Privacy Policy

1. Introduction

Welcome to HMN.Plus (operated by Ramirez Holdings Limited, trading as hmn.plus, registered in Christchurch, New Zealand). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our AI-powered business automation platform (the "Service").

2. Information We Collect

We collect information in the following categories:

2.1 Account Information

When you sign up, we collect your name, email address, and profile information provided by your OAuth provider (e.g. Google). If you sign up with email and password, we store a securely hashed version of your password.

2.2 Connected Account Data

When you connect third-party services via OAuth, we may access and process data from those services to power your automations. This includes:

• Google Gmail: Email messages, labels, and metadata — to automate inbox workflows
• Google Calendar: Events, schedules, and attendee information — to automate scheduling
• Google Drive: Files and documents — to automate document workflows
• Google Contacts: Contact names, email addresses, and organisation details — to automate outreach and CRM tasks

We only access the data necessary to perform the automations you configure. You can review and revoke access to any connected service at any time through your account settings or directly through the third-party provider's security settings.

2.3 Business Information

During onboarding, we may analyse publicly available information from your website (e.g. company name, logo, brand colours, tagline) to personalise your workspace. This data is derived from public sources and is not collected from your private systems.

2.4 Usage Data

We collect information about how you interact with the Service, including pages visited, features used, workflow configurations, and performance metrics.

2.5 Device and Technical Data

We collect your IP address, browser type, operating system, device identifiers, and approximate location (country/region level, derived from IP) for security, analytics, and localisation purposes.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service and your automations
• Execute AI agent actions within your connected services on your behalf
• Personalise your workspace and onboarding experience
• Process transactions and manage billing
• Communicate with you, including for customer support and service notifications
• Send marketing communications (with your consent; you can opt out at any time)
• Detect and prevent fraud, abuse, and unauthorised access
• Comply with legal obligations

4. AI Processing and Your Data

The Service uses artificial intelligence to automate tasks on your behalf. This section explains how your data interacts with AI systems:

• Your choice of AI provider: HMN.Plus does not maintain its own service agreements with AI/LLM providers. You select and configure which AI provider to use (e.g. Anthropic, OpenAI, Google Gemini) through your account settings. Your relationship with that provider is governed by their terms and your own agreement with them.
• How AI processes your data: When you configure an automation, relevant data from your connected accounts (e.g. an email body, a calendar event, a document) is sent to the AI provider you have selected to interpret, summarise, or act on it according to your instructions.
• No model training: We do not use your data to train, fine-tune, or improve AI models. Your data is used solely for real-time inference to deliver the Service. You should review your chosen AI provider's data usage policies to understand how they handle data received via their API.
• Data minimisation: We send only the minimum data necessary to complete each task. We do not send your entire inbox or drive contents to AI providers — only the specific items relevant to the automation being executed.
• HMN.Plus as conduit: HMN.Plus acts as a technical conduit, passing your data to the AI provider you have chosen. We do not independently determine which AI provider processes your data — that decision is yours.

5. Sub-processors and Third-Party Services

We share data with the following categories of sub-processors to deliver the Service. We maintain data processing agreements with our infrastructure and payment providers to ensure your data is protected:

Client-Selected AI Providers

HMN.Plus does not maintain service agreements with AI/LLM providers. When you use the Service, you choose which AI provider to use (e.g. Anthropic, OpenAI, Google Gemini). Data is sent to your chosen provider solely to execute your automations. Your use of any AI provider is governed by your own agreement with that provider, and you are responsible for reviewing their privacy and data handling policies. HMN.Plus supports multiple AI providers to give you choice, but does not act as a party to your relationship with them.

6. Google API Services User Data Policy

HMN.Plus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google user data to provide and improve the Service's features that are visible to you
• We do not transfer Google user data to third parties except as necessary to provide the Service, as required by law, or with your explicit consent
• We do not use Google user data for serving advertisements
• We do not allow humans to read your Google user data unless: you give explicit consent, it is necessary for security purposes (e.g. investigating abuse), it is required by law, or the data is aggregated and anonymised for internal operations

7. Third-Party Data (Your Clients' Data)

When you use the Service to automate workflows involving your own customers, employees, contacts, or other third parties ("End-User Data"), the following applies:

• You are the data controller: You determine what End-User Data is processed through the Service and for what purpose. HMN.Plus acts as a data processor, processing End-User Data solely on your instructions and to deliver the Service.
• Your responsibility: You are responsible for ensuring that you have a lawful basis to process End-User Data (e.g. consent, legitimate interest, contractual necessity) and that your own privacy practices comply with applicable laws. You should not process End-User Data through the Service in ways that violate your obligations to those individuals.
• What we may process: End-User Data may include names, email addresses, phone numbers, message content, calendar availability, document contents, and other information present in your connected accounts. We do not independently collect End-User Data — it enters the Service only through your connected accounts and automations.
• How we handle it: End-User Data receives the same protections as your own data: encrypted in transit and at rest, not used for model training, not sold, and not retained beyond what is necessary to execute your automations.
• AI processing of End-User Data: When an automation processes End-User Data (e.g. summarising an email from one of your customers), that data may be sent to the AI provider you have selected, under the terms described in Sections 4 and 5. You are responsible for ensuring your use of a third-party AI provider to process End-User Data complies with your obligations to those individuals.
• Deletion: When you delete your account or disconnect an integration, all End-User Data associated with your automations is deleted in accordance with the retention periods described in this policy.

If you require a formal Data Processing Agreement (DPA) for compliance purposes, please contact us at hello@hmn.plus.

8. Sharing Your Information

We do not sell, trade, or rent your personal information. We share your data only in the following circumstances:

• Sub-processors: As described in Section 5, to operate the Service
• Legal requirements: When required by law, regulation, legal process, or enforceable governmental request
• Protection of rights: To protect the rights, property, or safety of HMN.Plus, our users, or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you
• With your consent: When you explicitly authorise sharing with a specific third party

9. Data Retention

We retain your data for as long as necessary to provide the Service and fulfil the purposes described in this policy:

• Account data: Retained while your account is active and for 30 days after deletion to allow for recovery
• Connected account data: Processed in real time and cached only as long as needed to execute automations; not stored permanently
• Workflow and automation logs: Retained for 90 days for debugging and audit purposes
• Billing records: Retained as required by applicable tax and accounting laws
• Usage and analytics data: Retained in aggregated, anonymised form indefinitely

10. Data Security

We implement appropriate technical and organisational security measures, including:

• Encryption of data in transit (TLS) and at rest (AES-256)
• OAuth tokens and API credentials are encrypted before storage
• Access controls and audit logging for internal systems
• Regular security reviews of our infrastructure and dependencies

No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

11. International Data Transfers

HMN.Plus is operated from New Zealand. Your data may be transferred to and processed in countries other than your own, including the United States, where our infrastructure partners are located. When you choose an AI provider, your data may also be transferred to the jurisdictions where that provider operates — you should review their privacy policy for details. We ensure that international transfers to our own sub-processors (listed in Section 5) are protected by appropriate safeguards, including data processing agreements that include standard contractual clauses or equivalent protections where applicable.

12. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• The right to access your personal data
• The right to rectify inaccurate or incomplete data
• The right to request deletion of your data
• The right to restrict or object to processing
• The right to data portability
• The right to withdraw consent at any time
• The right to disconnect third-party integrations and revoke data access

To exercise any of these rights, contact us at hello@hmn.plus. We will respond within 30 days.

13. Cookies

We use cookies and similar technologies for authentication, preferences, and analytics. Essential cookies (session tokens, language/currency preferences) are required for the Service to function. Analytics cookies (Google Tag Manager, Meta Pixel) help us understand usage patterns and are only set with your consent where required by law. You can control cookie preferences through your browser settings.

14. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

15. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a notice on the Service at least 30 days before they take effect. We will always update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

16. Contact Us

If you have any questions about this privacy policy or our data practices, please contact us at:

hello@hmn.plus

Ramirez Holdings Limited
Christchurch, New Zealand