Privacy Policy

Last updated: 2026-05-28

This Privacy Policy explains what personal data HiveActs ("we") collects when you use HiveActs (the "Service"), why we collect it, who we share it with, and what your rights are.

1. Data we collect

• Account data — when you sign in with Google we receive your name, email address, and Google account avatar URL. We also store the role assigned to you within your company tenant and an encrypted Google refresh token used to access files you explicitly create in the Service.
• Google Drive / Docs content — we operate under the per-file drive.file OAuth scope: HiveActs can only see Google Docs and folders that HiveActs itself created (when you upload a .docx contract or generate a draft), or that you have explicitly shared with HiveActs via the in-app picker. We cannot read or list any other files in your Drive.
• Customer Data — the contracts, templates, playbook rules, counterparties, comments, chat messages, and signature images you and your colleagues upload or create inside your tenant.
• AI usage logs — for each AI request we log the model used, token counts, computed cost, action type (analyze / chat / generate / sign), tenant id, and user id. We do not log the prompt or AI response in our database.
• Audit logs — actions you take in the Service (e.g. uploading a contract, running an analysis, signing) are recorded with a timestamp and your user id, so administrators of your tenant can review who did what.
• Technical logs — IP address, user agent, and timestamps of requests are processed in transit by Google Cloud Run; we don't persist them in our database. Cloud Run retains server logs for up to 30 days by default.

2. Why we process this data

• To authenticate you and protect your account.
• To deliver the Service: store and retrieve contracts, run AI analysis you request, generate documents, apply signatures.
• To bill or meter usage (currently free of charge).
• To debug, monitor, and improve the Service.
• To comply with legal obligations.

Legal bases (GDPR, where applicable): performance of a contract (delivering the Service to your organisation), legitimate interests (security, abuse prevention), and consent (only for optional features you explicitly opt in to, e.g. connecting Dropbox).

3. Subprocessors

We route Customer Data through the following subprocessors solely to deliver the Service. We have data-processing terms in place with each of them where applicable.

Anthropic processes prompts inside the U.S. and, per their commercial terms, does not train its general-purpose models on API customer data. Excerpts of your contracts are sent to Anthropic only when you explicitly trigger an analysis, chat, or generation action.

3a. Google user data — who receives what

When you connect a Google account, HiveActs obtains a limited OAuth token (drive.file plus your email and profile name). The table below states exactly what we do with the data we receive from Google APIs, and which subprocessors above receive any portion of it:

We do not sell, rent, lend, advertise on, or use for human review any data we receive from Google Workspace APIs, except for users you have explicitly authorised inside your tenant. We do not train AI/ML models on Google user data, and our subprocessors are contractually prohibited from doing so.

3b. Limited Use — Google API Services User Data Policy

HiveActs' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Where data is stored

Primary application data resides in European Union (Belgium / Cloud Run europe-west1, Supabase EU). If you connect Google Drive or Dropbox, the documents themselves live in your own Google or Dropbox account in the region you have configured with that vendor.

5. How long we keep data

• Soft-deleted contracts — kept in the trash for 30 days, then permanently removed (a database job handles this).
• AI usage logs — kept indefinitely for accounting purposes; anonymised after 24 months if you close your account.
• Audit logs — kept indefinitely while your tenant is active; deleted with the tenant on closure.
• Closed accounts — Customer Data is retained for up to 90 days post-closure to allow restoration, then permanently deleted unless we are legally required to retain it (e.g. tax law).

6. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data. You can exercise these rights by emailing legal@hiveacts.com from the email address associated with your account. We will respond within 30 days.

EU/UK residents may also lodge a complaint with their national data protection authority.

7. Security

• All connections to the Service use HTTPS (TLS 1.2+).
• Google refresh tokens are encrypted at rest with AES-256-GCM.
• Database access is gated by row-level security keyed on tenant membership.
• We rely on Google Cloud and Supabase for physical security and underlying infrastructure controls (ISO 27001 / SOC 2 attested).
• If we ever discover a personal-data breach affecting you, we will notify you and the relevant authority within 72 hours, as required by applicable law.

8. Cookies

We use a small number of strictly-necessary cookies: a session cookie for authentication, a theme-preference cookie (light/dark), an active tenant cookie that scopes API calls to the right company. We don't use third-party advertising or analytics cookies.

9. Children

The Service is not intended for individuals under 16. We do not knowingly collect data from anyone under that age.

10. Changes

If we update this policy, we'll change the "Last updated" date above and notify active users by email or in-product banner.

11. Contact

Privacy / data requests: legal@hiveacts.com.