Privacy Policy

TL;DR

We collect only what we need to run Hania for you. We never sell your data. We never train foundation models on your conversations or knowledge. You can export everything, delete everything, and pin where it lives. The full version is below, but that's the gist.

What we collect

We collect three categories of information:

Account information. Name, email, company, role, billing details, and authentication metadata (such as last sign-in time and IP, for security).
Product data. The content of conversations your bots have, your knowledge base, your tools, your team members, and how you've configured everything. This is your data, and we process it on your behalf.
Usage and telemetry. Things like which dashboard pages you visited, which buttons you clicked, error logs, and performance metrics, all of it used to keep the service fast and reliable.

How we use it

To deliver the service you signed up for: running bots, answering API calls, and processing voice and chat.
To bill you accurately and prevent fraud.
To send transactional and product-update emails. You can unsubscribe from product updates at any time; transactional emails (receipts, security alerts) are required for the service to function.
To detect abuse and protect the integrity of the platform, for example by blocking accounts that violate our Acceptable Use Policy.
To improve Hania itself, by measuring features, latency, and reliability. This always happens on aggregated, pseudonymous data, never on the raw content of your conversations.

We share data with these categories of third parties, and only for the reasons listed:

Subprocessors. See our live subprocessor list. These include infrastructure (Cloudflare), AI model and voice providers (such as OpenAI, Anthropic, and Deepgram), payments (Stripe, PayPal), email and telephony (BlacklistGuard, LeanPBX), analytics and tag management (Google Analytics, Google Tag Manager), and advertising (Google Ads, Meta) used with your consent to measure our marketing. All are bound by data processing terms.
Apps you connect. When you connect an app such as ChatGPT or Claude, the results of its requests go to that app and the company that runs it, at your direction. See Apps you connect to Hania.
Auditors and legal advisors. Under NDA, and only when required for compliance or legal process.
Acquirers. If Hania is acquired or merged, your data may transfer to the new entity, who will be bound by this policy. You'll be notified before any transfer.

We do not sell your personal information, and we don't share it with data brokers. With your consent, we use advertising cookies that share limited data with advertising platforms to measure our own marketing campaigns, and you can decline these at any time.

No AI training on your data

This is important enough to make its own section: we don't use the content of your conversations, knowledge base, or tool calls to train AI models, and we don't sell your data.

We send your content to the AI providers we route to (such as OpenAI and Anthropic) only to generate a response in the moment. Their handling of that data is governed by their own terms; see our subprocessor list for who they are.

Google user data

You can connect Google Calendar and Google Sheets to Hania so your agents can work with them. This section explains exactly how Hania accesses, uses, stores, shares, and deletes the data it receives from Google (“Google user data”).

What we access. Only what you approve on Google’s consent screen, and only for the tool you connect:

Google Calendar: the events on your calendars (to see, create, change, and delete them), the list of calendars in your account, and your free/busy times.
Google Sheets: your Google Sheets spreadsheets (to see, create, change, and delete them), and only those Google Drive files that Hania creates or that you open with Hania.
Both: your Google account’s email address, which we use to name the connection so you can tell your accounts apart.

How we use it. We use Google user data only to provide the features you ask for: your agents read and act on your calendar or spreadsheets to carry out the tasks you give them, such as booking a meeting or updating a sheet. We don’t use it for any other purpose.

How we share it. To carry out a task, the data an agent reads is sent to the AI model provider running that agent (see our subprocessor list), only to generate that response in the moment. We don’t transfer Google user data to anyone else, except where necessary for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets, with your prior consent. We never:

sell Google user data, or transfer it to advertising platforms, data brokers, or other information resellers;
use or transfer it to serve ads, including retargeting and personalized or interest-based advertising;
use or transfer it to determine creditworthiness or for lending purposes;
use or transfer it to create, train, or improve any machine learning or artificial intelligence model, including generalized or foundation models.

Human access. No one at Hania reads your Google user data unless you give us permission for specific messages or files (for example, when you ask for support), it’s necessary for security purposes such as investigating abuse, it’s required to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

How we store and protect it. The authorization Google gives us is stored encrypted and is never shown back, including to you. Data an agent reads becomes part of that agent’s conversation, which is protected as described under Security.

Retention and deletion. You can remove a Google connection at any time from the Tools page in the Hania console, which deletes the stored authorization. You can also revoke Hania’s access at any time from your Google Account. Conversations containing data an agent read are kept until you delete them, as described under How long we keep things, and deleting your account removes all of it.

Limited Use. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. Hania’s use and transfer of information received from Google APIs will also adhere to the Google Workspace API User Data and Developer Policy.

Apps you connect to Hania (ChatGPT, Claude)

You can connect an AI app, such as ChatGPT or Claude, to your Hania workspace so it can work on your agents for you. This section explains what happens to your data when you do.

What we receive. When you connect, we receive the app's name and identifier and the permissions you approve. When you use it, we receive each request the app makes on your behalf: which action, and the details for it, such as an agent's name or a run's instructions. We don't receive your conversation with the app, only these requests.

Categories of personal data. Your account identity (the user the connection acts for, and their email address); the content of the requests; content from your workspace that a request asks for, which can include conversation transcripts your agents had with your customers; and the IP address each request comes from, with its time.

How we use it. Only to carry out the requests you or the app make, to keep the connection secure, to limit how many requests an app can make, and to show you a record of what the app did.

Who receives it. The results of each request go back to the app you connected and to the company that runs it (for example OpenAI for ChatGPT, or Anthropic for Claude). They handle those results under your agreement with them, not under this policy. We never send passwords or API keys to an app. Otherwise your data is handled as described under Who we share with.

How we store and protect it. Sign-in tokens are stored only as one-way hashes, never in readable form. An access token lasts one hour. A connection renews while the app uses it, and ends if it isn't used for 30 days. Ended connections are deleted after one day.

Activity record. For each request we record which action it was, the app, the connection, the user it acted for, the time, whether it worked, how long it took, the IDs of the items it touched, a short error summary if it failed, and the IP address it came from. We don't record the full request. This record is kept for as long as your workspace exists and is deleted with it. If a user is removed, their email address stays on their past entries. Workspace Owners and Admins can see all entries, and other members see their own.

Your controls. You see the permissions an app asks for before you allow it, and you can deny it. An app can never do more than your role allows. You can disconnect an app at any time in the Hania console, and changing your password disconnects every app. Workspace admins can require two-factor authentication.

No AI training. As with the rest of your data, we don't use these requests or their results to train AI models.

How long we keep things

Conversations and knowledge are retained until you delete them. Deleting a conversation, a bot, or your account removes the associated data.
Sensitive personal data (such as card numbers and government IDs) is redacted in real time and not stored.
Account information is kept for the life of your account, plus a short grace period after closure.
Billing records are retained as required for tax and legal compliance.
Connected app sign-ins last while in use and end after 30 days without use; ended connections are deleted after one day. The record of what connected apps did is kept for as long as your workspace exists. See Apps you connect to Hania.

Your rights

Wherever you live, you have the right to:

Access. Request a copy of everything we have about you.
Correct. Update inaccurate information.
Delete. Close your account and have personal data removed (subject to legal retention requirements).
Export. Request a copy of your conversations, knowledge, and configuration.
Object. Opt out of non-essential processing (analytics, advertising, product emails).
Lodge a complaint with your local data protection authority.

To exercise any of these, email [email protected]. We respond within 30 days; most requests are completed within a few business days.

Children

Hania is a B2B platform. We don't direct services at children, and you may not use Hania to build agents directed at children under 13 (or under 16 in the EU). If we learn we've collected information from a child, we'll delete it.

International transfers

Hania and its subprocessors may process your data in the United States and other countries. See our Subprocessors page for the third parties involved and where they operate.

Security

The short version: encryption in transit (TLS) and at rest, two-factor authentication, automatic PII redaction, and strict per-workspace isolation. For more, see our security page.

Changes to this policy

If we make a material change to this policy, we'll email every account owner at least 30 days before it takes effect. Minor changes (typos, clarifications) are published immediately, and the date at the top of this page shows when it was last updated.

Contact

Privacy questions: [email protected].
Security questions: [email protected].
Postal mail: Hania · Lahore, Pakistan.