Privacy Policy

Welcome to HMN.Plus (operated by Ramirez Holdings Limited, trading as hmn.plus, registered in Christchurch, New Zealand). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our AI-powered business automation platform (the "Service").

Who runs the deployment this policy describes

Almost always, us. The Service normally runs as a deployment we operate and maintain on your behalf, on infrastructure we chose and are answerable for. Unless you have been told otherwise in writing, that is what you have, and every clause below describes it: we hold the data, we set the retention, we engage the sub-processors in section 5. That deployment runs on Railway's infrastructure, in the region section 13 describes.

Enterprise customers can run it themselves instead. The Service is also available installed in the customer's own environment, on their own infrastructure. Where that is the arrangement, the picture changes in a way worth stating plainly rather than leaving in the small print:

• —The data stays in their environment. Connected-account data, execution records and produced files are held on infrastructure they control, and we do not hold a copy
• —The retention periods in section 11 are settings on their deployment, not periods we apply. Section 11 says what the software does by default; what it actually does there is what they set
• —The sub-processors in section 5 are the ones we engage — for this website, for billing, and for the deployments we operate. They are not automatically in the path of a customer's own installation
• —Their credentials never leave their deployment, and a deletion request is executed in their environment rather than ours

Everything about how the software behaves — what it accesses under each connection, what it never does with an AI model, what it writes into a record — is the same either way, and the clauses below describe it accurately in both cases. What differs is who holds the result. If you are not sure which you have, ask us; the answer is a fact about your account, not a matter of interpretation.

We collect information in the following categories:

2.1 Account Information

When you sign up, we collect your name, email address, and profile information provided by your OAuth provider (e.g. Google). If you sign up with email and password, we store a securely hashed version of your password.

2.2 Connected Account Data

When you connect third-party services via OAuth, we may access and process data from those services to power your automations. This includes:

• —Google Gmail: Email messages, labels, and metadata — to automate inbox workflows
• —Google Calendar: Events, schedules, and attendee information — to automate scheduling
• —Google Drive: Files and documents — to automate document workflows
• —Google Contacts: Contact names, email addresses, and organisation details — to automate outreach and CRM tasks
• —Meta lead ads (Facebook and Instagram): Lead form submissions, including the name, email address, phone number and any other fields your own lead form collects — to route and follow up new enquiries
• —Meta Page and Instagram messaging: Messages and conversation history in your Page inbox and Instagram Direct, and the display name and platform-scoped ID of the person who messaged you — to triage conversations and draft or send replies
• —Meta content publishing: Your Page and Instagram posts, captions, media, scheduling metadata and the public comments on them — to publish and respond to content you have approved
• —Meta advertising insights: Ad account, campaign and creative performance metrics, and the conversion events already recorded by your own Meta Pixel or dataset, read through the Meta APIs using the pixel ID you give us — to assemble the reports you have configured
• —Meta ad management: Where an automation you have built calls for it, we create, edit, activate and pause campaigns, ad sets, ads and audiences in your ad account, and set budgets — which means spending your money. Every automation is built or approved by you before it can run: the Service does not advertise, or spend, on its own initiative. What you choose per automation is how much of each run needs a person — some only draft changes for approval, some act within limits you set, and some run unattended once you have enabled them. You can revoke our access at any time
• —Meta WhatsApp Business messaging: Conversations on the WhatsApp Business number you connect — the messages sent and received, their history, and the display name and phone number of the person messaging you — to triage conversations and draft or send replies. Where an automation you have built calls for it, we also start conversations using the message templates your business has had approved
• —Meta WhatsApp Business account management: The WhatsApp Business account itself — the phone numbers registered to it, its business profile, its messaging limits and quality ratings, and its message templates — which we read, and which we create, edit, submit for approval and delete where an automation you have built calls for it
• —Meta product catalogs: Your catalogs and the product items in them — titles, descriptions, prices, availability, images, links and product identifiers — which we read, and which we create, update and delete where an automation you have built calls for it, including keeping them in step with product data held in another system you have connected
• —Meta Business Manager: Your business portfolio — the Pages, Instagram accounts, WhatsApp Business accounts, ad accounts, product catalogs, pixels and datasets it holds, and the people with access to them — read so that a connection can be pointed at the right asset, and, where an automation you have built calls for it, written to: creating and modifying business assets, and assigning access within your Business Manager
• —Xero accounting records: Contacts, invoices, bills, credit notes, payments and bank transactions — to reconcile, chase and report on your accounts. Where you configure an automation to do so, we also create and update contacts, invoices and bills on your behalf
• —Xero financial reports: Profit and loss, balance sheet, aged receivables and aged payables — to produce the summaries you have configured
• —Xero payroll: Employee names and contact details, pay rates, pay runs, leave balances and timesheets — to automate payroll administration. This is the most sensitive category of data the Service handles, and we access it only where you have connected payroll and configured an automation that needs it

We only access the data necessary to perform the automations you configure. You can review and revoke access to any connected service at any time through your account settings or directly through the third-party provider's security settings.

2.3 Business Information

During onboarding, we may analyse publicly available information from your website (e.g. company name, logo, brand colours, tagline) to personalise your workspace. This data is derived from public sources and is not collected from your private systems.

2.4 Usage Data

We collect information about how you interact with the Service, including pages visited, features used, workflow configurations, and performance metrics.

2.5 Device and Technical Data

We collect your IP address, browser type, operating system, device identifiers, and approximate location (country/region level, derived from IP) for security, analytics, and localisation purposes.

We use the information we collect to:

• —Provide, operate, and maintain the Service and your automations
• —Execute AI agent actions within your connected services on your behalf
• —Create, change and spend against advertising in your connected ad accounts, where you have configured an automation to do so
• —Send and reply to messages from your connected messaging accounts, including your WhatsApp Business number, where you have configured an automation to do so
• —Create, change and delete product catalog items, message templates and business assets in the business portfolio you connected, where you have configured an automation to do so
• —Personalise your workspace and onboarding experience
• —Process transactions and manage billing
• —Communicate with you, including for customer support and service notifications
• —Send marketing communications (with your consent; you can opt out at any time)
• —Detect and prevent fraud, abuse, and unauthorised access
• —Comply with legal obligations

The Service uses artificial intelligence to automate tasks on your behalf. It does so on your AI account, under your own agreement with the provider you chose. This section explains what that means, because it decides who is answerable for what.

• —Your key, your account, your bill: You register your own API credential with the AI provider you have chosen, and the Service uses that credential. Inference is billed by the provider directly to you. HMN.Plus does not resell inference, holds no credential of its own in the path, and does not control what that provider charges you.
• —Your AI provider is not our sub-processor: You engaged them, on your own terms, with your own account. They are your processor, and we pass data to them on your documented instruction as controller — not on ours. We hold no service agreement with any AI provider and are not a party to yours. The sub-processors we do engage are listed in section 5.
• —Three approved providers, commercial endpoints only: Anthropic, OpenAI and Google Gemini are the only AI providers approved for use with the Service, and data is sent only to those providers' commercial API endpoints. No other destination is approved — not a consumer or free tier, not a self-hosted or third-party-hosted model, not an intermediary or proxy service.
• —How AI processes your data: When you configure an automation, relevant data from your connected accounts (e.g. an email body, a calendar event, a document) is sent to your chosen provider to interpret, summarise, or act on it according to your instructions.
• —No training, fine-tuning, adaptation or enhancement: We do not use your data — or anything derived from it — to train, fine-tune, adapt or enhance any AI model. This applies to data in raw and in processed form, and to model outputs generated from it. Your data is used solely for real-time inference to deliver the automation you configured.
• —Data minimisation: We send only the minimum data necessary to complete each task. We do not send your entire inbox or drive contents to an AI provider — only the specific items relevant to the automation being executed.
• —If a provider fails, nothing moves without your say-so: Where you have registered more than one AI credential, the Service can retry a failed call on another of your providers rather than letting the automation fail. That is off unless you turn it on. With it off, the provider you chose for an automation is the only one that ever sees its data. Turning it on is you deciding in advance that a second provider you have also registered may receive the same request — so the choice stays yours, made once instead of per failure.
• —HMN.Plus is a conduit, not a decision-maker: We do not hold the relationship with your AI provider and we do not stand between you and them commercially. Which provider processes a given automation is your decision — the one you chose for it, or, where you enabled the retry above, one of the others you registered. We move your data to a destination you configured and bring the result back.

What happens at the provider is governed by your agreement, not this policy

Once your data reaches the provider you chose, what they may do with it — how long they keep it, whether it is retained for abuse monitoring, whether any setting on your account permits them to improve their models with it — is governed by your agreement with them and the settings on your account. This policy cannot bind them and does not claim to. Read their terms, and check what your own account is opted into. Section 4 of our Terms of Service sets out what you warrant to us about that account.

These are the sub-processors we engage — the ones we chose, contracted with, and are answerable to you for: for this website, for billing, and for the deployments we operate. If you run the Service in your own environment under an enterprise arrangement (section 1), your installation's infrastructure is yours and these are not automatically in its path. We maintain data processing agreements with our infrastructure and payment providers. Your AI provider is not on this list, and the sub-heading below the table explains why.

Your AI provider is not one of our sub-processors

A sub-processor is a party we engage to process your data on our behalf. Your AI provider is not one. You hold the account, you registered the credential, you pay the bill, and your agreement is with them — so they are your processor, and we pass data to them on your instruction as controller.

That is why they have no row in the table above and no data processing agreement with us: not an omission, but the shape of the arrangement. Section 4 sets out the whole of it — which three providers are approved, what we undertake never to do with your data, and what is governed by your agreement rather than by this policy.

HMN.Plus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• —We only use Google user data to provide and improve the Service's features that are visible to you
• —We do not transfer Google user data to third parties except as necessary to provide the Service, as required by law, or with your explicit consent
• —We do not use Google user data for serving advertisements
• —We do not allow humans to read your Google user data unless: you give explicit consent, it is necessary for security purposes (e.g. investigating abuse), it is required by law, or the data is aggregated and anonymised for internal operations

Where you connect a Facebook Page, an Instagram account, a WhatsApp Business account, a lead ads form, a product catalog, an ad account or a Business Manager business portfolio, HMN.Plus's use and transfer of the information we receive adheres to the Meta Platform Terms and the Meta Developer Policies. Information we obtain through the Meta APIs is called "Platform Data" below. Specifically:

• —We use Platform Data only to operate the automations you have configured, and only for features that are visible to you
• —We do not sell, license or rent Platform Data, and we do not transfer it to data brokers, advertising networks, or any service that monetises data
• —We do not use Platform Data for our own advertising, to build profiles of the people who contact you, or to make or inform decisions about anyone's eligibility for employment, housing, credit, insurance, or a government benefit
• —Where an automation you configure manages your advertising, it acts on your ad account, under the permissions you granted and any limits you set, for your campaigns. We do not move budget between accounts, do not run ads for anyone but you, and never use your ad account, your audiences or your Platform Data to advertise HMN.Plus
• —The same holds for every other asset an automation can write to. Catalog items, message templates, phone number settings and business assets are created, changed or removed only inside the business portfolio you connected, and only where an automation you built calls for it. We do not move assets between business portfolios, do not grant ourselves or anyone else access you did not configure, and do not use your catalogs or your WhatsApp Business account to reach anyone on our own behalf
• —We do not use Platform Data to train, fine-tune, or improve AI models. Platform Data is passed to the AI provider you have selected only as needed to execute the automation you configured, and only the minimum required for that task — see section 4
• —We do not allow humans to read Platform Data unless: you give explicit consent, it is necessary for security purposes (e.g. investigating abuse), or it is required by law
• —When you disconnect a Meta account, or delete your HMN.Plus account, we delete the Platform Data cached for it. See section 11 and our user data deletion instructions.

Every WhatsApp message is sent by you, not by us

An automation that messages on WhatsApp sends from your business number, to a person who gave your business permission to message them. The opt-in is yours to obtain and to hold a record of; the message templates are approved against your business; and what is sent is governed by the WhatsApp Business Messaging Policy. We keep no contact list of our own, never message anyone from your number on our own behalf, and never carry a phone number out of your WhatsApp Business account into another business's.

Our Meta Pixel, and yours, are different things

Our pixel is the one described in section 15. It sits on the hmn.plus website, records that a visitor to our own marketing pages took an action, and exists so that we can measure our own advertising. We never place it on your website, and it never sees your customers.

Your pixel is yours. You create it in your own Meta account and you install it on your own site. We do not create one for you, do not host one, and do not add any code to your website. Where an automation you configure reports on conversions, we read the events your pixel has already recorded, through the Meta APIs, using the pixel ID you give us. Those events are Platform Data, and everything in this section governs them: never used for our own advertising, not sold, not used to train models, and never combined with the website analytics described in section 15. Where an automation you configure acts on them, it does so in your ad account and for your campaigns.

Where you connect a Xero organisation, we access it under the OAuth scopes you approve on Xero's own consent screen, and our use of what we receive adheres to the Xero Developer Platform Terms and Conditions and the Xero App Partner requirements. Specifically:

• —We access your Xero data only to operate the automations you have configured. We request the narrowest set of scopes those automations need, and you approve them before any access begins
• —We do not sell, license or rent your Xero data, and we do not transfer it to data brokers, credit reference agencies, advertising networks, or any service that monetises data
• —We do not use your Xero data for advertising, credit scoring, or benchmarking against other customers
• —Never used to train, fine-tune, adapt or enhance an AI model. Those are Xero's four words and we undertake all four. Xero defines API Data as anything accessed, received, transmitted or generated through its APIs, in raw or processed form — so the undertaking covers not only what Xero returns but everything derived from it: extractions, summaries, categorisations, embeddings and model outputs. All of it carries the same restriction, permanently, with no expiry when the connection ends
• —Where Xero data may be sent. Xero's terms prohibit passing API Data to another third party without the user's consent. The only third parties that receive it are the sub-processors named in section 5 and, when an automation you configured requires it, the AI provider you registered — which can only be Anthropic, OpenAI or Google Gemini, on that provider's commercial API endpoint. Xero data is never sent to an unapproved provider or an unapproved endpoint, and you approve this arrangement when you connect the organisation and register your AI credential
• —Security incidents. If we discover unauthorised access to Xero data, we notify Xero at api@support.xero.com immediately and in any event within 24 hours of discovery, as clause 15 of the Xero Developer Platform Terms requires, with a description of the incident and our plan to contain and mitigate it — and we use our best efforts to resolve it. You are notified in parallel, under section 12
• —Payroll: where you connect payroll, we access employee records, pay rates, leave and timesheets only to run the payroll automation you configured. This data is never used for any other purpose, is never shared beyond the sub-processors named in section 5, and never reaches an advertising or analytics system of any kind
• —Where an automation writes to your Xero organisation — creating or updating a contact, an invoice or a bill — it does so only within the workflow you configured, and every change is attributed to the HMN.Plus connection in your Xero history
• —When you disconnect the Xero connection, or delete your HMN.Plus account, we delete the Xero data cached for it and destroy the stored tokens. Xero data that has been written into an execution record or a file an automation produced is covered by the retention periods in section 11, and a deletion request reaches those too — see section 11 and our deletion instructions

When you use the Service to automate workflows involving your own customers, employees, contacts, or other third parties ("End-User Data"), the following applies:

• —You are the data controller: You determine what End-User Data is processed through the Service and for what purpose. HMN.Plus acts as a data processor, processing End-User Data solely on your instructions and to deliver the Service.
• —Your responsibility: You are responsible for ensuring that you have a lawful basis to process End-User Data (e.g. consent, legitimate interest, contractual necessity) and that your own privacy practices comply with applicable laws. You should not process End-User Data through the Service in ways that violate your obligations to those individuals.
• —What we may process: End-User Data may include names, email addresses, phone numbers, message content, calendar availability, document contents, and other information present in your connected accounts. We do not independently collect End-User Data — it enters the Service only through your connected accounts and automations.
• —How we handle it: End-User Data receives the same protections as your own data: encrypted in transit and at rest, never used to train, fine-tune, adapt or enhance any AI model — in raw or processed form, and including anything derived from it — not sold, and not retained beyond what is necessary to execute your automations.
• —AI processing of End-User Data: When an automation processes End-User Data (e.g. summarising an email from one of your customers), that data may be sent to the AI provider you registered, on your account and your credential, under section 4. Because that account is yours, you are the one who can answer for it to the individuals concerned — including whether it is on the provider's commercial terms and whether any setting on it permits the provider to improve its models with what you send. Section 4 of the Terms of Service is where you warrant both to us.
• —Deletion: When you delete your account or disconnect an integration, all End-User Data associated with your automations is deleted in accordance with the retention periods described in this policy.

If you require a formal Data Processing Agreement (DPA) for compliance purposes, please contact us at hello@hmn.plus.

We do not sell, trade, or rent your personal information. We share your data only in the following circumstances:

• —Sub-processors: As described in Section 5, to operate the Service
• —Your own AI provider: On your instruction, using the credential you registered — see Section 4. This is not a disclosure we choose to make; it is your data reaching an account that is already yours, and it is limited to the three approved providers on their commercial API endpoints
• —Legal requirements: When required by law, regulation, legal process, or enforceable governmental request
• —Protection of rights: To protect the rights, property, or safety of HMN.Plus, our users, or the public
• —Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you
• —With your consent: When you explicitly authorise sharing with a specific third party

This is a system built to remember what it did. An automation that acted on your business six years ago is a record you may need, so the default is to keep the execution history rather than to expire it. That is a deliberate choice, and it means the honest answer to "how long do you keep this?" is longer than most policies give:

• —Account data: Retained while your agreement with us is active, and for 30 days after it ends so that you can take an export
• —Execution records: Retained for 10 years while your agreement is active. Every automation run writes a record — which workflow ran, when, which step, whether it succeeded, and a summary of what went in and what came out. Those summaries can contain connected-account content — the subject of an email, a line from an invoice, the text of a message — because a record that cannot show what was acted on cannot be audited
• —Files an automation produced or delivered: Retained indefinitely by default while your agreement is active. A report, a document, an export, and the record of which file was sent to which recipient on which date are kept unless you delete them. This is the layer that answers "what exactly did we send that client?" years later
• —Step output captured for debugging: 14 days, then swept
• —Connected-account data outside those records: Fetched to execute a step and not kept as a separate store. What persists of it is what the execution record and any produced file contain, above
• —Billing records: Retained as required by applicable tax and accounting laws
• —Security and audit logs: Retained on the same terms as execution records
• —Usage and analytics data: Retained in aggregated, anonymised form indefinitely

When your agreement ends, all of it goes

The 10-year and indefinite periods above apply only while your agreement with us is active. When it ends, or your subscription ends, we keep your data for 30 days so that you can take an export, and then delete it — execution records and produced files included — unless the law requires us to keep something longer.

These are defaults, and they are yours to shorten

The 10-year window is a configurable retention period, not a fixed property of the system. If your own policy is seven years, or three, tell us and it is set to that for your deployment — every layer above follows the one setting. Where you run the Service in your own environment, it is yours to set directly.

Deletion overrides all of it

The periods above describe what we keep while you are a customer and have not asked otherwise. They are not a floor. A deletion request under our user data deletion instructions reaches the execution records and the produced files as well as the account itself, and is completed within 30 days. The same applies when you disconnect a single service: we delete what we cached from it and destroy that connection's tokens, and where you ask us to, the execution history that carries its data goes with it.

Where we are legally required to retain something — billing and tax records — we keep that and nothing more, for no longer than the law requires.

We implement appropriate technical and organisational security measures, including:

• —Encryption of data in transit (TLS) and at rest (AES-256)
• —OAuth tokens and API credentials are encrypted before storage
• —Access controls and audit logging for internal systems
• —Regular security reviews of our infrastructure and dependencies
• —Backups of every deployment we operate: weekly backups by our hosting provider, and a separate monthly backup of our own that includes stored files. Backups are kept for at least 90 days

If something goes wrong, you hear it from us. If we discover unauthorised access to your data, we will notify you without undue delay, with what we know: what was reached, when, what we have done to contain it, and what you may need to do. Where the data reached came from a connected platform, we notify that platform on the timetable its terms require — for Xero that is within 24 hours of discovery, under section 8 — and notifying them is never a reason to tell you later. Where the law requires a regulator to be notified, we do that too.

No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

HMN.Plus is operated from New Zealand, and the deployments we operate are hosted outside it.

• —Your deployment: Where we operate your deployment, it runs on Railway's infrastructure, in Railway's default region. Another region or another hosting provider is available on request, and where you have agreed one with us, your agreement sets it out
• —This website: hmn.plus is hosted by Vercel, which serves it from locations around the world, including the United States
• —Services you connect: Google, Meta, Xero and the other services you connect process your data where they operate, under their own terms
• —Your AI provider: The provider you registered processes what an automation sends it in the jurisdictions where it operates, under your agreement with them — see section 4, and review their privacy policy
• —Your own environment: Where you run the Service in your own environment, you choose where it sits, and only the connected-service and AI-provider points above apply

Railway and our other sub-processors (section 5) hold personal information on our behalf and only to provide the Service. Under the New Zealand Privacy Act 2020 we remain responsible for it wherever it is stored, and we protect those transfers with data processing agreements that include standard contractual clauses or equivalent protections. Where we disclose personal information to a party overseas that is not acting for us, we do so only as Information Privacy Principle 12 permits.

Depending on your location, you may have the following rights regarding your personal data:

• —The right to access your personal data
• —The right to rectify inaccurate or incomplete data
• —The right to request deletion of your data
• —The right to restrict or object to processing
• —The right to data portability
• —The right to withdraw consent at any time
• —The right to disconnect third-party integrations and revoke data access

To exercise any of these rights, contact us at hello@hmn.plus. We will respond within 30 days.

We use cookies and similar technologies for authentication, preferences, and analytics. Essential cookies (session tokens, language/currency preferences) are required for the Service to function. Analytics and advertising cookies (Google Tag Manager, Meta Pixel) help us understand how visitors use this website and measure our own advertising, and are only set with your consent where required by law. You can control cookie preferences through your browser settings.

These technologies operate on the hmn.plus website only. They are separate from the data we receive from any account you connect to the Service: nothing from a connected Google, Meta or Xero account is ever passed to an analytics or advertising tool, and no cookie described here has access to it. See sections 6, 7 and 8.

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a notice on the Service at least 30 days before they take effect. We will always update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

A signed agreement keeps the version it names. A signed client agreement names the version of this policy it incorporates, by its "Last updated" date. A later version applies to that agreement only if the client agrees to it in writing.