in particular in the United States: these transfers are covered by the European Commission’s standard contractual clauses or the Data Privacy Framework.

Retention

  • Account and organisation: as long as the account exists, then deleted within 30 days of your request.
  • Sign-in link and code: 15 minutes. Session: 30 days at most.
  • Test results (screenshots, videos, logs): 30 days by default; some services announce a shorter period (for example 7 days for Go/No-Go APKs, 24 hours for uploaded files).
  • Log of AI agent actions: 180 days.
  • Contact requests: 180 days.
  • Server logs: 12 months at most.
  • Invoices and accounting records: 10 years (legal obligation).

Hangar Compagnon Android app

The app shows the customer workspace and the family’s websites in a built-in browser. It only requests Internet access: no contacts, photos, location or microphone. It contains no advertising and no tracking tools. It adds a marker to its built-in browser and the hm_compagnon cookie so the server can adapt the display. The data processed is the same as on the website, described above. Downloads go through Google Play, which applies its own privacy rules.

Your rights

You can access your data, correct it, have it deleted, restrict its use, object to processing and receive a copy in a readable format. Write to [email protected] from your account’s address: we reply within one month. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Deleting your account

How to ask, what is deleted and what is kept: delete my account.

Contact

[email protected]