Hikoo

How we reached this

French legal entity: Hikoo SAS, 4 rue Michel Luciani, 91330 Yerres, RCS Évry 100 812 817, VAT FR29 100 812 817, from tryhikoo.com/en/legal-notice/. Exposure US_CLOUD_ACT, and this one is evidenced rather than assumed. The legal notice names Vercel Inc. of Walnut, California as the host of the frontend and application, and Microsoft Ireland Operations Limited (Azure, Dublin) as the host of the server, API and database. A US company holds the application layer, and Microsoft Ireland is the Irish subsidiary of a US parent, which is the arrangement the CLOUD Act was enacted to reach. Data hosting location is recorded as EU because the database is in Dublin; the tool is EU-hosted and US-reachable at the same time, which is why those two fields are kept separate. PARTIAL rather than COMPLIANT: the controller is identified, transfer safeguards are named (EU-US Data Privacy Framework adequacy for certified processors, Standard Contractual Clauses for the others) and retention criteria are set out, but processors are listed only by category rather than named, so a reader cannot verify who holds what beyond the two hosts above. Schrems II risk MEDIUM: real transfers to the US, with safeguards stated. No DPA is published and none appears to be required: section 1 names Hikoo SAS as the data controller, and the product audits public websites and competitors rather than processing personal data on a customer's behalf, so there is no Article 28 controller-to-processor relationship to paper.