How we handle your data.

HIVRA is operated by MOUV USA LLC DBA HIVRA, a New York limited liability company (“HIVRA”, “we”). HIVRA is a platform that businesses use to answer their customers on WhatsApp, Instagram, Messenger, SMS and phone with an AI agent, run campaigns, take bookings and collect payments.

This policy covers three groups of people:

• Operators — the people at a business who sign up and use the dashboard. For your account data, HIVRA is the controller.
• Customers of a business that uses HIVRA — if you messaged or called a business and an AI agent answered, that business decides why and how your data is used, and HIVRA processes it on the business’s behalf as a service provider. Requests about your data should go to that business first; you can also write to us and we will route them.
• Visitors to hivra.ai.

• Account data: the operator’s name, email and phone number.
• Business data: legal name, address, products and prices, hours, tone of voice, knowledge base, connected integrations and their credentials (stored encrypted).
• Contact data the business uploads or syncs: names, phone numbers, emails, lifecycle stage, purchase and booking history, tags.
• Messages, inbound and outbound, on every channel the business connects, including voice-note transcriptions and the images or documents a customer sends.
• Phone calls answered by the AI voice agent: the call audio is streamed to our speech vendor while the call lasts, and we keep a transcript and a written summary. We do not store the audio recording ourselves.
• Payment data: amounts, order references, and the name and email used at checkout. Card numbers go directly to Stripe or PixelPay and never reach HIVRA.
• Usage data on the dashboard: pages, clicks, settings changes, errors, browser and device type.
• Cookies: in the dashboard, a session cookie for sign-in and a language preference. On our public website (hivra.ai) we also keep a first-party record of how you reached us (the campaign tags, ad click ID, landing page and referring site, for up to 90 days) and use the Google Ads and Meta tags to measure our own ads. When you fill a form on our website, that record is saved with your request. None of this applies to the businesses’ customers or their messages, and you can manage it from Cookie preferences.

• To run the service: deliver messages, keep conversations going, book appointments, process payments, sync your integrations, send you alerts.
• To make the AI agent better for your business: the corrections you give it, the knowledge you teach it and the outcomes of its conversations tune how it answers your customers.
• To support you and tell you about changes to your account or the service.
• To keep the platform secure, prevent abuse and comply with the law.

AI training. We do not use one business’s customer conversations to build models for another business, and we do not sell conversation data. Our model providers process your data under commercial API terms that prohibit them from training their models on it.

Messages and calls to a business that uses HIVRA may be answered by an AI agent. The agent identifies itself as an AI assistant whenever asked and, in text conversations with US businesses, at the start of the conversation. A person at the business can take over any conversation or call at any time, and can pause the agent.

The agent does not make decisions with legal or similarly significant effects about you on its own. Bookings, payments and cancellations happen only on your request and are confirmed to you in writing.

• A business sends you SMS only after you opt in with that business (for example by checking a consent box on its form or by texting it first). Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time and HELP for help.
• SMS consent and mobile phone numbers are not shared with third parties or affiliates for marketing purposes.
• Calls to or from a business’s HIVRA number may be answered by an AI voice agent and may be transcribed for quality and to serve you. If you do not agree to being transcribed, hang up and message the business instead.
• A business may ask the AI agent to call you back after you request information. That call is placed only where you gave the business prior express consent to be called, and you can ask not to be called again.

HIVRA runs on third-party infrastructure. Each provider receives only what its function needs, under a contract that limits it to that function:

• AI model providers — message text (yours and your customers') to draft replies, classify intents, review replies, summarize conversations and search your knowledge base; the audio of WhatsApp voice notes, to transcribe them.
• Voice agent provider — live call audio (both directions), transcripts and the text spoken to callers; text-to-speech for voice replies.
• Conversation memory service — facts a customer stated (preferences, prior requests) so a returning customer is not asked twice.
• Meta Platforms (WhatsApp, Messenger, Instagram) — message delivery — phone numbers, message content, templates and call signalling for the channels you connect.
• Telephony and SMS carriers (US and Mexico) — phone numbers, SMS content, call audio and the one-time codes Meta sends to verify a number.
• Cloud hosting, database, storage and queue providers — everything we store, the request logs of hivra.ai, and short-lived copies of message ids and payloads while a message is being dispatched.
• Identity provider (operator sign-in) — the name, email and phone of the people who log in to the dashboard.
• Payment processors — your HIVRA subscription, and your customers' card payments through the processor you connect — amounts, order references and the customer's name and email. HIVRA never sees full card numbers.
• Google — Calendar (bookings and availability), Gmail (send-only, the emails you send from HIVRA) and, if you share one, a Sheet (your menu or catalogue). See the Limited Use statement below.
• The booking, e-commerce, accounting, CRM and point-of-sale systems you connect — only for businesses that connect them — catalogue, classes, appointments, orders, invoices and contact records are synchronized in both directions.
• Transactional email provider — booking confirmations to your customers and account email to you.
• Website reader — reads your public website during onboarding to draft your knowledge base.
• Product analytics — page views and clicks by operators on the dashboard, never your customers' messages.

The current list of providers behind each category is available on request at privacy@hivra.ai.

We also disclose data when the law requires it, to protect our rights or someone’s safety, and to a successor if HIVRA is acquired (this policy would continue to apply). We do not sell personal information and we do not share it for cross-context behavioral advertising.

HIVRA’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use the Google Calendar API only to book appointments and check availability for the businesses that connect a calendar.
• We use the Gmail API only to send email from the address a business connects — the messages that business sends to its own leads and customers from HIVRA (replies to an inquiry, a welcome email, a follow-up). HIVRA cannot read, search, modify or delete any email in that mailbox.
• Google user data is not transferred to third parties and is not used for advertising.
• Google user data is not used for any purpose other than providing these features to the business that connected its account, and is never used to develop, improve or train generalized AI or machine-learning models.
• Humans do not read Google user data except for security, to comply with the law, or with your explicit consent.
• The only Google scopes we request are calendar.events, calendar.freebusy and calendar.calendarlist.readonly (Calendar), and gmail.send (Gmail, send-only), plus your email address to show which account is connected. No access to reading Gmail, Drive or Contacts. A Google Sheet is read from the link you share with us, without signing in to Google.
• Disconnecting in HIVRA’s settings deletes the stored access token. Removing HIVRA from your Google Account’s third-party access page stops our access immediately.

• Data in transit is encrypted with TLS 1.2 or higher.
• Data at rest is encrypted (AES-256); integration credentials are additionally encrypted per tenant.
• Row-level security in the database keeps each business’s data separate from every other’s.
• Access to customer data is limited to authorized personnel, logged, and used only to support you.
• Operator sign-in uses OAuth 2.0 and industry-standard session tokens.
• Infrastructure is reviewed and vulnerability-scanned regularly.

We keep a business’s data while its subscription is active, and for 90 days after cancellation for accounting, tax and legal obligations. After those 90 days the business’s data is deleted from our active systems. Backups and security logs are overwritten in their normal cycle, at most a further 90 days.

Message and call transcripts belong to the business and follow that schedule. A business can ask us to delete an individual contact and their conversations at any time, or its whole account — see data deletion.

Wherever you are, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct inaccurate data;
• delete your account and the data associated with it;
• stop a particular use, where the law gives you that right.

Write to privacy@hivra.ai. We verify requests against the email or phone number on the account, answer within 30 days (45 days for California requests, with one extension if we tell you why), and never treat you differently for exercising a right. If you are a customer of a business that uses HIVRA, we will forward your request to that business and help it respond.

If you are a California resident, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.

• We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of; this sentence is our “Do Not Sell or Share My Personal Information” notice.
• Categories collected in the last 12 months: identifiers (name, phone, email), commercial information (orders, bookings), internet activity (dashboard usage), audio and electronic information (messages, call transcripts), and inferences the AI agent draws to answer you (preferences, intent). Sources: you, the business you contacted, and the integrations that business connected. Purposes and recipients: the sections above.
• Submit a request at privacy@hivra.ai with the subject “California privacy request”. An authorized agent may submit it for you with your signed permission. We respond within 45 days.
• When HIVRA acts for a business (its customers’ data), it does so as a service provider and uses the data only to provide the service to that business.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with consumer privacy laws have similar rights of access, correction, deletion and portability, and the right to opt out of targeted advertising, sale and profiling with significant effects — none of which we do. Use the same address above; if we decline a request you may appeal by replying to our answer, and we will respond to the appeal within 45 days.

HIVRA is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 13, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us data, write to us and we will delete it.

HIVRA is operated from the United States and its providers process data in the United States and in the regions those providers use. If you use HIVRA from another country, your data is transferred to the United States under this policy.

We will post changes here with a new “last updated” date and, for material changes, email the operators of every active account before they take effect.

MOUV USA LLC DBA HIVRA, New York, USA · privacy@hivra.ai.