HumarainsOn this page
- 1. Who we are
- 2. What we collect
- 3. How we use your information
- 4. Email connection
- 5. WhatsApp connection
- 6. Google Calendar and Google sign-in
- 7. AI processing
- 8. Who we share data with
- 9. How long we keep data
- 10. Your rights
- 11. Cookies
- 12. Security
- 13. International transfers
- 14. Children
- 15. Changes to this policy
The short version
We collect only what we need to run the service, and we never sell your data. Your email password is stored encrypted and used only to read enquiries and send the replies you allow. If you connect WhatsApp, we process your customers’ phone numbers and messages to reply for you, and we only start conversations with people who messaged you first. Customer photos are analysed by our AI provider and the image files are not kept. Calendar access is used only to show and create appointments. You can delete your account from your dashboard, or email hello@humarains.com.
1Who we are
Humarains is an AI agent that helps small service businesses handle enquiries and bookings, operated by Ekambaram Saraswathi as a sole proprietor based in Singapore (“we”, “us”, “our”). We are the data controller for the personal data of the people who sign up for Humarains, under applicable law including Singapore’s Personal Data Protection Act (PDPA), the EU General Data Protection Regulation (GDPR) and the UK GDPR.
Your customers’ data. When a business connects an email inbox, a WhatsApp number or a web form to Humarains, that business decides why and how its customers’ personal data (names, phone numbers, email addresses, messages and photos) is used. For that data the business is the controller and we are its processor, acting on its instructions. If you are a customer of one of our business users and want to see, correct or delete your data, please contact that business; we will help them respond. A data processing agreement is available on request.
Contact: hello@humarains.com
2What we collect
- Account details: your name, email address and, for email-and-password accounts, a password stored only as a bcrypt hash. If you sign in with Google we receive your Google profile ID, name, email address and profile photo URL. Signing in with Google does not give us access to your inbox.
- Business profile and knowledge: your business name, type and contact details, the services and prices you set, quoting rules, policies, and anything you add to the knowledge base (such as FAQs, processes and notes). The AI quotes only from what you give it.
- Your photo library: photos you upload for the Agent to attach to messages (for example pictures of past work) are stored in our database.
- Leads and conversations: enquiries that arrive by email, WhatsApp or your website form, every message in the conversation (text, direction, time and channel), the lead’s status and outcome (won or lost, deal value), and, on the Pro plan, lead scores and deal insights.
- Email connection: your email address, password or app-specific password, and IMAP and SMTP details, encrypted at rest with AES-256-GCM.
- WhatsApp connection: when you connect through Meta’s one-click signup we receive and store a business access token, your Phone Number ID, WhatsApp Business Account ID, display number and verified business name, plus the number’s health status. If you connect manually, you provide the same details yourself.
- Telegram connection: if you connect Telegram, we store your Telegram chat ID, username and display name, and your notification choice. Messages you send to the Humarains bot are processed like messages you type in the dashboard Agent chat, and the last few are kept so the Agent has context (used for up to 12 hours, and deleted when you disconnect Telegram). Photos you send to the bot are saved to your photo library and shown to the AI that powers the Agent so it can describe them. Updates the Agent sends you there can include customer names and message excerpts.
- WhatsApp messages and consent records: your customers’ phone numbers, profile names (where Meta shares them) and message content. We also record that a person messaged your business first, whether they have opted out, and how many messages have been sent to them, so that follow-ups follow Meta’s rules.
- Customer photos: when a customer sends a photo to your WhatsApp number we download it from Meta and send it to our AI provider to describe the job and estimate its size. We do not keep the image file. We keep the AI’s written description and any caption the customer wrote, as part of the conversation.
- Google Calendar: if you connect it, we store your Google account email and the access and refresh tokens (encrypted at rest with AES-256-GCM), and we create and read calendar events as described in section 6.
- Agent, workflows and campaigns: the instructions you give the Agent, the actions it takes for you, opportunities it proposes, your Autopilot, briefing and alert choices, workflow settings and their run logs, and the outcome of each campaign.
- Billing: payments are handled by Stripe. We store your Stripe customer ID, plan, subscription status, invoice events and, if you cancel, the reason you give. We never see or store your card number.
- Support messages: if you write to us from the Support page in your dashboard, we keep your messages and our replies, together with your account, until you ask us to delete them or you delete your account.
- Website forms: if you ask for a demo or send us a support message, we keep the name, email address, message and any business details you enter.
- Usage and security events: how many AI replies and WhatsApp messages you have used in the month, and security events such as sign-ins and account changes, with the time and IP address. We use no third-party analytics trackers.
- Processing queue: incoming messages wait in a temporary queue while they are processed, and are retried if something fails.
- Backups and logs: encrypted database backups for disaster recovery, and standard server logs (IP address, URL, status code, time) kept for up to 30 days for security and debugging.
3How we use your information
| What we do | Lawful basis |
|---|---|
| Create and secure your account | Performance of a contract (GDPR Art. 6(1)(b)) |
| Read enquiries from your connected inbox, website form or WhatsApp, and prepare replies and quotes from your business settings | Performance of a contract (GDPR Art. 6(1)(b)) |
| Send replies by email or WhatsApp, send follow-ups by email, and book jobs in your Google Calendar | Performance of a contract (GDPR Art. 6(1)(b)) |
| Analyse customer photos with AI to prepare an estimate | Performance of a contract (GDPR Art. 6(1)(b)) |
| Run the Agent, workflows and campaigns you set up, and show lead scores and deal insights on plans that include them | Performance of a contract (GDPR Art. 6(1)(b)) |
| Send your morning briefing, alerts about customers who are waiting, and payment and account notices | Performance of a contract (GDPR Art. 6(1)(b)) |
| Billing and subscription management through Stripe | Performance of a contract (GDPR Art. 6(1)(b)) |
| Occasional emails to help you finish setting up, or to tell you your leads and settings are kept if you cancel. You can ask us to stop at hello@humarains.com | Legitimate interests (GDPR Art. 6(1)(f)) — helping customers get value from the service |
| Queueing and retrying messages, error monitoring and encrypted backups | Legitimate interests (GDPR Art. 6(1)(f)) — keeping the service reliable and recoverable |
| Server logs, rate limiting and security monitoring | Legitimate interests (GDPR Art. 6(1)(f)) — protecting the service |
| Strictly necessary cookies (sign-in and CSRF protection) | Legitimate interests (GDPR Art. 6(1)(f)) — strictly necessary |
4Email connection
When you connect an email account we use your credentials for two things:
- Reading (IMAP): checking your inbox for new customer enquiries so the AI can pick them up. We read only what is needed to identify and answer enquiries. We do not browse, search or export your mailbox history.
- Sending (SMTP): sending replies and follow-ups from your address. These go out only in the sending mode you choose: held for your approval, or sent automatically.
Credentials are encrypted at rest, are never sent to your browser, and are used only for these purposes. You can disconnect your email at any time in your dashboard, which permanently deletes the stored credentials. Because Humarains uses standard IMAP and SMTP rather than a provider’s own API, no provider API terms apply to this connection. This policy governs how we handle it.
5WhatsApp connection
WhatsApp runs on Meta’s official WhatsApp Business Cloud API. You connect through Meta’s signup window, or by supplying your own Phone Number ID and access token. We use the connection to:
- Receive messages your customers send to your business number, through a webhook from Meta, so we can create or update the lead and prepare a reply.
- Send replies to customers who message you, automatically and without waiting for your approval, within 24 hours of their last message.
- Download photos customers send, so the AI can prepare an estimate, and then discard the file.
Consent and opt-outs. We never start a WhatsApp conversation: we only reply to people who messaged your business first, within 24 hours of their last message. A phone number from a web form or an email is never messaged on WhatsApp. If someone replies STOP, “no thanks” or similar, we stop messaging them and cancel pending follow-ups until they write to you again.
Your WhatsApp access token and Phone Number ID are stored in our database with your other integration settings. Unlike your email and Google credentials, they are not currently encrypted with a separate layer. They are protected by the same database access controls, HTTPS encryption in transit and sign-in protections as the rest of your account, and are never sent to your browser. Disconnecting WhatsApp deletes them.
Meta acts as an independent controller for the transmission of WhatsApp messages and is subject to its own WhatsApp Business Policy and Privacy Policy.
6Google Calendar and Google sign-in
Google sign-in uses only your basic profile and email address. Google Calendar is a separate, optional connection that you authorise with the calendar.events permission. We use it to show your upcoming appointments and to create events for the jobs the AI books. We do not use it for anything else.
Our use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
Limited Use: data obtained through Google APIs is used only to provide and improve Humarains for you. It is never used to train generalised AI or machine-learning models, and is never sold or shared with third parties for their own purposes.
You can revoke our access at any time from myaccount.google.com/permissions or by disconnecting Calendar in your dashboard.
7AI processing
The text of customer enquiries, any photos sent over WhatsApp, your conversations with the Agent, and your business settings are sent to Anthropic’s Claude API to write replies, prepare quotes, estimate jobs from photos, score leads and draft follow-ups. Anthropic processes this as our data processor under its API terms, and your data is not used to train AI models. We do not send your business or lead data to any other AI provider.
Automated replies. On WhatsApp, and on email if you choose an autonomous mode, replies are written and sent without a person reviewing them first. Prices come from your own rules, and anything unusual is handed to you instead of being guessed. A customer who would rather speak to a person can ask the business, and you can step in at any time from your dashboard. Photo estimates are indicative and subject to confirmation by the business. Lead scores and deal insights help you decide where to spend your time. They do not decide anything about a customer on their own.
9How long we keep data
We keep your account data while your account is active. Leads, conversations and AI replies are kept so you can read your history. Some operational records are cleared automatically:
- Security event records: 180 days
- Finished workflow runs and finished follow-up jobs: 90 days
- Completed Agent tasks and decided Agent proposals: 180 days
- Handled entries in the message-processing queue: 30 days (90 days for messages that could not be processed)
- Encrypted backups: a limited period, up to 90 days
Deleting your data. You can delete your account yourself from your dashboard settings. This cancels your subscription and removes your account, leads, conversations and settings from our live systems. Copies in encrypted backups expire as the backups rotate out. You can also disconnect email, WhatsApp or Google Calendar at any time, which deletes the stored credentials, and delete individual leads. Where the law requires us to keep something, such as tax and payment records, we keep it only for as long as required.
If you cancel but keep your account, your leads and settings stay in place so you can pick up where you left off.
10Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict certain processing. Email hello@humarains.com and we will reply within 30 days. EU and UK residents can also complain to their local data protection authority, and Singapore residents to the Personal Data Protection Commission.
12Security
Everything is sent over HTTPS. Email passwords and Google tokens are encrypted at rest with AES-256-GCM, and database backups are encrypted before they leave our servers. Account passwords are hashed with bcrypt (12 rounds). Tokens and passwords are stripped out of the data sent to your browser, so your dashboard never receives them. We use rate limiting, CSRF protection and input validation throughout. WhatsApp credentials are the exception described in section 5.
No system is perfectly secure. If you believe your account has been accessed without permission, tell us straight away.
13International transfers
We are based in Singapore. Our hosting and database providers may process data in the United States and elsewhere. For users in the EEA and UK, transfers outside those regions use appropriate safeguards, including Standard Contractual Clauses where they apply. Encrypted backups sit with a cloud storage provider that may be outside Singapore. If you connect WhatsApp, message data also passes through Meta’s infrastructure, under Meta’s own terms.
14Children
Humarains is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. If you think a child has given us personal data, email hello@humarains.com and we will delete it promptly.
15Changes to this policy
We may update this policy from time to time. We will tell you about material changes by email or in the app at least 14 days before they take effect. Using the service after a change takes effect means you accept the updated policy. Questions about privacy or your data rights: hello@humarains.com