Privacy Policy
Hiver, Inc. Global Privacy Policy
Last Updated: 4th September, 2026
1. OVERVIEW
This Document. This document (“Privacy Policy”) explains how we collect, use, process, share, store, and protect your personal information when you access and use our Services.
The Parties. This Privacy Policy constitutes a binding legal agreement by and between Hiver, Inc. (“Company”, “we”, “us”, “our”) and you, an individual (“User”, “you,” “your”) (each Company and User referred to individually as a “Party”, and collectively as the “Parties”).
Your Agreement to these Terms. By using our Services, you agree to be bound by this Privacy Policy. If you do not wish to be bound by this Privacy Policy, please do not use our Services.
2. DEFINED TERMS
Defined terms are identified in quotes as specified in this Section 2 (Defined Terms), unless defined elsewhere in this Privacy Policy. The singular meaning of a defined term will have the same meaning as the plural meaning and vice versa.
“Add-Ons” means additional features to the Software and/or Platform, as applicable, made available by the Company for an additional fee. The details of the functionality of the additional features can be found on our Website.
“AI’ means computer software that uses large amounts of data to solve problems, make choices, create text and images, without human intelligence.
“AI Assistant” means the AI tools that the User interacts with to perform the requested tasks.
“AI Provider” means a third party which provides AI tools (which are made available for use in the Services). The AI Providers are listed on our Website.
“AI Response” means the response provided to the AI Provider as a result of questions or inquiries from a user.
“Credential” means the User’s identifier and verification information to access and use the AI tools.
“Output” means the content resulting from the AI Response.
“Platform” means the Company’s Omni Hiver subscription based software-as-a-service as described on our Website.
“Section” means a section of this Privacy Policy.
“Service Provider” means a third party which processes your personal information for a business purpose under a contract between us and the third party. The Service Providers are listed on our Website.
“Services” means the Platform, Software, and Add-Ons.
“Software” means the Company’s Hiver for Gmail subscription based extension to User’s existing Gmail account as described on our Website.
“Website” means the Company’s website, https://hiverhq.com (or successor URL).
3. CATEGORIES OF PERSONAL INFORMATION THAT WE COLLECT
Collection of Information. We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with you (“personal information”). Personal information does not include publicly available information from government records or de-identified or aggregated information or other publicly available information.
When you Access and Use our Platform and Add-Ons.When you access and use our Platform (which includes cookies and other similar technologies), create an account with us, and/or communicate with us, we may collect, store and use different categories of personal information about you, including:
| Categories of information | Type of information |
| User account information | first and last name; user name and password phone number; cell phone number; email address |
Business information (for account admin) | business phone number; business address; business email address |
| Payment information | billing address; postal address; bank information; credit card information |
| Device information | internet protocol address; device IDs; device characteristics/operating system; browser type; geolocation |
| Services information | amount of time during which you have an account with us; feature usage; administrative events (such as setting changes); browsing time; essential cookie information |
| Email information | sender/recipient email addresses; display name; headers; subject; content/messages; folders/labels; timestamps; attachments (which include photos, images, graphics, videos or documents); message IDs |
| Add-Ons information | audio recordings (voiceprints) |
| User information | content that you create or provide to the Services |
| When using AI Features | request identifier, name of user, account identifier, product, the AI tool used, the capability invoked, the outcome and the time taken |
When you Use our Software and Add-Ons. When you use our Software, and/or communicate with us, we may collect, store and use different categories of personal information about you, including:
| Categories of information | Type of information |
| User information | first and last name phone number; cell phone number; gmail address |
| Payment information | billing address; bank information; credit card information |
| Device information | internet protocol address |
| Email information | sender/recipient email addresses; content/messages; attachments (which include photos, images, graphics, videos or documents) |
| When using AI Features | request identifier, name of user, account identifier, product, the AI tool used, the capability invoked, the outcome and the time taken |
Providing Information. If you fail to provide certain personal information to us when requested, we may not be able to perform all our legal and contractual obligations or carry out all activities requested by you within the Services.
4. OUR USE, PROCESSING, STORAGE, AND TRANSFER OF YOUR PERSONAL INFORMATION
When you Access and Use our Services. If you access and use our Services (which includes cookies and other similar technologies), create an account with us, and/or communicate with us, then we use, collect, and process your personal information for the following purposes:
Legal Basis | Purpose |
Contract | To provide you with our Services To create and manage your account within the Services; and process your purchase transactions and inquiries To provide you with technical assistance and customer service To send you communications related to our Services, such as maintenance notifications, expiration notices |
Legitimate Interest | To authenticate your access and use of our Services; session management To maintain and improve our Services To keep our Services safe and secure; for cross site request forgery protection To enable participation in interactive features of our Services; inform you of new products and services; determine how our Services are being used to improve the features and functionality To send you communications related to our Services, such as newsletters, promotions, advertisements, and marketing information To determine the effectiveness of marketing and promotional campaigns and usage trends To notify you of changes to this Privacy Policy |
Legal Obligation | To maintain and process records for tax and accounting purposes To comply with our legal and reporting obligations |
Use of Information. In some instances, we may use your personal information in combination with information belonging to others. In this process, we use various methods to remove the identifying portions of any personal information before combining it with the information of others. The output of this process is aggregate data, which is incapable of identifying you or any others. We use this aggregate data for several reasons, including improving the features and functions of our Services, and how we deliver our Services to you.
Storing Information. For the Platform: We delete your personal information within fourteen (14) calendar days after termination of the access and use of the Platform; however, certain personal information may remain in our encrypted backups for a period of up to two (2) months after termination of the Platform.
For the Software: we delete the sender/recipient headers within fourteen (14) calendar days after termination of use of the Software. Gmail content/message and attachments will be deleted within one (1) hour of collection.
Regardless of the provisions of the above two sentences, certain personal information may be stored for as long as necessary to fulfill the purposes for which it was collected (such as billing addresses, invoices, contact details), and to allow us to satisfy any contractual, legal, accounting, and reporting requirements.
Google Workspace APIs Compliance. Where the Services integrate with Google Workspace APIs, we will comply with the Google User Data Policy, including the limited use requirements, with regard to any raw or derived user data received by us from Google Workspace APIs. Further, we will not use, transfer, or sell any raw or derived user data received by us from Google Workspace APIs for the purpose of creating, training, or improving foundational or generalized artificial intelligence or machine learning models.
Automated Processing. We do not conduct automated decision-making processing; such as profiling.
Do Not Sell Information. We do not sell your personal information to third parties for a monetary payment or something else of values received in return. However, we may provide your personal information to third parties where we do not receive a monetary payment, as specified in Section 5 (Providing Your Personal Information to Service Providers) and Section 6 (Providing Your Personal Information to AI Providers).
Children’s Information. We do not knowingly collect, process, or store the personal information of a user who is not of legal age in the country, state, region or province where the user resides. If we learn that we have collected, processed or stored the personal information of a user who is not of legal age in the country, state, region or province where the user resides, we will use commercially reasonable efforts to delete such personal information as soon as possible.
Opt-Out of Marketing and Promotional Communications. At any time, you can opt-out of receiving any marketing and promotional communications by clicking on the unsubscribe link in the emails that we send to you or sms messages that we send to you or by contacting us as specified in Section 9 (Contact Information). However, even if you opt-out of receiving any marketing and promotional communications, we will still send you any service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for non-marketing purposes.
Transfer of Information. If you reside outside of the United States, we will transfer your personal information to the United States, and we will put in place the required safeguards so that the transfer of your personal information complies with data protection laws.
5. PROVIDING YOUR PERSONAL INFORMATION TO THIRD PARTIES
Providing your personal information to third parties. We may provide to third parties the categories of personal information, as specified in Section 3 (Categories of Personal Information That We Collect), depending upon the purpose.
Purpose of providing your personal information to third parties. We may provide to third parties your personal information for the following purposes, where we do not receive a monetary payment, including:
Third Party | Purpose for providing personal information |
Service Providers | For business purposes. Examples of a business purpose are hosting our Services, authentication for access and use of our Services, data storage, integrations with our Services; processing orders, fulfilling orders, processing payments, processing accounting functions, and providing services such as email notifications, to monitor and analyze trends and usage, technical assistance; detect, prevent, or otherwise address fraud, security, or technical issues. |
Marketing agencies | To assist in marketing and email campaigns. |
Public authorities & legal proceedings | To respond to a subpoena, warrant or other legal processes issued by a court or public authority; discovery requests and demands as part of a civil lawsuit or similar legal process; disclosure is required to comply with applicable laws, and similar legal processes; investigating potential violations; protect against harm of the rights, property, safety of us, our Service Providers, and our users. |
Business transfer | If we are involved in a merger, acquisition, bankruptcy, or any form of sale of some or all of our business, your personal information may be sent as part of that transaction. If we buy a business, we may acquire your personal information. |
Affiliated companies | We may share your personal information with our affiliated companies. |
Professional advisors | To our attorneys and accountants who assist us in providing our products and services to you. |
6. PROVIDING YOUR PERSONAL INFORMATION TO AI PROVIDERS
Providing your personal information to AI Providers. The personal information provided to the AI Providers will depend upon the request made to the AI Provider. We may provide to AI Providers the following categories of personal information:
| Categories of information | Type of information |
| User information | user’s identifier; email address; role, identifiers of shared emailboxes the user accesses; Credentials |
| Emailbox configurations | shared emailbox names and addresses; tag names names of service-level policies |
Information about colleagues | first and last name of users; email addresses; identifiers of users who are members of a shared emailbox |
| Email information | subject lines; email address of person that contacted the user status; assignee, tags, timestamps; links to the conversations content of the email message (including earlier correspondence); attachments |
| Report information | conversation volumes; response and resolution times service-level breaches (including subject line and contact address of concerned conversation) customer satisfaction scores, free-text feedback; sentiment counts workload by customer organisation |
| Activity log | for each request log includes: request identifier, the user name and account identifier, the product, the AI Assistant used, the capability invoked, the outcome, and time taken, message content, email address, authorization records, Credentials issued to the AI Assistant, user’s permissions, recent report results |
| Capability-gap report | For each request where AI assistant determines no available capability: description of what user requested, user name, account identifier |
Purpose of providing your personal information to AI Providers. We may provide to AI Providers your personal information for the purpose of obtaining Outputs from the AI Providers, and where we do not receive a monetary payment.
Storing Information. A Credential expires one hour after it is issued. The Credential used to maintain the connection to the AI Provider expires thirty (30) calendar days after it is issued (and is replaced each time it is used). Permissions and reports are stored for approximately five (5) minutes. The activity logs and capability-gap reports are stored for ninety (90) calendar days from date of creation. All other information identified in the above table are stored as specified in Section 4 of this Privacy Policy.
Additional information about this Section 6 can be found in Appendix A of this Privacy Policy.
7. YOUR PRIVACY RIGHTS
Your Rights. Subject to applicable laws, you may have some or all of the following additional rights. It is your responsibility to understand your rights in the country, state, region, or province where you reside. In order to exercise the rights that you have or if you need assistance with exercising the rights that you have, you can contact us as specified in Section 9 (Contact Information).
If your employer or another organization is using the Services and the organization provided your data to us, then the organization is responsible for handling your requests.
| Right | Your rights and the actions you may take |
| Be Informed | You have a right to know your personal information that we collect, use, process, and store. By logging into your account with us, you can identify much of your personal information that we collect. |
| Access | You have a right to access your personal information that we collect, use, process, and store. By logging into your account with us, you can access much of your personal information. |
Correction (also known as Rectification) | You have a right to correct your personal information that we collect, use, process, and store. By logging into your account with us, you can access much of your personal information. |
Deletion (also known as Right to be Forgotten) | You have a right to delete your personal information that we collect, use, process, and store. You may delete your account with us at any time or you may request that we delete the personal information which we maintain about you. We may retain your personal information for as long as we believe it is necessary to fulfill the purposes for which the personal information was collected, or as otherwise required by law. There are instances where applicable law allows or requires us to refuse to delete your personal information. In the event that we cannot delete your personal information, we will inform you of the reasons why. |
| Restrict Processing | You may have a right to request that we restrict processing of your personal information under certain circumstances, including if you believe the personal information is not accurate. |
| Portability or copy of | You may have the right, if it is possible, given our then-current automated systems and data architecture, to receive your personal information in machine readable format or receive a copy of your personal information. |
| Objection | You may have the right, in limited circumstances, to object to our processing of your personal information. |
| Opt-Out | You may have the right to opt-out of our processing of your personal information when we deliver advertisements according to our target-audience preferences. |
| Withdraw Consent | Where we collect and process your personal information based on your consent, you have the right to withdraw your consent by deleting your account. |
| Lodge a Complaint | You have a right to file a complaint with the appropriate government agency if you believe we have not complied with this Privacy Policy or have violated the applicable privacy law. |
Non-Discrimination. We will not discriminate against you by (a) denying you use of our products or services; (b) charging different prices or rates to similarly situated customers; (c) providing a different level or quality for use of our products or services; (d) for exercising your rights.
Shine the Light. If you are a resident of the State of California, under California Civil Code known as the “Shine The Light”, your may request and obtain from us, once a year, and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes, and the names and addresses of all third parties with which we shared your personal information during the immediately preceding calendar year. If you are a resident of the State of California and would like to make such a request, please submit your request in writing via email to us as specified in Section 9 (Contact Information).
Request of Your Information. When you contact us regarding your personal information, we may request information from you to enable us to confirm your identity. We will use reasonable means to confirm that the individual that is making the request is you. If we cannot verify that the individual making the request is you, we may deny the request.
There will be no charge to request and receive access to your personal information which we have collected about you, but only for the number of requests as allocated by the applicable law of the country, state, region, or province that you reside; and provided such requests would require disproportionate effort or if the requested information has already been provided to you. If we cannot provide you with access to your personal information, we will inform you of the permissible reasons why we may not be able to provide access.
In addition, we may not always be able to fulfill your request to your satisfaction. In some cases, we may be prohibited by law, agreement or legitimate interest to fully comply with your request. When those situations arise, we will inform you of why we are unable to fulfill your request.
8. PROTECTING YOUR PERSONAL INFORMATION
Our Security Measures. We are committed to protecting the security of the personal information that we collect from you. We use reasonable physical, technical, and administrative measures to help protect your personal information from the risk of accidental loss, and unauthorized or inappropriate access, destruction, use, modification, or disclosure.
Your Obligations. The safety and security of your personal information also depends upon you. If you access certain Services using a username and password, you are responsible for keeping this personal information confidential and not sharing it with unauthorized individuals or entities.
9. CONTACT INFORMATION
Contact Us. If you have any questions regarding the collection, use, processing, sharing, or storage of your personal information, or to exercise your rights under this Privacy Policy, please contact us via email at privacy@hiverhq.com (or successor URL) or security@hiverhq.com (or successor URL).
10. CHANGES TO THIS PRIVACY POLICY
Changes. Occasionally, we may make changes to this Privacy Policy. and the most recent version of this Privacy Policy is the one that applies to you. If we make material changes to this Privacy Policy, we will provide you with notice by displaying a prominent notice on our Website or by sending you an email. Please make sure you read any such notice carefully. Having received notice of any changes to this Privacy Policy, if you continue to access and use the Services, then you agree to the updated Privacy Policy. Neither the course of conduct between the Parties nor trade usage will act to modify or alter the provisions of this Privacy Policy.
APPENDIX A - ADDITIONAL INFORMATION
To ensure fair and transparent processing of your personal information, you have the following rights (which may be subject to certain exceptions and limits under applicable law). Any information we provide to you in response to an exercise of these rights will be supplied in an easily accessible electronic form:
1. This section applies when a user in your account connects a supported external AI assistant to Hiver using the Model Context Protocol (“MCP”). It applies to Hiver in Gmail and to Hiver Omni. The connectors are disabled by default, and no processing described in this section occurs unless a user has completed the authorisation described in Section 2 of this Appendix A. The AI assistants currently supported, and the entities that operate them, are listed at hiverhq.com/third-party-subprocessors.
2. To connect an AI assistant, a user completes an authorization in which they sign in with their existing Hiver credentials and are shown a consent screen listing the categories of access being granted, and whether each permits reading or changing data. We then issue the assistant a credential scoped to that individual user’s own permissions. An assistant can access only the shared mailboxes that users can already access: administrators can reach every shared mailbox in their account, and other users only the mailboxes they are a member of. Any content an assistant creates is attributed to that user, and their permissions are re-verified at the time of writing.
3. Information disclosed to the AI provider. When a user asks an assistant a question, the assistant requests information from Hiver and our response is disclosed to the provider operating that assistant, which is a third party outside our systems. Depending on the request, that response may include:
- Account and user information. The user’s identifier, email address and role, and the identifiers of shared mailboxes they can access.
- Mailbox configuration. Shared mailbox names and addresses, tag names, and the names of service-level policies.
- Information about colleagues. The names, email addresses and identifiers of other users who are members of a shared mailbox.
- Conversation information. Subject lines, the email address of the person who contacted you, status, assignee, tags, timestamps and links to the conversation.
- Message content. The full content of email messages within a conversation, including quoted earlier correspondence and references to attachments.
- Reporting information. Conversation volumes, response and resolution times, service-level breaches (which include the subject line and contact address of the conversation concerned), customer satisfaction scores and any free-text feedback, workload by customer organisation, and sentiment counts
4. We do not determine which of the above is disclosed; that is determined by the requests a user makes of their assistant. You should therefore assume that any correspondence held in a shared mailbox a user can access, including its full text, may be disclosed to the AI provider if that user asks a question which requires it to be read. We do not control how an AI provider subsequently uses, stores, discloses or retains information disclosed to it. That is governed by the agreement between you and that provider, and we recommend reviewing their terms before connecting an assistant, particularly where your mailboxes contain sensitive or regulated information.
5. Changes an assistant can make. A connected assistant may create internal notes on a conversation and optionally notify colleagues; save shared reply drafts for a person to review; and change a conversation’s tags, assignee or status. Assistants cannot send email. They also cannot delete conversations, alter account or billing settings, manage users, or access anything outside the shared mailboxes covered by the authorising user’s own permissions.
6. Information we record. Separately from the conversation data itself, we record: an activity log containing one entry for each request, comprising a request identifier, the user and account identifier, the product, the assistant used, the capability invoked, the outcome and the time taken — the parameters supplied with a request are stored only as a one-way cryptographic hash and never as readable text, because they may contain message content or email addresses; authorisation records, including the user’s consent and the credentials issued to the assistant; and short-lived caches of a user’s permissions and of recent report results, held for approximately five minutes.
7. Capability-gap reports. Where an assistant determines that no available Hiver capability can address a user’s request, it may record that gap so we can prioritise developing the missing capability. Such a record contains a short description of what the user was seeking to accomplish, as phrased by the assistant, together with the user and account identifier. It is held separately from the activity log described in Section 6 of this Appendix A, with its own access controls, and is used only for product development. It is not used to train any artificial intelligence model. Assistants are instructed to describe the objective rather than reproduce mailbox contents, but we cannot guarantee that such a record contains no personal information.
8. Third parties. Information is disclosed from Hiver only to the AI provider whose assistant a user has connected, and only in response to that user’s requests; different users within the same account may connect different assistants. The AI providers currently supported are named at hiverhq.com/third-party-subprocessors, which is updated as providers are added or removed and is the current record for this Section 8 of this Appendix A. For Hiver in Gmail, searching conversations queries the Google Gmail API on the user’s behalf, as elsewhere in the Services. The connectors introduce no additional hosting or infrastructure provider beyond those already identified in this Policy.
9. Retention. A credential issued to an assistant expires one hour after issue. The credential used to maintain a connection expires after thirty days and is replaced each time it is used. Permission and report caches are held for approximately five minutes. The activity log described in Section 6 of this Appendix A is retained for 90 days and the capability-gap reports described in Section 7 of this Appendix A for 90 days. Notes, drafts and tags created by an assistant are retained on the same basis as any other content in the Services, as described in Section 4 of the Privacy Policy. Information already disclosed to an AI provider is retained in accordance with that provider’s policy; withdrawing a connection prevents further disclosure but does not delete information previously disclosed.
10. Your choices. Connecting an assistant is always initiated by a user and requires that user’s consent, which lists the access being granted before it is given. A user may disconnect an assistant at any time, from within the assistant or by withdrawing the authorisation, which invalidates its credentials. Administrators can review which connections exist for their account. Administrators can disable connectors account-wide, from the MCP client itself. Reporting capabilities are available only to administrators, so other users cannot obtain account-wide analytics through an assistant. Questions about this Section 10 of this Appendix A may be directed to security@hiverhq.com, and the rights described in Section 7 of this Privacy Policy apply to information processed under this Section 10 of this Appendix A.
