Privacy Policy

This policy explains what information HIRA collects, how it's used, who it's shared with, how it's protected, how long it's kept, and how it can be deleted — including, specifically, information accessed through Google APIs, since HIRA integrates with Google Calendar for businesses that choose to connect it.

By using HIRA, either as a business or as someone messaging a business that uses HIRA, you're agreeing to how information is handled as described here.

We collect the following, only as needed to run the product:

• Account information — name, email, and business details (business name, industry, country, timezone) provided at signup.
• WhatsApp messages — the content of messages sent to and from the business's connected WhatsApp number, the phone numbers involved, timestamps, and delivery status.
• Instagram messages — for businesses that connect an Instagram Business account, the content of direct messages sent to and from that account.
• Business knowledge — FAQs, pricing, hours, policies, or anything else a business types directly into HIRA, or imports from a public webpage it provides, so HIRA can answer its customers accurately.
• Calendar and appointment data — bookings made through HIRA's own built-in scheduler, and, only if a business chooses to connect it, data accessed via Google Calendar — see Google Calendar Integration below.
• Customer and lead records — names, contact details, and sales-pipeline status a business tracks about its own customers, including notes the business writes.
• Platform credentials — the WhatsApp Business Account ID, Instagram Business account details, and access tokens HIRA needs to send and receive messages on a business's behalf. Stored encrypted, never in plain text.
• Technical data — standard server logs and error reports, used to keep the service running and to fix bugs. We do not log message content or full request bodies in these logs — see Security.

We do not currently process payments or collect payment information — HIRA does not charge for access today. If that changes, this policy will be updated before payment collection begins.

Account information (name, email, business profile) is provided directly by the business at signup and managed through our authentication provider, Clerk. We use it to identify who's using HIRA, scope all of a business's data to that business, and to contact the business about its account.

Google user data enters HIRA only through one integration: Google Calendar, and only for a business that explicitly chooses to connect it — it is never required to use HIRA.

HIRA's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, that means:

• Google Calendar data is used only to power the appointment-scheduling features described below — never for advertising, never sold or shared with data brokers or third parties for their own purposes, and never used to train any AI model.
• Access is limited to what's needed for scheduling; we do not read the titles, descriptions, attendees, or content of a business's other, pre-existing calendar events.
• Human access to Google Calendar data is limited to what's necessary for support and debugging, and is logged.

When HIRA answers a customer message, it sends the relevant conversation, the matching knowledge-base content, and relevant business context (such as the customer's name, pipeline stage, and any upcoming appointment time) to a large language model provider to generate a reply. Depending on how a given deployment is configured, that provider is either Anthropic (Claude) or Groq — never both for the same message — and that provider processes the data under its own standard commercial API terms. Stoneveil does not operate its own foundation model and does not use business data to train one.

For long-running conversations, HIRA also periodically asks the same AI provider to summarize older messages into a shorter running summary, so future replies stay accurate without re-sending the full history every time. That summary is stored and reused the same way the conversation itself is.

By default, HIRA runs in Assisted Mode: every AI-drafted reply or proposed action (a booking, a lead update) is reviewed by the business before it's sent or executed. A business can choose to turn on Autonomous Mode for specific actions, which removes that review step for those actions only — this is always a choice the business makes, never a default.

Turning a business's knowledge base into something HIRA can search happens locally — the text is converted into vector embeddings by a model that runs on Stoneveil's own infrastructure, not sent to a third-party embeddings API.

HIRA does not currently support uploading documents or files of any kind. Business knowledge is added only by typing it directly into HIRA or by importing text from a public webpage the business provides. If document upload is added in the future, this policy will be updated before that feature launches.

Message content, sender/recipient phone numbers or handles, timestamps, and delivery status are stored for as long as the relevant business account is active, so the business can see its own conversation history and so HIRA can use recent context to generate accurate replies. There is currently no fixed automatic expiry on conversation data — it is retained until the business deletes the relevant records or requests account deletion — see Account & Data Deletion.

HIRA's dashboard uses one cookie: an authentication/session cookie set by our sign-in provider, Clerk, to keep a business owner signed in. That's the only cookie in use today — no advertising cookies, no analytics cookies, no tracking pixels.

Information is used to operate HIRA itself: answering customer messages, retrieving the right knowledge to ground a reply, managing bookings, and tracking leads for the business that owns that data. We also use technical logs to debug and keep the service reliable.

We do not sell any of this information, and we do not use it for advertising.

We share information only as needed to operate HIRA:

• With the AI provider (Anthropic or Groq) to generate a reply, as described in AI Processing.
• With Google, only for a business that connects Google Calendar, as described in Google Calendar Integration.
• With Meta, as the operator of the WhatsApp Business Platform and Instagram, since using either channel inherently routes messages through Meta's own infrastructure — see WhatsApp and Instagram Data.
• With our hosting and infrastructure providers, solely to run the service.
• If required by law, or to protect the rights, safety, or property of Stoneveil, our users, or the public.

We do not sell information, and we do not share it with third parties for their own advertising or marketing purposes.

HIRA's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See Google Calendar Integration above for the specifics of what's accessed, why, and how it's protected.

The services below each process only what they need to do their specific job:

• Meta Platforms, Inc. — the WhatsApp Business Platform and, where connected, Instagram.
• Anthropic and/or Groq — AI reply generation, whichever is configured for a given deployment.
• Google — Calendar sync, only for businesses that choose to connect it.
• Clerk — dashboard authentication.
• Sentry — error monitoring, configured to exclude message content and sensitive headers.
• Our hosting and infrastructure providers, which run the application, database, and this website.

We keep data for as long as a business's account is active. There is no fixed automatic expiry on conversation, customer, or knowledge-base data today — it's retained until a business deletes specific records itself, disconnects an integration, or requests account deletion. Routine database backups are kept for 14 days and then automatically cycled out. If a business asks us to delete its data, we follow the process described in our Data Deletion Policy.

A business can access, correct, or request deletion of its data at any time by contacting support@stoneveil.in. If you're an individual who messaged a business on WhatsApp or Instagram, start with that business directly — they hold the relationship with you — and reach us at the same address for anything specific to HIRA's own handling of your data.

Until a formal Grievance Officer is appointed, all privacy and data requests should be sent to support@stoneveil.in.

HIRA is intended for use by businesses and their adult representatives, not by children. We do not knowingly collect information directly from children under 18. If you believe a child has provided us information directly (as opposed to being a customer's contact messaging a business), contact us at support@stoneveil.in and we'll delete it.

Stoneveil is based in India, and data may be processed there. Some of the providers described in this policy — including Anthropic, Groq, Google, Clerk, and our hosting providers — may process data in other countries, including the United States. Where that happens, we rely on those providers' own safeguards and standard commercial terms, and take reasonable steps consistent with applicable law to protect information transferred internationally.

If we make a material change to this policy, we'll update the date at the top of this page and make a reasonable effort to let active businesses know.

Questions about this policy, or a request relating to your data: support@stoneveil.in.