Privacy Policy

This Privacy Policy is for the Hibro application (“Hibro,” “we,” “our,” or “us”), operated at https://www.hibro.ai. It explains how Hibro accesses, uses, stores, shares, protects, retains, and deletes personal data, including Google user data if you connect Gmail, Google Calendar or Google workspace. Connecting Google is optional.

By creating a Hibro account or using the Service, you acknowledge this policy. If we change how we use Google user data, we will update this page and in-product notices and request your consent before using it for a new purpose.

1. Who we are and how to contact us

Application / brand name: Hibro
Developer / operator: Hibro
Website: https://www.hibro.ai
Privacy Policy (this page): https://www.hibro.ai/privacy
Data deletion: https://www.hibro.ai/data-deletion
Email: [email protected]

Hibro is an AI communication product for businesses. It helps a workspace reply to customers on WhatsApp and website chat, store leads in a CRM, email new website enquiries, and book calendar meetings.

2. Information we collect

We collect the categories below. We do not collect more Google user data than the scopes you approve.

2.1 Account and billing information we collect

When you register we collect username, email address, and a hashed password. You may add business name, description, website, phone numbers, addresses, operating hours, and timezone. If you subscribe, our payment processor (Stripe, when enabled) processes payment identifiers. Hibro stores subscription and usage counters needed to enforce your plan. We do not store full card numbers on Hibro servers.

2.2 Messaging and CRM information we collect

If you connect WhatsApp or use the website widget, we process message content, sender and recipient identifiers (for example a phone number or widget session id), timestamps, delivery metadata, and media you choose to send. Website visitors may submit name, phone number, and optional email before chat. We store those fields as a contact and a CRM lead, with source “website widget,” plus any notes the system adds (for example “Captured from website widget”).

2.3 Google user data we access (optional connections)

Connecting a Google account is optional and happens only after you click Connect in Hibro and grant consent on Google’s screen. Depending on the button you use, Hibro accesses:

• Google account identity. Scopes: user info email and profile. Data accessed: your Google account email address and display name (and, if provided by Google, a profile name). Purpose: show “Connected as [email protected]” and, if you have not set a notify address, pre-fill the lead-notification destination with that email.
• Gmail send. Scope: https://www.googleapis.com/auth/gmail.send. Data accessed: permission to send email as that account. We submit a message we compose (subject, body, recipient you configured). Example body: name, phone, optional email of a website visitor, and that the source was the website widget. The optional Google workspace tools access selected files and do not read Gmail.
• Google Calendar. Scope: Google Calendar API. Data accessed: calendar events Hibro creates or updates for bookings (title, start/end time, duration, attendee name or phone, notes, status). Purpose: create, read, update, or cancel meetings the assistant or you asked Hibro to manage.

We store a Google OAuth refresh token, the connected email, display name, and connection timestamp so the link stays active until you disconnect. Access tokens are fetched when needed for the Google integrations you authorize.

Google workspace tools: selected files, Sheets and Docs (optional)

The Google workspace panel requests https://www.googleapis.com/auth/drive.file and account identity when you connect it. Access is limited to files Hibro creates or you explicitly authorize through Google Picker. Google Picker displays files in your connected account so you can choose which to authorize; pasting a link alone does not grant access. File search inside Hibro lists only authorized or app-created files. Calendar and Gmail sending use separate connections.

• Selected files: list authorized file names and metadata and preview supported content. Google Docs and small text, CSV, JSON and XML files are supported. PDF, image and Office previews are not supported.
• Google Sheets: read the cell range you select, create spreadsheets and write values you review and confirm. Writes can overwrite the cells covered by those values.
• Google Docs: read document text, create documents and append text you review and confirm. The panel does not delete documents.

These operations run when you use the corresponding controls. Your search text, file identifier, cell range, new title and any text or values you choose to save are sent to Google as needed for that request. Retrieved content passes through Hibro's backend and hosting infrastructure to your signed-in browser for display. The manual Connections panel does not copy retrieved content into Hibro's database, import it into the knowledge base, or send it to an AI provider. If you separately enable Docs and Sheets in AI Management, the file content you ask the assistant to read is sent to OpenAI to answer your request. Previews, proposed changes and replies may be stored in your AI Management conversation and action records; clearing that conversation removes these records from active storage. Creates and edits require your approval in AI Management. Disabling AI file tools stops new AI file operations; it does not delete Google files or erase the existing conversation. Google content is not automatically imported into memory or the knowledge base and is not used to train generalized or non-personalized AI models.

We store an encrypted workspace refresh token, connected email address, granted scopes and connection time in your account settings. Short-lived access tokens are obtained as needed and passed to Google Picker in your browser when you choose files. Refresh tokens remain encrypted on the server. Manual Connections preview content is held temporarily for the request and current view; AI Management content follows the conversation and action-record storage described above. Google retains the original files, including documents and spreadsheets you create or edit, under your Google account and Google's policies.

Disconnect workspace tools removes this panel's stored connection credentials and metadata from active account settings and stops subsequent workspace requests. It does not disconnect the separate Gmail-send or Calendar integrations, revoke every Google permission for Hibro, or undo changes made in Google. To revoke the app's Google access, use Google Account third-party connections; this may also affect other Hibro Google integrations.

2.4 Other third-party channel data

If you connect Outlook, we store a Microsoft refresh token and mailbox email to send the same type of lead notification. If you connect Instagram, we process Instagram Direct Messages and store page tokens allowed by the scopes you approve. WhatsApp session data is stored so the line can stay linked.

2.5 Knowledge, configuration, and analytics

We store FAQs, service descriptions, policies, uploaded documents used for answers, team contacts (name, phone, role, expertise), agent tone, language, greeting, blocked topics, and mode (auto-reply vs approval). We log message metadata (time, direction, channel) and classification labels for analytics charts.

2.6 Support and website analytics

Support forms may include your email, category, description, and an optional screenshot. The public marketing site may record basic page-view analytics. We use browser local storage for your signed-in session token. We do not use third-party advertising cookies.

3. How we use information

We use personal data only to provide and improve Hibro’s user-facing features:

• Create and authenticate your workspace
• Deliver and store customer conversations on channels you connected
• Generate AI draft or sent replies from your knowledge base and the current thread
• Create CRM contacts and leads from website chat forms
• Email you a lead notification from your connected Gmail or Outlook
• Create or update Google Calendar events when you use scheduling
• Search and display authorized Google files, and read, create or update Docs and Sheets through the workspace controls
• Show supervisor queues, analytics, and billing usage
• Provide customer support and protect the Service against abuse

We will use your data to provide the services you requested, such as email notification of new website leads and calendar booking. We do not use Google user data for targeted advertising, retargeting, interest-based ads, credit or lending decisions, resale to data brokers, or to build unrelated databases. We do not use Google Workspace APIs, Gmail data, or Calendar data to develop, improve, or train generalized or non-personalized AI or machine-learning models.

4. How we share, transfer, or disclose information

We do not sell personal data. We do not transfer Google user data to third parties except as needed to provide or improve the disclosed user-facing features with your consent, for security purposes, or to comply with law. We may share data only as follows:

• AI providers. Conversation text and knowledge you configured may be sent to our AI provider (currently OpenAI) so a reply can be generated. We do not authorize that provider to train public or non-personalized models on your Google user data. The manual Google workspace panel does not send retrieved content to AI providers. When you enable Docs and Sheets in AI Management, requested file content is sent to OpenAI to provide that disclosed feature.
• Google. For the integrations you authorize, we call Google’s APIs to send composed lead emails, manage calendar events, search and read mail or files, and create or update Docs and Sheets as described above. Google processes that API request under Google’s terms.
• Microsoft. If Outlook is connected, we call Microsoft Graph to send the lead email.
• Messaging platforms. WhatsApp and, if connected, Meta/Instagram receive the messages needed to deliver the conversation.
• Infrastructure subprocessors. Hosting and database providers that run Hibro (for example Render for application hosting and MongoDB Atlas for encrypted storage) process data only to host the Service.
• Payments. Stripe, when billing is enabled, processes checkout and subscription data.
• Legal. We may disclose information if required by law, regulation, legal process, or a valid governmental request, or to protect the security of Hibro and its users.

We do not transfer or disclose your information to third parties for purposes other than the ones listed above. We do not transfer Google user data for advertising or for training generalized AI models.

5. How we protect information

Security procedures are in place to protect the confidentiality of your data. We use encryption to protect information in transit (HTTPS / TLS) and rely on MongoDB Atlas encryption at rest for stored application data, including Google OAuth refresh tokens. Passwords are stored as one-way hashes. API access requires a signed session token. Production access is limited to authorized operators. No method of electronic storage is 100% secure, but we work to prevent unauthorized access, alteration, or destruction of personal data.

6. Retention and deletion

We store your personal information for a period consistent with operating your workspace: account and CRM data while the account is active; conversation history as needed to provide chat and analytics; Google and Microsoft tokens only while that connection remains enabled. We will retain personal information for the length of time needed to fulfill the purposes in this policy unless a longer period is required or permitted by law. When the retention period expires for a given type of data, we delete or destroy it.

You may request that your data be deleted by:

• Disconnecting the relevant Gmail, Outlook, Google Calendar or Google workspace connection in Hibro → Connections (we remove that connection’s stored credentials and stop its subsequent API access; other connections remain enabled)
• Revoking Hibro at https://myaccount.google.com/permissions
• Submitting a request at https://www.hibro.ai/data-deletion
• Emailing [email protected]

We complete account deletion requests typically within 30 days, unless law requires a longer hold (for example billing records).

7. Your rights

Depending on where you live, you may access the personal data we hold, correct it, delete it, export it, or withdraw consent (including by disconnecting Google, WhatsApp, or Instagram). Email [email protected] to exercise these rights. You may also refuse optional Google access and still use other Hibro features.

8. Google API Services User Data Policy — Limited Use

Hibro’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• We use Google user data solely to provide or improve user-facing features of Hibro: displaying the connected account, sending lead-notification email from your Gmail, using the Google workspace tools described above, and managing calendar events you asked Hibro to book.
• We do not use Google user data for serving advertisements, including personalized, retargeted, or interest-based ads.
• We do not allow humans to read your Google user data unless you give affirmative consent for a specific support case, it is necessary for security, or it is required to comply with applicable law.
• We do not transfer Google user data to third parties except with your consent as necessary to provide or improve those disclosed features, for security purposes, or to comply with law (see section 4).
• We do not use Google Workspace APIs, Gmail data, or Calendar data to develop, improve, or train generalized or non-personalized AI / ML models.

9. International processing

Hibro is operated from infrastructure that may be located outside your country (including cloud regions used by our hosting and database providers). Where we transfer personal data, we do so to provide the Service you requested and we apply the safeguards described in this policy.

10. Cookies and local storage

We use browser local storage to keep you signed in (a session token). We do not use third-party advertising cookies. The marketing site may use first-party analytics to understand which public pages are viewed.

11. Children

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it.

12. Changes to this policy

We may update this Privacy Policy. We will change the “Last updated” date at the top. If we change how Hibro accesses or uses Google user data, we will update this page and the relevant in-product disclosure and obtain your consent before using that data in a new way or for a new purpose. Continued use alone does not authorize expanded Google data use.

13. Contact

Questions about this policy, access requests, or deletion: [email protected]
Website: https://www.hibro.ai
This Privacy Policy: https://www.hibro.ai/privacy