The short version: We collect only what we need to run the service. We never sell your data. Email account credentials (IMAP/SMTP) are stored encrypted and used only to read enquiries and send replies you approve. If you connect WhatsApp Business, we process your customers' phone numbers and message content, and your Meta API credentials, solely to send and receive WhatsApp messages on your behalf. If you enable the Voice Agent, outbound and inbound calls are placed through Bland.ai; call transcripts and optional recordings are stored in your account and used only to update lead records. You can delete your account and all associated data at any time by emailing hello@humarains.com.
Humarains is an AI-powered lead conversion platform for small service businesses, operated by Ekambaram Saraswathi as a sole proprietor based in Singapore ("we", "us", or "our"). We are the data controller responsible for your personal data under applicable law, including Singapore's Personal Data Protection Act (PDPA), the EU General Data Protection Regulation (GDPR), and the UK GDPR.
Contact: hello@humarains.com
| Processing Activity | Lawful Basis |
|---|---|
| Account creation and authentication | Performance of a contract (GDPR Art. 6(1)(b)) |
| Generating AI quote replies from your business settings and lead content | Performance of a contract (GDPR Art. 6(1)(b)) |
| Reading inbound enquiries from your connected email account via IMAP | Performance of a contract (GDPR Art. 6(1)(b)) |
| Sending approved replies via your connected email account via SMTP | Performance of a contract (GDPR Art. 6(1)(b)) |
| Sending and receiving WhatsApp messages via the Meta WhatsApp Business Cloud API | Performance of a contract (GDPR Art. 6(1)(b)) |
| Placing outbound AI voice calls to leads via Bland.ai | Performance of a contract (GDPR Art. 6(1)(b)) |
| Receiving and storing call transcripts and recording URLs from Bland.ai | Performance of a contract (GDPR Art. 6(1)(b)) |
| Answering inbound calls via a Bland.ai-provisioned number | Performance of a contract (GDPR Art. 6(1)(b)) |
| Billing and subscription management via Stripe | Performance of a contract (GDPR Art. 6(1)(b)) |
| Sending transactional emails (receipts, account notices) | Performance of a contract (GDPR Art. 6(1)(b)) |
| Server logs and security monitoring | Legitimate interests (GDPR Art. 6(1)(f)) — protecting system integrity |
| Essential cookies (authentication, CSRF protection) | Legitimate interests (GDPR Art. 6(1)(f)) — strictly necessary |
When you connect your email account, you provide your email address, password (or app-specific password), and your IMAP/SMTP server details. These credentials are used for two purposes:
Your email credentials are stored encrypted (AES-256-GCM) and are used only for the purposes above. You can disconnect your email account at any time from your dashboard settings, which immediately and permanently deletes the stored credentials. Because Humarains connects via standard IMAP/SMTP protocols rather than a provider-specific API, no third-party API terms (such as Google's) govern this integration — our handling of your email data is governed entirely by this Privacy Policy.
WhatsApp messaging is provided through the official Meta WhatsApp Business Cloud API (developers.facebook.com/docs/whatsapp). To connect this feature, you provide a Meta Phone Number ID and a System User access token, generated in your own Meta Business account. We use these credentials for two purposes:
Your Meta access token and Phone Number ID are stored in our database together with your other account integration settings. Unlike email credentials, WhatsApp credentials are not currently encrypted at rest with a separate encryption layer; they are protected by the same database access controls, transport encryption (HTTPS/TLS), and authentication safeguards that protect the rest of your account data. You can disconnect WhatsApp at any time from your dashboard settings, which immediately deletes the stored credentials from our database.
Because WhatsApp messaging is processed through Meta's infrastructure, Meta acts as an independent controller for the underlying transmission of messages and is also subject to its own WhatsApp Business Policy and Meta Privacy Policy. Your use of the WhatsApp Business Cloud API through Humarains is also subject to Meta's own terms.
The Voice Agent feature is powered by Bland.ai (bland.ai). When you enable it, calls are placed and received through Bland.ai's infrastructure using our shared platform API key — you do not need to provide your own Bland.ai credentials.
Outbound calls: When Humarains triggers an outbound call to a lead, we send Bland.ai the lead's phone number, your business phone number (as caller ID), and a prompt built from your agent name, persona, and the lead's details. Bland.ai conducts the call and, when it completes, sends us a webhook containing the call status, duration, a text transcript of the conversation, and (if recording is enabled in your settings) a URL to an audio recording hosted on Bland.ai's servers.
Inbound calls: If you enable inbound calling, Bland.ai provisions a dedicated phone number that you forward your business line to. When a call is received, Bland.ai handles the conversation using your configured agent settings and sends us the same post-call webhook with transcript and recording URL.
What we store: We store the transcript text, the recording URL, call duration, and status in your Humarains account and link them to the relevant lead record. The audio recording file itself is hosted by Bland.ai — we store only the URL. You can disable call recording at any time from your Voice settings; this applies to future calls only.
Your customers: When your AI agent calls a lead, that person's phone number and the content of their conversation is processed by Bland.ai as part of the call. You are responsible for ensuring you have a lawful basis to contact leads by phone and that your use of the Voice Agent complies with applicable telemarketing and recording-consent laws in your jurisdiction (e.g. requiring two-party consent for recordings in certain states or countries).
Bland.ai acts as a data processor on our behalf for the purposes of conducting and transcribing calls. Their handling of call data is also governed by Bland.ai's Privacy Policy.
Humarains integrates with Google Calendar via the Google Calendar API (OAuth 2.0) to allow the AI to book appointments directly into your calendar on your behalf. Our use of data obtained through Google Workspace APIs — including Google Calendar — complies with the Google API Services User Data Policy, including the Limited Use requirements.
Limited Use Statement: The use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google Workspace APIs is used solely to provide and improve the Humarains service for the individual user. This data is never used to train, develop, or improve generalised AI or machine learning models, and is never shared with or sold to third parties for any purpose.
Specifically, Google Calendar data accessed through our integration is used only to create, read, and manage calendar events on your behalf as part of the appointment booking feature. We do not read, store, or process any Google Calendar data beyond what is necessary to create or confirm a specific appointment booking initiated through Humarains. You can revoke our access to your Google Calendar at any time from your Google Account permissions page at myaccount.google.com/permissions or from your Humarains dashboard settings.
Customer enquiry content and your business settings are sent to Anthropic's Claude API to generate quote replies. Anthropic processes this data as a data processor on our behalf under their API terms. Your data is not used to train AI models. We do not share your business settings or customer lead data with any other third party for AI processing.
We share your data with the following categories of third parties only where necessary to provide the service:
We do not sell your data. We do not share it with advertisers or use it for any purpose other than operating the service.
We retain your account data for as long as your account is active. Lead data and AI-generated replies are retained so you can access your history. If you delete your account, all personal data is deleted within 30 days, except where we are required to retain it by law (e.g. billing records for tax purposes, retained for up to 7 years).
Depending on your location, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these rights, email hello@humarains.com. We will respond within 30 days. EU and UK residents may also lodge a complaint with their local supervisory authority.
We use only strictly necessary cookies: an authentication cookie (bp_token) and a CSRF protection cookie (bp_csrf). We do not use advertising, analytics, or tracking cookies. No cookie consent banner is required for strictly necessary cookies under applicable law.
All data is transmitted over HTTPS. Sensitive credentials (email account passwords, IMAP/SMTP details) are encrypted at rest using AES-256-GCM before being stored in our database. WhatsApp Business credentials (Meta Phone Number ID and access token) are stored in our database under the same access controls and transport encryption as the rest of your account data. Voice Agent call transcripts are stored in our database with the same access controls; audio recordings are hosted by Bland.ai and accessed via URLs stored in your account. Passwords are hashed using bcrypt with 12 rounds. We apply rate limiting, CSRF protection, and input validation throughout the platform.
We are based in Singapore. Our infrastructure (Supabase, Render) may process data in the United States. For EEA/UK users, transfers to the US are made under appropriate safeguards including Standard Contractual Clauses where applicable. If you connect WhatsApp, message data also passes through Meta's infrastructure, which may process data outside of Singapore in accordance with Meta's own privacy terms. If you enable the Voice Agent, call and transcript data is processed by Bland.ai, whose infrastructure is based in the United States.
Humarains is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us at hello@humarains.com and we will delete it promptly.
We may update this policy from time to time. We will notify you of material changes by email or via an in-app notice at least 14 days before they take effect. Continued use of the service after changes take effect constitutes acceptance of the updated policy.
For any privacy questions or to exercise your data rights: hello@humarains.com