Privacy notice

Who provides HulloFox

HulloFox is operated by შპს ატმოსგეითი (Atmosgate), registered in Georgia, company identification number 406568129. Contact levani.parastashvili@gmail.com for privacy questions and data requests.

Registered address: Lilo settlement, V quarter, building 1, apartment 73, Samgori district, Tbilisi, Georgia.

Our role and your business’s role

We manage information needed to provide and secure HulloFox accounts and support. A business using HulloFox decides which accounts to connect, what knowledge to upload and how to use its customer conversations. We process that business’s customer content to provide the service on its instructions. If you contact a business through a connected channel, its privacy notice also applies.

Information we process

This includes account details, workspace membership, business inventory, uploaded knowledge and files, connected-account identifiers and authorization credentials, messages and replies, customer contact information provided in conversations, delivery records and operational logs. The connected platform controls what it makes available through its official interfaces. The service does not automatically import every historical message from every channel.

Why we use information

We use information to authenticate users, connect authorized business accounts, generate replies from relevant business information, provide a shared inbox, route human handoffs, maintain the service, handle requests and investigate abuse or errors. Where a legal basis is required, account and service administration relies on providing the requested service, protecting the service and complying with applicable obligations. The business is responsible for a valid basis for the customer content it instructs us to process and for required notices or consent.

Service providers and data flow

• Convex provides the backend, authentication data, database and file storage. Our application deployment is in Ireland.
• Cloudflare delivers the web application through Pages and processes web-request information. Its private-file endpoints stream authorized downloads and, where the upload gateway is enabled, uploads to Convex. Normal dashboard data requests connect directly to Convex; Cloudflare is not the workspace database or file-storage provider.
• Vercel continues to host the retained pilot application, process its web-request information and deliver authorized file downloads through that pilot. Earlier document-processing jobs may finish or be cleaned up in its isolated conversion environments during the transition to Azure. Convex remains the database and file-storage provider.
• Microsoft Azure provides our AI models and document-processing infrastructure. Relevant message context, selected inventory and knowledge are sent to model APIs for reply generation and search embeddings. Rendered document pages and images are sent to Azure models for reading when required. The document reader handles uploaded file content and temporary extraction results on dedicated Azure infrastructure in Poland Central. Convex remains the authoritative store for original files and workspace data. Encrypted recovery copies may also be kept in separate Azure storage in Poland Central as incremental backups are enabled.
• Meta provides the Facebook Messenger, Instagram and WhatsApp interfaces for accounts a business connects, subject to Meta’s own terms and privacy practices.
• Google Gmail, when account email is enabled, sends verification and password-reset messages through our temporary support mailbox. Google processes the recipient address and email content. The sender grant is send-only and does not connect a customer’s inbox. Emailing support also sends your request to Google. For this Gmail integration, our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• GitHub Actions runs backup export and encryption. A hosted runner temporarily processes the export before encrypting it; retained backup artifacts are encrypted. Where incremental backups are enabled, encrypted file copies are stored separately in Azure and linked to the dated backup records needed for restoration.

When file reading is enabled, uploaded documents are processed by the document reader and, where needed, Azure AI models. New document-reading jobs use the Azure processor; earlier jobs may complete or be cleaned up on Vercel during migration. Supported formats, file-size limits and processing results are shown in the workspace. Reading a file is not an antivirus certification or a guarantee that every extracted detail is correct.

We do not sell conversations or use them to train our own shared AI model. Service providers may process data for their service operations, security or abuse monitoring under their applicable terms. We do not promise that provider monitoring is disabled.

Where processing happens

Our operating and support team accesses data from Georgia. Our Convex application and deletion ledger are deployed in Ireland, and the Azure document reader is deployed in Poland Central. These locations do not mean all processing stays in those countries. Azure chat and fallback models use Global Standard deployments on a Sweden Central resource, so relevant inference may occur in other supported geographies. Embeddings use a Microsoft-defined European data zone. The retained Vercel conversion and download paths are configured for Frankfurt. Cloudflare delivery and providers’ operations, diagnostics and remote support may involve other countries. Applicable service configurations, contracts and transfer requirements govern that processing; we do not claim a single-country or EU-only service.

Retention

Conversations have no automatic expiry. Conversation history, inventory and business knowledge remain until an authorized user removes them or an applicable deletion request is completed. Deleting an account or workspace is separate from disconnecting a channel or pausing AI.

Document processing creates temporary copies of uploaded files and extraction results. These processing copies are removed after a job finishes or is cancelled; failed cleanup is retried and reviewed. This cleanup does not delete the original files, business knowledge, conversation history or retained backups.

Short-lived verification codes, delivery metadata, logs and backups have separate lifecycles. Account-email payloads are encrypted while queued and removed after dispatch or expiry; account-email delivery metadata is kept for up to 30 days. Numerical AI usage measurements do not include message bodies: detailed records are kept for seven days and daily totals for 31 days. Routine encrypted backup artifacts currently expire after 14 days. A completed live-data deletion does not instantly remove an older backup. Records required for security, a dispute or a legal obligation may be retained for the applicable purpose.

Access and safeguards

Workspace access depends on account authentication and membership. Connected credentials are encrypted. Authorized business teammates can read and answer their workspace’s conversations; necessary platform support and infrastructure providers may process information to operate the service. Authenticator enrollment is optional. No online service can guarantee that every security risk will be eliminated.

Your choices and requests

You can manage the connected accounts and data controls offered in your workspace. Contact us to request access, correction, export or deletion of information, or to raise a privacy concern. Identify the account, business or conversation involved without sending passwords or codes. We verify identity and authority and explain any applicable limitation. If your request concerns a business’s customer records, we may need to coordinate with that business. Rights and complaint routes depend on the law applicable to you.

Updates

We publish material changes here and provide additional notice where required. New channels and processing providers are described before they are made available. See support and data requests for help, or review the terms.