Privacy Policy

Personal Information

We may collect personal information that you voluntarily provide to us when you:

• Register for an account
• Use our AI automation services
• Contact us for support
• Subscribe to our newsletter
• Participate in surveys or promotions

Automatically Collected Information

We automatically collect certain information when you visit our platform:

• IP address and location data
• Browser type and version
• Operating system
• Usage patterns and preferences
• Device information

Harmona AI allows users to optionally connect their Google (Gmail, Google Calendar, Google Drive) and Microsoft (Outlook) accounts to enable AI-powered email, calendar and document assistants and automations. These integrations are entirely optional and are only activated when a user explicitly chooses to create such an agent. When connected, our platform requests the following permissions (OAuth scopes) via secure OAuth 2.0 flows.

Google User Data

Harmona lets you sign in with Google and, separately, connect your own Google account so that your AI assistants and automations can work with your mail, calendar and files on your behalf. This section explains exactly which Google user data Harmona accesses, how it is used, stored and shared, and how you can revoke access.

What we access

Harmona requests only the scopes needed for the feature you turn on, and asks for each of them at the moment you enable that feature:

How we use it

Google user data is used solely to perform the tasks you ask for: answering your questions, drafting or sending messages you request, keeping a dashboard widget you created up to date, or running an automation you configured (for example a morning e-mail digest). Harmona does not read your mailbox, calendar or files for any other purpose, does not use Google user data for advertising, and does not sell it.

How we store it

• Access tokens. When you connect a Google account we store the OAuth refresh and access tokens Google issues in our database, hosted on Amazon Web Services, so that we can act on your behalf without asking you to sign in again. They are used only to call Google APIs for you.
• Content. Mail, calendar and file content is normally processed in memory while your request is served and is not stored afterwards. Some content is retained because you asked us to keep it: the parts an assistant quotes in a conversation are kept in that conversation's history; a dashboard widget keeps the latest result it displayed; an automation run keeps its log; and when you connect a Google Drive folder as a document source, we extract the text of those files and store it, together with search indexes, so your assistants can search it. This retained content is deleted when you delete the conversation, widget, automation or document source, when you remove the Google account from Harmona, or when your Harmona account is deleted.

Who we share it with

We share Google user data only with the service providers that we need to run Harmona, and only to the extent needed for the task you requested:

• AI model providers (OpenAI, Anthropic and Google) receive the portion of content needed to generate a response, under agreements that prohibit them from using it to train their models.
• Hosting (Amazon Web Services) stores our database and files.

We do not share Google user data with any other third party, do not allow humans to read it except with your explicit consent for support, for security or abuse investigation, or where required by law, and we never transfer it for advertising, market research or resale.

AI / machine-learning models

Harmona does not use data obtained through Google Workspace APIs (Gmail, Google Calendar, Google Drive) to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models. Google user data is used only to serve you, the user who granted access.

Limited Use disclosure

Harmona's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access and deleting your data

You can stop Harmona's access at any time:

• remove the Google account from the Integrations page in Harmona, or
• revoke Harmona under your Google Account's third-party access settings.

Either action stops all further access. To have the stored tokens and any retained Google content deleted, delete the related conversations, widgets and document sources, delete your Harmona account, or write to privacy@harmona.ai and we will delete them within 30 days.

Microsoft (Outlook) Data Access

When a user enables an Outlook-connected agent, Harmona AI requests access to the following Microsoft user data through the Microsoft Graph API via OAuth 2.0:

This data is used solely to perform the AI agent tasks requested by the user. We do not use Microsoft user data for advertising purposes or to train AI/ML models. Microsoft user data is not shared with third parties except as strictly necessary to operate the service and as described in this policy.

We use the information we collect for various purposes, including:

• Providing and maintaining our AI automation services
• Processing transactions and managing user accounts
• Improving and personalizing user experience
• Communicating with you about updates, security alerts, and support
• Analyzing usage patterns to enhance our platform
• Complying with legal obligations and protecting our rights
• Developing new features and services

We do not sell, trade, or otherwise transfer your personal information to outside parties except in the following circumstances:

Service Providers

We may share your information with trusted third-party service providers who assist us in operating our platform, conducting business, or servicing you, as long as they agree to keep this information confidential.

Marketing and Communication Partners

We may process and share your personal data for marketing and communication purposes, including:

• Sending you emails about our products, services, updates, campaigns, and events, via Hubspot or d-engage,
• Contacting you by phone to request feedback about our services or to inform you about new products or features,
• Sending SMS messages for notifications, campaigns, or product announcements when appropriate,
• Providing targeted advertising and remarketing through online advertising networks and platforms such as Google, Meta (including Facebook and Instagram), TikTok, LinkedIn and similar marketing channels,
• Creating custom or lookalike audiences and running targeted ads within the advertising networks of these platforms, in accordance with their own privacy and data protection policies.

Where required by applicable law, we will only use your personal data for direct marketing purposes based on your prior consent, and you may withdraw your consent or opt out of such communications at any time by following the unsubscribe instructions in our messages or by contacting us.

These third parties are only permitted to use your personal information as necessary to provide marketing, analytics, or communication services to us and are required to protect your information in accordance with applicable data protection laws and our instructions.

Legal Requirements

We may disclose your information when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation,
• Protect and defend our rights or property,
• Prevent or investigate possible wrongdoing,
• Protect the personal safety of users or the public.

We implement robust security measures to protect your personal information:

• End-to-end encryption for data transmission
• Secure data storage with industry-standard encryption
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Employee training on data protection best practices

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using industry best practices.

If you are a resident of the European Economic Area (EEA), you have certain data protection rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Request restriction of processing your personal data
• Right to Data Portability: Request transfer of your data to another service
• Right to Object: Object to our processing of your personal data

To exercise these rights, please contact us at privacy@harmona.ai. We will respond to your request within 30 days.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

When we no longer need your personal information, we will securely delete or anonymize it in accordance with our data retention policies and applicable legal requirements.

8. International Data Transfers

Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ.

We ensure that such transfers are made in accordance with applicable data protection laws and include appropriate safeguards to protect your personal information.

9. Children's Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from children under 13. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us immediately.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.