Privacy policy

This Privacy Policy applies to havby.com, the Havby workspace at app.havby.com, Havby for macOS, Havby for mobile, and the Havby API and developer portal (together, the "Services"). It does not apply to third-party services that you connect to Havby, which are governed by their own privacy policies.

Havby provides the Services to organizations ("Customers"). When we process content that a Customer or its users place in a Havby workspace ("Customer Data"), we act as a service provider or processor on behalf of that Customer and in accordance with our agreement with them. The Customer determines what goes into its workspaces and who may access them.

For account, billing, website and support information, Havby acts as the controller and this Privacy Policy describes how that information is handled.

Information you provide to us

• Account information. Your name, email address, organization, role and sign-in history.

• Workspace content. Messages, threads, direct messages, files, briefs and the tasks on your board.

• Communications. Invite requests, support requests and other correspondence you send us.

Information from connected services

• Connections. When you connect a service to an agent, currently Gmail, Google Calendar, Google Contacts, Google Drive, Google Docs, Google Sheets, Google Slides, GitHub and the web, we or our integration provider Composio store the credentials or tokens for that connection and the information the service returns when an agent uses it. Browser passwords you provide to an agent are stored encrypted under a key specific to your organization.

Information generated by the Services

• Activity records ("receipts"). A record of each action an agent takes, including what it did, when, through which connection, the reasoning it gave, and who approved it where approval was required.

• Billing information. Seats, agents, hours drawn from your allowance and additional hours purchased. Payment card details are collected and processed directly by Stripe. We do not receive or store full card numbers.

• Usage and device information. IP address, browser and application version, pages and screens used, errors and crash reports.

Website visits and traffic source

• Visit counts. When you view a page on havby.com we record the date, the page path and the origin of the site that referred you, for example https://www.google.com. Our own count does not store your IP address, does not set cookies and does not build a device fingerprint. Separately, we use Google Analytics on havby.com (see Cookies and similar technologies below), which receives your visit as described there.

• Traffic source on invite requests. If you request an invite, we also store the utm_source, utm_medium and utm_campaign values from the link you arrived on and the origin of the referring site, so we can tell which channel brought the request. They are held in your browser session storage until you close the tab.

• Your signal is respected. If your browser sends Do Not Track or Global Privacy Control, our own visit count records no visit and captures no traffic source. This does not apply to Google Analytics, which loads for all visitors. Our own visit count is not shared with any third party and is not used for advertising.

We use personal information to:

• provide, operate and maintain the Services, including the agents that act within them;

• process payments and manage billing;

• secure the Services and Customer workspaces, and detect and prevent fraud and abuse;

• respond to support requests;

• send service communications, such as sign-in codes, approval requests and receipts; and

• understand aggregate usage, such as which features are used and where errors occur, in order to improve the Services.

We do not access the contents of a workspace to improve the Services. We access workspace content only when you ask us to as part of a support request, or where necessary for security or legal reasons, and we log each such access.

An agent can use only the access you grant to it, set per connection for each team at No access, Can read, Can edit, Can act with your OK, or Can act on its own, and an agent can carry its own setting on top. An agent granted read access is not given a means to write. Information an agent reads through a connection is used to perform the task it was assigned and is retained only as part of your workspace and its receipts.

Unless an account is set to Can act on its own, actions that cannot be reversed, such as sending an email, making a payment or deleting data, require your OK from a person in your workspace before they are carried out. Changes to a connection or to an agent's access take effect from the agent's next action.

To perform a task, an agent sends the content needed for that task to an AI model. Every model request is routed through OpenRouter with provider data collection denied, so the model provider may not store the request for, or use it for, training. The providers that may serve a request are listed on our Sub-processors page.

We do not use Customer Data to train or fine-tune any model, whether our own or a third party's. The Data handling page describes the technical controls that enforce this.

When you send Havby a support request and it needs more than the first answer, the messages, the details you give us and the ticket history may be processed by AI agents on Havby’s own support team. They work in Havby’s own workspace, not in yours, and they draft, categorize and investigate. A person at Havby reviews and approves every reply that reaches you and every decision to close your ticket, and a reply written with AI help says so.

Requests to the AI models behind these agents are routed with provider data collection denied and no training on the content, as described above. What our support agents remember is kept separately for each customer organization and is not used for any other customer. It is kept for as long as the ticket it came from.

If you are located in the European Economic Area, the United Kingdom or Switzerland, we process personal information on the following legal bases: performance of our contract with you or your organization; our legitimate interests in securing and improving the Services; your consent, where we request it; and compliance with our legal obligations.

We do not sell personal information and we do not share it with advertisers. We disclose personal information only as follows:

• Service providers. To the sub-processors listed on our Sub-processors page, each for the purpose stated there.

• Within your organization. Members of a workspace can see the information that workspace's permissions allow, including receipts. Organization owners can view and manage all workspaces in their organization.

• At your direction. When an agent sends an email, posts a comment or submits a form on your behalf, the recipient receives the content the agent sent.

• Legal requirements. Where required by law. We notify the affected Customer before disclosure unless we are legally prohibited from doing so.

• Business transfers. If Havby is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction and will remain subject to this Privacy Policy until you are notified otherwise.

Havby hosts the Services on Google Cloud in Canada. Some of our sub-processors, including Stripe, Resend, OpenRouter and Composio, operate in the United States. Where personal information is transferred outside the jurisdiction in which it was collected, we rely on standard contractual clauses or an equivalent safeguard.

• Receipts. Retained for two years, then deleted.

• Deleted workspaces. When a workspace is deleted, it stops working immediately. Its underlying data is permanently deleted 45 days later.

• Account information. Retained while your account is active.

• Billing records. Retained for the period required by applicable tax and accounting laws.

• Usage and security logs. Retained for a limited period sufficient to investigate operational issues and abuse.

• Website visit counts. Kept as aggregate counts by date, page and referring site, with no link to you.

• Invite request traffic source. Kept with the invite request it belongs to.

• Support tickets and AI support work. Kept for the same period as the support ticket they belong to, including what AI agents on our support team recorded about it.

We encrypt data in transit using TLS 1.2 or higher and encrypt data at rest. Browser passwords are encrypted under a separate key for each organization. Havby personnel do not have standing access to Customer Data. The Security page describes how we isolate, encrypt and restrict access to data.

If a security incident affects your personal information, we will notify you without undue delay, describe what happened and explain the steps we have taken in response.

You may request a copy of your personal information or the deletion of your account by contacting hello@havby.com. Organization owners may delete a workspace directly within Havby. We respond to requests within 30 days.

Depending on where you live, you may also have the right to correct your personal information, restrict or object to its processing, receive it in a portable format, and withdraw any consent you have given. You may also lodge a complaint with your local data protection authority.

Where a request concerns Customer Data in an organization's workspace, we will refer it to that organization's owner and assist them in responding.

We use cookies to keep you signed in and to remember your preferences. We do not use advertising cookies or track you across third-party websites.

Our website uses Google Analytics (Google LLC), a web analytics service that sets first-party cookies such as _ga and _ga_G-4R42XWHHM5 on your device to distinguish visitors and sessions. Google receives your IP address, device and browser information, the pages you view and how you interact with them, and uses them to provide analytics reports to us. We do not use Google Analytics for advertising. Google Analytics loads for all visitors and does not currently honor Do Not Track or Global Privacy Control; you can block it with a browser extension or by clearing or blocking cookies, and Google offers an opt-out add-on at https://tools.google.com/dlpage/gaoptout. Apart from Google Analytics, the website uses browser storage in two places only: session storage, which holds the traffic source described above until you close the tab, and, once you have requested an invite, a note in local storage on your device that you already asked, so the form can say so; that note stays until you clear it.

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under California and other applicable US state privacy laws. The rights described in this Privacy Policy are available to you regardless of where you live.

The Services are not directed to individuals under 16, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under 16, we will delete it.

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. If we make a material change, we will notify you by email before it takes effect.

If you have questions about this Privacy Policy or our privacy practices, contact us at hello@havby.com. To report a security concern, contact security@havby.com.