1. Who we are and this policy
HVM is a product of Vamberic Studio Ltd (company number 17480014), registered at Park Bridge Farm, Isington, Alton, Hants, GU34 4PL, United Kingdom. This policy covers h-v-m.net and the HVM application, including connected services. For questions about personal information or to make a rights request, contact hello@h-v-m.net.
We act as controller for our own website, account administration, enquiries and service security. When a client places contact records, documents or communications in its workspace and determines their use, the client normally acts as controller and we process that information on its instructions. The client’s privacy notice and our applicable data-processing agreement also matter.
2. Information we handle
Depending on the features you use, HVM handles account and business contact details; workspace memberships and permissions; company and contact records; lifecycle and contact preferences; uploaded documents and assets; research sources; company, product, audience and offer profiles; Brand Kit settings; conversations with Henry; generated drafts; approvals and activity history.
Information comes from you, authorised workspace users, client imports, connected services and public sources used for requested research. Public availability does not remove a person’s data-protection rights. Hosting and authentication services also process technical request, sign-in and security information.
Do not upload information you are not entitled to use. HVM is a business service and is not intended for children or for submitting special-category personal information.
3. Why we use information
We use information to provide the features you request, maintain accounts, support users, protect the service and meet legal obligations. For our controller activities, the basis is performance of a contract with an individual account holder where applicable; legitimate interests in operating and securing a business service and responding to business enquiries; or compliance with a legal obligation. Where consent is required, we request it and you can withdraw it.
Clients must establish their own lawful basis for contact research, profiling and communications, respect objections and meet applicable marketing rules. Authorising a mailbox connection is not permission to contact every person in it.
Account and authentication information is needed to provide access. Optional uploads and integrations are your choice; declining them limits the associated feature. AI recommendations support human decisions and are not intended to make solely automated decisions with legal or similarly significant effects on individuals.
4. Google and Gmail connections
You choose the Google account to connect and authorise access on Google’s consent screen. HVM requests permission to send email and read messages. Google’s read permission can technically cover the mailbox; HVM’s current connection feature retrieves messages within conversations it starts, rather than importing your historical inbox.
The current feature supports controlled connection-test emails and displaying their replies. It stores the connected email address, connection status, scope and sync information, message and thread identifiers, message headers and bounded reply text. OAuth credentials are held in AWS Secrets Manager; reply records are stored in the workspace database. Google handles sending and retrieval. The current Gmail connection path does not send fetched replies to an AI model.
Disconnecting stops this workspace’s use of the connection and removes its usable credential reference. Credential deletion is scheduled with a seven-day recovery window. Disconnecting does not delete previously stored messages or activity records. Contact us to request their deletion. You can also revoke HVM’s access through your Google Account connections; this may affect other HVM connections using the same Google account.
HVM’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google-derived information is not sold or used for advertising targeting, data brokerage or general-purpose model training. Human access is limited to your explicit agreement for specific data or the security and legal exceptions permitted by that policy. New uses require appropriate disclosure and authorisation before they are introduced.
5. AI-assisted features
When you request generation or a conversation with Henry, relevant workspace context, your instructions, selected source material and approved brand guidance may be sent to OpenAI to produce a result. The information used depends on the task. Do not submit unnecessary personal or confidential information.
Generated content can be incomplete or incorrect. Drafts and suggestions are distinct from approved records. Review material facts and permissions before relying on, approving or distributing a result. The Gmail connection described above is separate from these generation functions.
7. Retention and deletion
We keep active workspace records while needed to provide the client’s service and follow its lawful instructions. We review retention when a workspace closes or a deletion request is received, taking account of the information’s sensitivity, continuing purpose, outstanding disputes and legal obligations. We do not set one expiry date for every type of record. Removing a connection, archiving a record and deleting a record have different effects. Audit history and backups may be retained separately from active records; a screen deletion should not be taken as proof that every historical copy has immediately disappeared.
Contact us for deletion or export requests, including stored Gmail replies. Where we act for a client, we may need to refer the request to that client or obtain its instructions. We may need to retain limited information for legal obligations or to establish, exercise or defend legal claims.
8. Security and international processing
HVM uses authenticated access, workspace permission checks and separate secret storage. No online service can guarantee absolute security. Keep your account credentials secure and report suspected unauthorised access promptly.
Our suppliers may process information outside your country. The location and applicable safeguards depend on the service and contract. You can contact us for details of the arrangements relevant to your workspace.
9. Website storage and external links
The current marketing website does not include advertising pixels or analytics scripts. Its fonts are hosted locally. Enquiry buttons open your email application; the site does not submit an enquiry form. Hosting still processes requests needed to deliver the pages.
The HVM application uses browser session storage and authentication services to maintain sign-in. Google and other linked services have their own storage practices and privacy notices. Visiting a link takes you to that provider.
10. Your rights and complaints
Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal information, object to processing, or withdraw consent without affecting earlier lawful processing. You can object to use of your information for direct marketing. Rights are subject to applicable legal conditions.
To make a request, contact hello@h-v-m.net. We may need information to verify your identity and locate the relevant records. We respond within the timescales required by applicable law, normally one month; we will explain any permitted extension. You can complain to the UK Information Commissioner’s Office or your relevant supervisory authority. You do not have to contact us first.
11. Changes to this policy
We update this notice when our practices change and show the revision date above. Material changes will be communicated appropriately. A new use of Google data will not be introduced solely by silently changing this page.