Privacy Policy

This Privacy Policy is for the Hibro application (“Hibro,” “we,” “our,” or “us”), operated at https://www.hibro.ai. It explains how Hibro accesses, uses, stores, shares, protects, retains, and deletes personal data, including Google user data if you connect Gmail or Google Calendar. Connecting Google is optional.

By creating a Hibro account or using the Service, you acknowledge this policy. If we change how we use Google user data, we will update this page and in-product notices.

1. Who we are and how to contact us

Application / brand name: Hibro
Developer / operator: Hibro
Website: https://www.hibro.ai
Privacy Policy (this page): https://www.hibro.ai/privacy
Data deletion: https://www.hibro.ai/data-deletion
Email: [email protected]

Hibro is an AI communication product for businesses. It helps a workspace reply to customers on WhatsApp and website chat, store leads in a CRM, email new website enquiries, and book calendar meetings.

2. Information we collect

We collect the categories below. We do not collect more Google user data than the scopes you approve.

2.1 Account and billing information we collect

When you register we collect username, email address, and a hashed password. You may add business name, description, website, phone numbers, addresses, operating hours, and timezone. If you subscribe, our payment processor (Stripe, when enabled) processes payment identifiers. Hibro stores subscription and usage counters needed to enforce your plan. We do not store full card numbers on Hibro servers.

2.2 Messaging and CRM information we collect

If you connect WhatsApp or use the website widget, we process message content, sender and recipient identifiers (for example a phone number or widget session id), timestamps, delivery metadata, and media you choose to send. Website visitors may submit name, phone number, and optional email before chat. We store those fields as a contact and a CRM lead, with source “website widget,” plus any notes the system adds (for example “Captured from website widget”).

2.3 Google user data we access (optional connections)

Connecting a Google account is optional and happens only after you click Connect in Hibro and grant consent on Google’s screen. Depending on the button you use, Hibro accesses:

• Google account identity. Scopes: user info email and profile. Data accessed: your Google account email address and display name (and, if provided by Google, a profile name). Purpose: show “Connected as [email protected]” and, if you have not set a notify address, pre-fill the lead-notification destination with that email.
• Gmail send. Scope: https://www.googleapis.com/auth/gmail.send. Data accessed: permission to send email as that account. We submit a message we compose (subject, body, recipient you configured). Example body: name, phone, optional email of a website visitor, and that the source was the website widget. Hibro does not read, search, list, download, or permanently store the contents of your Gmail inbox, sent folder, drafts, attachments, labels, or other people’s mail.
• Google Calendar. Scope: Google Calendar API. Data accessed: calendar events Hibro creates or updates for bookings (title, start/end time, duration, attendee name or phone, notes, status). Purpose: create, read, update, or cancel meetings the assistant or you asked Hibro to manage.

We store a Google OAuth refresh token, the connected email, display name, and connection timestamp so the link stays active until you disconnect. Access tokens are fetched when needed and are not used for any other Google product.

2.4 Other third-party channel data

If you connect Outlook, we store a Microsoft refresh token and mailbox email to send the same type of lead notification. If you connect Instagram, we process Instagram Direct Messages and store page tokens allowed by the scopes you approve. WhatsApp session data is stored so the line can stay linked.

2.5 Knowledge, configuration, and analytics

We store FAQs, service descriptions, policies, uploaded documents used for answers, team contacts (name, phone, role, expertise), agent tone, language, greeting, blocked topics, and mode (auto-reply vs approval). We log message metadata (time, direction, channel) and classification labels for analytics charts.

2.6 Support and website analytics

Support forms may include your email, category, description, and an optional screenshot. The public marketing site may record basic page-view analytics. We use browser local storage for your signed-in session token. We do not use third-party advertising cookies.

3. How we use information

We use personal data only to provide and improve Hibro’s user-facing features:

• Create and authenticate your workspace
• Deliver and store customer conversations on channels you connected
• Generate AI draft or sent replies from your knowledge base and the current thread
• Create CRM contacts and leads from website chat forms
• Email you a lead notification from your connected Gmail or Outlook
• Create or update Google Calendar events when you use scheduling
• Show supervisor queues, analytics, and billing usage
• Provide customer support and protect the Service against abuse

We will use your data to provide the services you requested, such as email notification of new website leads and calendar booking. We do not use Google user data for targeted advertising, retargeting, interest-based ads, credit or lending decisions, resale to data brokers, or to build unrelated databases. We do not use Google Workspace APIs, Gmail data, or Calendar data to develop, improve, or train generalized or non-personalized AI or machine-learning models.

4. How we share, transfer, or disclose information

We do not sell personal data. We do not transfer Google user data to third parties except as needed to provide or improve the features above. We may share data only as follows:

• AI providers. Conversation text and knowledge you configured may be sent to our AI provider (currently OpenAI) so a reply can be generated. We do not authorize that provider to train public or non-personalized models on your Google user data.
• Google. If Gmail or Calendar is connected, we call Google’s APIs to send the composed lead email or to write calendar events. Google processes that API request under Google’s terms.
• Microsoft. If Outlook is connected, we call Microsoft Graph to send the lead email.
• Messaging platforms. WhatsApp and, if connected, Meta/Instagram receive the messages needed to deliver the conversation.
• Infrastructure subprocessors. Hosting and database providers that run Hibro (for example Render for application hosting and MongoDB Atlas for encrypted storage) process data only to host the Service.
• Payments. Stripe, when billing is enabled, processes checkout and subscription data.
• Legal. We may disclose information if required by law, regulation, legal process, or a valid governmental request, or to protect the security of Hibro and its users.

We do not transfer or disclose your information to third parties for purposes other than the ones listed above. We do not transfer Google user data for advertising or for training generalized AI models.

5. How we protect information

Security procedures are in place to protect the confidentiality of your data. We use encryption to protect information in transit (HTTPS / TLS) and rely on MongoDB Atlas encryption at rest for stored application data, including Google OAuth refresh tokens. Passwords are stored as one-way hashes. API access requires a signed session token. Production access is limited to authorized operators. No method of electronic storage is 100% secure, but we work to prevent unauthorized access, alteration, or destruction of personal data.

6. Retention and deletion

We store your personal information for a period consistent with operating your workspace: account and CRM data while the account is active; conversation history as needed to provide chat and analytics; Google and Microsoft tokens only while that connection remains enabled. We will retain personal information for the length of time needed to fulfill the purposes in this policy unless a longer period is required or permitted by law. When the retention period expires for a given type of data, we delete or destroy it.

You may request that your data be deleted by:

• Disconnecting Gmail, Outlook, or Google Calendar in Hibro → Connections (we remove the stored refresh token and stop sending or writing events)
• Revoking Hibro at https://myaccount.google.com/permissions
• Submitting a request at https://www.hibro.ai/data-deletion
• Emailing [email protected]

We complete account deletion requests typically within 30 days, unless law requires a longer hold (for example billing records).

7. Your rights

Depending on where you live, you may access the personal data we hold, correct it, delete it, export it, or withdraw consent (including by disconnecting Google, WhatsApp, or Instagram). Email [email protected] to exercise these rights. You may also refuse optional Google access and still use other Hibro features.

8. Google API Services User Data Policy — Limited Use

Hibro’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• We use Google user data solely to provide or improve user-facing features of Hibro: displaying the connected account, sending lead-notification email from your Gmail, and managing calendar events you asked Hibro to book.
• We do not use Google user data for serving advertisements, including personalized, retargeted, or interest-based ads.
• We do not allow humans to read your Google user data unless you give affirmative consent for a specific support case, it is necessary for security, or it is required to comply with applicable law.
• We do not transfer Google user data to third parties except as necessary to provide or improve those features (the API calls and subprocessors listed in section 4).
• We do not use Google Workspace APIs, Gmail data, or Calendar data to develop, improve, or train generalized or non-personalized AI / ML models.

9. International processing

Hibro is operated from infrastructure that may be located outside your country (including cloud regions used by our hosting and database providers). Where we transfer personal data, we do so to provide the Service you requested and we apply the safeguards described in this policy.

10. Cookies and local storage

We use browser local storage to keep you signed in (a session token). We do not use third-party advertising cookies. The marketing site may use first-party analytics to understand which public pages are viewed.

11. Children

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it.

12. Changes to this policy

We may update this Privacy Policy. We will change the “Last updated” date at the top. If we change how Hibro accesses or uses Google user data, we will update this page so the disclosure stays current. Continued use after an update means you accept the updated policy.

13. Contact

Questions about this policy, access requests, or deletion: [email protected]
Website: https://www.hibro.ai
This Privacy Policy: https://www.hibro.ai/privacy