Privacy Policy
HerovaAi is a self-hosted assistant for WhatsApp customer conversations. This page explains what this deployment collects, why it collects it, where it is processed, and how you can control or remove it. “We” and “the operator” mean the business running this deployment for you.
What we collect
- Account details. Your name, email address, optional phone number, and a profile picture if your sign-in provider supplies one. Passwords are stored only as one-way hashes — never as readable text.
- What you teach the assistant. Your business profile (name, industry, description, website, contact email), your catalog and prices, the instructions and tone you set, and the memories the assistant builds from your conversations so it can answer the way you would.
- Customer conversations. When you pair a WhatsApp number, the messages exchanged with your customers are stored: the text, the customer's phone number, whether each message was incoming or outgoing, and timestamps. This is what lets the assistant answer and lets you review what was said.
- Security records. Standard request metadata — IP address, browser user agent and timestamps — kept to protect the service and diagnose faults.
Why we process it
- To provide the service: reply to your customers, show you your conversations, and keep the assistant's memory of your business.
- To keep accounts and the deployment secure, and to detect abuse.
- To support you when something goes wrong, and to meet legal obligations.
Where it is processed, and who else sees it
- This deployment. Data is stored in the operator's own database on the server that runs the app.
- AI providers. Replies are written by an AI model you choose. A local model runs on the same machine and keeps the text there. A cloud model — for example Groq or Google Gemini, as listed in the model picker — receives the message text needed to produce the reply, under that provider's own terms.
- Google (optional). If you sign in with Google, Google authenticates you and shares your name, email address and picture. You can also register with an email address instead.
- WhatsApp. Messages travel between you and your customer through WhatsApp as they normally would; the assistant works from your own paired WhatsApp session.
- Hosting and delivery. Public traffic is proxied through the hosting or tunnel provider that publishes the app, and that provider processes ordinary request metadata such as IP addresses to deliver it.
- Administrators. The operator and any admin account they create can see accounts, conversations and memories in the admin area. That access is how the service is run and supported for you.
We do not sell your data, and we do not use it for advertising.
Your choices and rights
- Review, edit and delete memories and conversations from the dashboard at any time.
- Pause or stop automatic replies, and disconnect the paired WhatsApp number whenever you want.
- Ask the operator to delete your account and its business data; the stored conversations for your session are removed with it.
- Ask what we hold about you and ask for a copy.
If you are a customer of a business that uses HerovaAi, your conversation is controlled by that business — please contact them. We process it on their instruction.
How long we keep it
Account data, business memories and conversations are kept while your account is active, and are deleted when you delete the account or ask the operator to. Security records rotate automatically after a short period.
Cookies and local storage
This site sets no advertising or analytics cookies. Signing in stores an access token in your browser's own storage so the app can recognise you, and the optional Google sign-in handshake uses a short-lived session cookie on the server. Google may set its own cookies during sign-in, under Google's policies.
Security
Passwords are stored as bcrypt hashes, sign-in sessions are issued as signed tokens, administrative access is limited to operator accounts, and provider keys live in server-side configuration rather than in the browser. No system is perfectly secure: if you believe your account or data has been misused, tell the operator straight away.
Children
HerovaAi is a tool for businesses and is not intended for anyone under 18, and we do not knowingly collect data from children.
Changes to this policy
When this policy changes, the date at the top of this page changes with it. Material changes are announced inside the app before they take effect.
Contact
To exercise any of the choices above, contact the operator of this deployment — the business that gave you access to it, or the address in your welcome message.