Transparency First

1. Introduction

Support Hive AI Ltd ("we", "our", or "us") is committed to protecting your privacy through "Data Protection by Design." This policy outlines how we collect, use, and safeguard information in connection with our AI agents and related services (collectively, the "Service"). By using our Service, you acknowledge the practices described herein.

2. Information We Collect

We collect only the minimum data necessary to provide high-fidelity automated services:

• Account Information: Name, email, business credentials, and billing details.
• Voice & Communication Data: Real-time audio recordings and transcripts from inbound/outbound calls. Note: Voices are processed as biometric data for the sole purpose of speech-to-text conversion.
• Contextual Data: Messaging logs, email content, and metadata (timestamps, caller ID) used to maintain conversation "memory."
• Integration Data: Metadata and access tokens for third-party tools (e.g., Calendly, Salesforce).
• Google Account Data: When you connect your Google account via OAuth, we access the following:
  • Email Address & Profile (userinfo.email, userinfo.profile): Used solely to authenticate you into the SupportHive admin dashboard via Google sign-in.
  • Gmail — Send Only (gmail.send): Used to send transactional emails (order confirmations, reservation confirmations, receipts) to your customers on your behalf. We never read, search, modify, or delete your emails. We do not access your inbox, drafts, or any other Gmail data.
  • Google Calendar (calendar, calendar.events): Used to check your calendar availability and create reservation or appointment events on your behalf during live phone calls. We never delete your calendars. Access is limited to reading availability and creating/editing events.

3. How We Use Your Data

We process data under the lawful bases of Contractual Necessity and Legitimate Interests:

• AI Agency: Powering dynamic conversations and executing tasks (e.g., booking appointments).
• Service Improvement: We use de-identified and aggregated transcripts to improve AI accuracy. We do not use your specific business data to train foundational models for other clients.
• Automated Decision-Making: Our AI may make "Limited Risk" automated decisions (e.g., scheduling). You have the right to request human intervention for any decision with significant effects.
• Google Data Usage: Google account data is used exclusively for the purposes described in Section 2. Specifically:
  • Gmail send access is used only to deliver transactional emails to your customers.
  • Calendar access is used only to manage reservations and appointments.
  • Google data is never used for advertising, profiling, market research, or any purpose unrelated to delivering the Service.

4. Data Sharing & Sub-Processors

We do not sell your data. To deliver the Service, we share data with vetted sub-processors under strict Data Processing Agreements (DPAs):

• AI Intelligence: OpenAI, Deepgram, and ElevenLabs (Real-time inference only).
• Telephony: Twilio (Call routing and SMS).
• Infrastructure: AWS (Secure cloud hosting with AES-256 encryption).
• International Transfers: For data moving outside the UK/EEA (e.g., to US-based AI providers), we utilise the UK-US Data Bridge and Standard Contractual Clauses (SCCs) to ensure equivalent protection.

We do not transfer Google user data to third parties except as strictly necessary to provide the Service (e.g., sending an email via the Gmail API). We do not allow third parties to use your Google data independently.

5. Google API Services — Limited Use Disclosure

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google data for the purposes explicitly described in this policy.
• We do not transfer Google data to others unless necessary to provide or improve the Service, to comply with applicable laws, or as part of a merger/acquisition with equivalent privacy protections.
• We do not use Google data for serving advertisements.
• We do not allow humans to read your Google data unless: (a) you have given explicit consent, (b) it is necessary for security purposes (e.g., investigating abuse), (c) it is necessary to comply with applicable law, or (d) the data is aggregated and anonymised for internal operations.

6. Retention & Deletion

In accordance with the principle of Storage Limitation:

• Audio Recordings: Automatically deleted after 60 days unless a client specifies a shorter window.
• Transcripts: Retained for 12 months to facilitate service continuity and quality audits.
• Google OAuth Tokens: Retained only while your Google account is connected. Tokens are permanently deleted when you disconnect your Google account or delete your SupportHive account.
• Google Calendar & Gmail Data: We do not store copies of your emails or calendar events. Data is accessed in real-time via the Google API and is not cached or retained on our servers beyond the immediate transaction.
• User Rights: You may exercise your rights to Access, Rectification, Erasure, or Portability via the "Hive Control Centre" or by emailing privacy@supporthive.ai. We honour all requests within 30 days.
• Revoking Google Access: You can disconnect your Google account at any time from the SupportHive Integrations page, or directly from your Google Account Permissions. Upon disconnection, all stored tokens are immediately deleted.

7. Outbound Compliance (TCPA & FCC)

For outbound AI services, we maintain strict adherence to 2026 regulations:

• Explicit Consent: We require "Prior Express Written Consent" for all AI-generated outbound calls.
• Revocation (Opt-Out): We honour "STOP" or verbal opt-out requests across all channels within 10 business days.
• Identification: Our agents clearly identify themselves as "Artificial Intelligence" at the start of every call.

8. Security Measures

We implement industry-leading safeguards:

• Encryption: TLS 1.3 for data in transit; AES-256 for data at rest.
• Anonymization: Automated PII (Personally Identifiable Information) redaction tools can be enabled to scrub sensitive data from transcripts.
• Access Controls: Role-based permissions and multi-factor authentication for all platform access.
• Incident Response: We maintain a 72-hour breach notification protocol in compliance with UK GDPR Article 33.
• Google Token Security: OAuth tokens are stored encrypted and access is restricted to the application service layer only.

9. Contact Us

If you have questions about this Privacy Policy, your data, or how we use your Google account data, please get in touch: