Data Processing Terms

1Roles

Your business is responsible for the data it keeps about people in Hemlo. Hemlo processes it on your behalf and on your instructions only, for one purpose: providing the service.

2Your commitments

• Have a lawful reason or consent to collect and keep people’s data.
• Have consent to contact them. Ordinary WhatsApp reminders in Hemlo are sent from your own phone and account. With Hemlo Connect, Hemlo sends messages on your behalf from your business’s WhatsApp Business number: offers go only to people who agreed to them, a “stop” is honoured automatically, and you follow WhatsApp’s Business policies.
• For dental clinics: health data is sensitive; get the patient’s consent and keep professional confidentiality.
• Give each staff member only the access they need, and remove access when someone leaves.
• Don’t publish an owner’s or tenant’s personal details on public property pages.

3Our commitments

• Process the data only to provide the service, for no other purpose.
• Keep each business’s data isolated from every other.
• Apply the security measures described in the Privacy Policy.
• Bind our team to confidentiality, and log every admin access.
• Never sell the data, or share it except with the providers listed below.
• Tell you without delay (within 72 hours of confirming it) of any breach affecting your business’s data, with what we know and what we have done.
• Help you answer people’s requests about their data.
• Let you export the data at any time, and delete it when the business closes.

4Sub-processors

• Cloudflare: hosting, file storage, and some AI models.
• Neon: the database.
• Resend: email.
• The AI provider chosen for each job: receives only what that job needs, and only when you use that feature.

We’ll announce any new provider on this page before it handles business data.

5Public pages

Property listings you choose to publish (hemlohq.com/p/ links) are public by design and anyone can open them. Only the facts you choose are published.

6When the relationship ends

You can export all your data at any time, even after the subscription ends. When you ask to close, we delete the data within 90 days, except what the law requires us to keep.