1What this policy covers
It applies to hemlohq.com, your Hemlo account, Hemlo Systems and Tools. We have two roles in it:
- Your account and business details at Hemlo: we are responsible for them.
- The data your business enters about its customers, patients, members and clients: the business is responsible for it, and we process it on its behalf, as set out in the Data Processing Terms.
2What we collect
- Account: name, email, phone number, your passkey’s public key (we never see your private key), and sign-in records (time, device type, IP address).
- Business: name, city, type, staff and their roles, plan and payments.
- Early-access requests: name, business name, phone, city, email.
- What you enter: products, sales, invoices, customers, members, patients and visits, properties, contracts, and the photos and files you upload.
- Hemlo Connect (when a business switches it on): the WhatsApp messages between the business and its customers, customers’ numbers and WhatsApp profile names, delivery and read status, and viewing requests the assistant records.
- Inquiries from Hemlo Website sites: the name, phone and message a visitor sends to the business.
- Usage: which features are used, errors, and how often AI is used, to run and improve Hemlo.
- Messages you send us.
3What we don’t do
- We don’t sell your data.
- We don’t show ads or use tracking cookies.
- We don’t use your business’s content to train AI models.
4Why we use it
- To provide and run the services you asked for.
- For security, fraud prevention and protecting accounts.
- For billing and activating plans.
- For support and replying to you.
- To improve Hemlo, using totals that don’t reveal any one business.
- To comply with the law.
5Who processes data with us
We use trusted providers to run Hemlo; their servers may be outside Iraq:
- Cloudflare: hosting, file storage, and some AI models.
- Neon: the database.
- Resend: email (sign-in codes and invitations).
- The AI providers we choose for a given job (such as Google, Anthropic or OpenAI, directly or through OpenRouter, and Groq): we send them only what that job needs, such as the invoice photo.
- Payment providers (such as FIB and ZainCash) when you pay through them.
- Meta (the WhatsApp Business Platform): to send and receive WhatsApp messages when a business switches on Hemlo Connect. Messages pass through Meta’s servers under its policies.
We don’t share your data with anyone else unless the law requires it.
6How long we keep it
- Account data: while the account exists; removed within 30 days of deletion.
- Business data: while the business exists; deleted within 90 days of a request to close it.
- Payment records: as long as the law requires.
- Security and sign-in logs: up to 12 months.
- Demo: deleted within 24 hours. The Connect demo on hemlohq.com doesn’t keep what you type.
- Connect conversations: while the business is subscribed; deleted with its data when it closes.
- Backups rotate out automatically within 30 days.
7How we protect it
- All connections are encrypted (HTTPS), and storage is encrypted at our providers.
- Each business’s data is isolated inside the database itself, so no business can see another’s.
- Hemlo’s team signs in to the admin dashboard with passkeys only, and everything it does is logged.
- AI providers’ keys are stored encrypted.
- Nobody on our team looks at your business’s data except to support you, fix a problem, or when the law requires.
8Your rights
You can ask for a copy of your data, or ask us to correct, export or delete it, or object to a particular use of it. Write to hello@hemlohq.com and we’ll reply within 30 days.
If your data is held by a business that uses Hemlo (for example, you are a patient at a clinic or a member of a gym), contact that business first, as it is responsible for it; we’ll help it answer you.
If you get WhatsApp messages from a business that uses Hemlo Connect, send “stop” (or “إيقاف”) in that chat and you won’t get automatic messages from it again.
9Children
Our services are for adults (18 and over). Businesses may keep minors’ data (such as a gym member or a patient) under their own responsibility and with a guardian’s consent.
10Cookies
We use only what is needed to sign you in. Details in Cookies.
11Changes
We may update this policy and will publish each update with its date, telling you about important changes in advance.
12Contact
For any privacy question, write to hello@hemlohq.com.
A question about these terms?
Write to hello@hemlohq.com and we’ll reply within two working days.