Privacy Policy

• Account details. Your name, email address, optional phone number, and a profile picture if your sign-in provider supplies one. Passwords are stored only as one-way hashes — never as readable text.
• What you teach the assistant. Your business profile (name, industry, description, website, contact email), your catalog and prices, the instructions and tone you set, and the memories the assistant builds from your conversations so it can answer the way you would.
• Customer conversations. When you pair a WhatsApp number, the messages exchanged with your customers are stored: the text, the customer's phone number, whether each message was incoming or outgoing, and timestamps. This is what lets the assistant answer and lets you review what was said.
• Security records. Standard request metadata — IP address, browser user agent and timestamps — kept to protect the service and diagnose faults.

• To provide the service: reply to your customers, show you your conversations, and keep the assistant's memory of your business.
• To keep accounts and the deployment secure, and to detect abuse.
• To support you when something goes wrong, and to meet legal obligations.

• This deployment. Data is stored in the operator's own database on the server that runs this site.
• AI providers. Replies are written by an AI model you choose. A local model runs on the same machine and keeps the text there. A gateway model — the free models listed in the picker, such as Google Gemini or Groq — is answered through this deployment's own AI gateway, which forwards only the message text needed to produce the reply to whichever provider serves it, under that provider's own terms. This deployment holds no AI account of yours and is never charged to you for these replies.
• Google (optional). If you sign in with Google, Google authenticates you and shares your name, email address and picture. You can also register with an email address instead.
• WhatsApp. Messages travel between you and your customer through WhatsApp as they normally would; the assistant works from your own paired WhatsApp session.
• Hosting and delivery. Public traffic is proxied through the hosting or tunnel provider that publishes this site, and that provider processes ordinary request metadata such as IP addresses to deliver it.
• Administrators. The operator and any admin account they create can see accounts, conversations and memories in the admin area. That access is how the service is run and supported for you.

We do not sell your data, and we do not use it for advertising.

• Review, edit and delete memories and conversations from the dashboard at any time.
• Pause or stop automatic replies, and disconnect the paired WhatsApp number whenever you want.
• Ask the operator to delete your account and its business data; the stored conversations for your session are removed with it.
• Ask what we hold about you and ask for a copy.

If you are a customer of a business that uses HerovaAi, your conversation is controlled by that business — please contact them. We process it on their instruction.

Account data, business memories and conversations are kept while your account is active, and are deleted when you delete the account or ask the operator to. Security records rotate automatically after a short period.

This site sets no advertising or analytics cookies. Signing in stores an access token in your browser's own storage so the app can recognise you, and the optional Google sign-in handshake uses a short-lived session cookie on the server. Google may set its own cookies during sign-in, under Google's policies.

Passwords are stored as bcrypt hashes, sign-in sessions are issued as signed tokens, administrative access is limited to operator accounts, and provider keys live in server-side configuration rather than in the browser. No system is perfectly secure: if you believe your account or data has been misused, tell the operator straight away.

HerovaAi is a tool for businesses and is not intended for anyone under 18, and we do not knowingly collect data from children.

When this policy changes, the date at the top of this page changes with it. Material changes are announced inside the app before they take effect.

To exercise any of the choices above, contact the operator of this deployment — the business that gave you access to it, or the address in your welcome message. If you are the operator, you can reach your own support route from the dashboard.