⚠️ DRAFT — DO NOT PUBLISH WITHOUT LEGAL REVIEW. This document is a draft prepared for Holari Group LLC. A lawyer must review it before it is published. Everything in [BRACKETS] is still to be filled in.

Holari.io Privacy Policy

Last updated: [EFFECTIVE DATE]

This policy explains what personal data Holari.io collects, why we use it, who we share it with and what rights you have. It applies to the holari.io website, the Holari.io web application and the Holari.io mobile app (when available).

1. Who we are

Holari.io is a service of Holari Group LLC, a limited liability company organized in [STATE OF FORMATION], United States.

• Address: [REGISTERED ADDRESS]
• Privacy email: [privacy@holari.io — TO BE CONFIRMED]
• Data protection officer / contact: [NAME OR "NOT APPOINTED"]

In this policy, "Holari", "we", "us" and "our" mean Holari Group LLC.

2. Two kinds of people, two different roles

Holari.io is a CRM with artificial intelligence (AI) agents for service businesses. We handle data about two groups:

If you are an end user: the business you messaged decides about your data. Please check its privacy policy and send your requests to it first. We help the business handle them (see section 10).

3. Data we collect

3.1 Customer (account) data

• Account: name, email address, profile photo (optional) and password. The password is stored by our authentication provider as a hash; we never see it. If you sign in with Google, we receive your Google name, email and photo.
• Business: company name, logo, service area, hours, services, prices and any information you write to train your agent.
• Team: name, email and role of each person you invite.
• Billing: plan, subscription status, trial and billing dates, and Stripe customer and subscription identifiers. We do not store card numbers: payments are processed by Stripe.
• Message balance: top-ups, charges for messages sent and adjustments to the prepaid balance.
• Service usage: technical logs, AI usage events (for example, how many replies your agent sent), errors and IP address.
• Audit log: who did what and when (plan changes, exports, deletions and access by our support team).
• Integration credentials: the access you give us to connect your channels or Google Calendar, stored encrypted with AES-256-GCM.
• Mobile device (app): push notification token and notification preferences.

3.2 End-user data (processed on behalf of the business)

• Contact: name, phone number, email, channel identifier (for example, Instagram ID), tags, custom fields and whether they agreed to receive messages.
• Conversations: text messages, voice notes, images and other files, and the automatic transcription of voice notes.
• Appointments: date, time, service and status.
• Sales: opportunities, stage and estimated value recorded by the business.

3.3 Website visitors

• Technical data (browser, device, pages visited, IP) and cookies needed for the site to work. [CONFIRM WHETHER ANALYTICS OR ADVERTISING COOKIES WILL BE USED; if so, add a cookie notice and banner.]

4. How we use data

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not use end-user data for our own marketing.

5. Artificial intelligence

• To let the agent reply, Holari.io sends the conversation content, the business information and excerpts from its knowledge base to OpenRouter, which routes them to the selected AI model provider. Voice notes are also sent for transcription.
• We configure these services to use the data only to generate the reply. [CONFIRM with OpenRouter and each model provider their retention terms and whether they use data for training; choose only providers that do not train on the data.]
• Holari does not use customer conversations to train its own or third-party AI models.
• AI replies may contain mistakes. The business can review any conversation and take over at any time with the "Take over" button.
• The business decides whether to tell its clients that an automated assistant is replying. We recommend doing so.

6. Who we share data with (subprocessors)

We share data only with providers that help us deliver the service, under contract and only for that purpose:

We may also share data: (a) when required by law or a competent authority; (b) to protect the rights, safety or property of Holari, our customers or others; (c) in a merger, acquisition or asset sale, with prior notice to you.

7. Meta data (WhatsApp, Instagram, Messenger)

• When you connect a Facebook Page, an Instagram professional account or a WhatsApp number, we receive the messages your clients send you and the basic profile data the platform shares (name, channel ID and, on WhatsApp, the phone number).
• We use that data only to show conversations in your inbox, reply (you or your AI agent) and organize your contacts and appointments.
• We do not sell this data, use it for advertising or combine it with other customers' data.
• We follow Meta's policies: the 24-hour customer service window, approved templates outside that window, the human agent tag where applicable, and the pause on marketing templates to US (+1) numbers.
• You can disconnect a channel at any time from Holari.io or from your Facebook or Instagram settings. See our data deletion instructions.

8. Google data (Limited Use)

If you connect Google Calendar, Holari.io reads and writes events on your calendar to show your real availability and to create or update appointments booked in Holari.io.

Holari.io's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use Google data only to provide and improve the scheduling feature you see in Holari.io; we do not transfer it except to provide that feature, as required by law or with your permission; we do not use it for advertising; and no human reads it except with your permission, for security, or as required by law.

9. How long we keep data

[OWNER DECISION: confirm all periods with the lawyer and with the actual Supabase backup settings.]

10. Your rights

10.1 Customers

From the app, or by writing to [privacy@holari.io — TO BE CONFIRMED], you can:

• see and download your data;
• correct it;
• delete a contact or your whole workspace (deleting the workspace cancels the subscription);
• object to or ask us to restrict certain uses;
• withdraw consent to news emails.

10.2 End users

Send your request to the business you messaged. If you don't know how to reach it or it doesn't answer, write to [privacy@holari.io — TO BE CONFIRMED] with the business name and the channel you used; we will forward your request and help the business respond.

10.3 California residents (CCPA/CPRA)

If you live in California, you have the right to: know what personal information we collect and how we use it; access it; correct it; delete it; and not be discriminated against for exercising your rights. We do not sell or "share" personal information as those laws define the terms, and we do not use sensitive personal information for purposes other than those permitted. The categories we collect are those in section 3 (identifiers, commercial information, internet activity, audio recordings when you send voice notes, and professional information). You may exercise your rights by email or through an authorized agent; we will verify your identity before responding.

[PENDING: confirm with the lawyer whether Holari meets CCPA thresholds and whether other US state privacy laws apply.]

10.4 Mexico, Colombia and other Latin American countries

If you live in Mexico, you may exercise your ARCO rights (access, rectification, cancellation and opposition) under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). If you live in Colombia, Argentina, Chile, Peru or another country with a data protection law, we recognize the equivalent rights under that law. Write to [privacy@holari.io — TO BE CONFIRMED].

10.5 Response time

We respond within 30 days (or the shorter period your law requires; for example, 20 business days in Mexico). If we need more time, we will tell you.

11. International transfers

Holari.io is hosted in the United States. If you use Holari.io from another country, your data is transferred to and processed in the US and in the countries where our providers operate. We require our providers to apply appropriate safeguards (data protection contracts and clauses). [PENDING: if there are customers in the European Union or the UK, add standard contractual clauses.]

12. Security

• Each workspace is isolated from the others with row-level security in the database.
• Integration credentials are encrypted with AES-256-GCM.
• Automatic notifications (webhooks) from our providers are signature-verified and processed only once.
• Support access is temporary and logged: our team enters your account only after giving a reason, the access expires automatically and your account admin can see it in the audit log.
• The audit log cannot be edited or deleted.

No system is 100% secure. If a breach affects your data, we will notify you as required by law.

13. Children

Holari.io is a service for businesses. It is not directed at anyone under 18, and we do not knowingly collect data from children under 16. If you believe a minor gave us data, contact us and we will delete it. Businesses must not use Holari.io to contact minors without any consent the law requires.

14. Changes to this policy

If we make material changes, we will notify you by email or in the app before they take effect. The date above shows the last update.

15. Contact

Holari Group LLC [REGISTERED ADDRESS] [privacy@holari.io — TO BE CONFIRMED]