Privacy Policy: Hureka AI

1. Information we collect

a. Account & organization information

When you register, we collect your name, email address, and a securely hashed password (or your identity provider details if you sign in with a third party), along with your organization name, role, team membership, and billing/plan information.

b. Google user data

Connecting a Google account is optional and always initiated by you. Two connections are offered, each requesting only the scopes it needs:

Gmail. Grants https://www.googleapis.com/auth/gmail.modify plus openid, userinfo.email, and userinfo.profile. Using these, Hureka accesses:

• Gmail messages in the connected mailbox (sender/recipient/subject headers, plain-text and HTML message bodies, snippets, attachments, thread IDs, and Gmail labels) in order to read the incoming email the assistant is asked to handle.
• The ability to send, reply to, label, and mark messages as read in that mailbox, in order to respond and to keep the inbox organized (a label marks what has already been handled so the same message is never processed twice).
• Your Google account profile (email address, display name, and Google account identifier), solely to identify the connected mailbox.

A Gmail connection may be made by an organization for a shared support mailbox, or by an individual user for their own mailbox (the Personal Assistant and sales outreach features). In both cases access is limited to the single mailbox connected.

Google Calendar. A separate, optional connection that grants https://www.googleapis.com/auth/calendar and https://www.googleapis.com/auth/calendar.events. Using these, Hureka accesses:

• The list of calendars on the connected account (name and identifier only) so that you can choose which calendars Hureka may use.
• Events on the calendars you select (title, description, start and end times, time zone, location, organizer, and attendee email addresses and RSVP status) in order to detect meetings and prepare briefs and follow-ups around them. Hureka subscribes to change notifications for the selected calendars so new and updated events are picked up.
• The ability to create, update, and cancel events and their guest lists on the calendars you select, in order to schedule the meetings and webinars you set up in Hureka and to keep their invitee lists current.

We do not access Google Drive, Contacts (People API), or any Google data outside the scopes listed above.

c. Customer & contact data you process

In the course of providing the Service, we process the content of the support conversations your organization handles, including the email addresses, names, and message content of the customers who contact you, and any information they include in their messages. Your organization is the controller of this data; Hureka processes it on your behalf to operate the Service.

d. Usage & technical data

We collect standard log and device information such as IP address, browser type, pages viewed, and timestamps, which we use for security, troubleshooting, and improving the Service.

e. Cookies

We use strictly necessary cookies to keep you signed in and to secure your session. We do not use advertising or cross-site tracking cookies.

2. How we use information

We use the information above to: provide and operate the Service (reading inbound emails, classifying their intent/topic/sentiment, drafting and, where you allow, sending replies, threading conversations, and organizing the mailbox with labels; detecting meetings on the calendars you select and creating or updating the events you schedule from Hureka); authenticate you and secure your account; provide support; communicate service and account notices; comply with legal obligations; and maintain and improve the Service.

Hureka’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not sell or transfer it except as necessary to provide or improve the Service, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.

AI/ML model training. We do not use Google Workspace APIs data, including Gmail message content and Google Calendar event data, to develop, improve, or train generalized or standalone AI/ML models, and we do not transfer it to any third party for that purpose. The AI providers your organization configures process this content only to return a classification or a draft for that request, under API terms that exclude training on submitted data. Any exemplar retained to improve your organization’s own future responses stays inside your organization’s private knowledge base and is never used to train a model shared with anyone else.

Human review. Drafts are reviewed by your own organization’s staff in the approval queue. That is the point of the product. Hureka personnel do not read your Google user data except with your explicit consent (for example, when you ask us to investigate a support issue), where necessary to protect the security and integrity of the Service, or where required by law.

3. How we share information

We do not sell your personal information. We share it only with service providers (subprocessors) that help us run the Service, and only for the purposes described here:

• AI / LLM providers (e.g. Anthropic, OpenAI, Google, Groq): the content of a message is transmitted to the provider your organization configures, for the sole purpose of generating a classification or response, under each provider’s enterprise/API terms (these providers do not train on data submitted via their APIs).
• Observability: if you enable it, prompts and responses may be logged to our self-hosted LangFuse instance for debugging and quality monitoring.
• Knowledge base: anonymized, PII-redacted exemplars may be added to your private knowledge base to improve your organization’s future responses.
• Infrastructure: cloud hosting, database, and storage providers that run our systems under confidentiality obligations.
• Legal & safety: where required by law, or to protect the rights, safety, and security of Hureka, our users, or the public; and in connection with a merger, acquisition, or sale of assets, subject to this Policy.

4. How we store and protect data

Data is stored in our PostgreSQL database. OAuth tokens and provider credentials are encrypted at rest using AES-256-GCM with per-organization keys. All data in transit is protected with TLS (HTTPS). Hureka is multi-tenant: every record is scoped to an organization and isolated using PostgreSQL Row-Level Security so one organization can never access another’s data. Access to production systems is restricted to authorized personnel. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard safeguards.

5. Data retention and deletion

We retain personal data and Google user data only as long as your account/organization remains active and the relevant integration is connected, or as needed to comply with legal obligations. You can revoke Hureka’s access to your Google account at any time from Google Account → Security → Third-party access, or by disconnecting the Gmail or Google Calendar connection in Hureka. Deleting your organization permanently and irreversibly removes all associated messages, contacts, conversations, and credentials. To request access to, correction of, or deletion of your data, contact us at contact@hurekatek.com and we will action it within 30 days.

6. International data transfers

Your information may be processed in countries other than your own. Where we transfer personal data across borders, we use appropriate safeguards (such as standard contractual clauses) consistent with applicable law.

7. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA/UK (GDPR) and California (CCPA/CPRA) have these rights and the right to be free from discrimination for exercising them. To make a request, email contact@hurekatek.com. If Hureka processes data on behalf of your organization, we will direct your request to that organization as the controller.

8. Children’s privacy

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

9. Third-party links

The Service may link to third-party sites or services that we do not control. Their privacy practices are governed by their own policies, and we encourage you to review them.

10. Changes to this Policy

We may update this Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide additional notice within the Service or by email.

11. Contact us

If you have questions about this Policy or our data practices, contact us at contact@hurekatek.com (Hurekatek).