Privacy Policy

1. Who We Are

Hamia Ltd (Hamia, we, us, or our) is a global technology company building AI-powered products for businesses, creators, and developers, including Hamia Agent, Hamia Studio, Hamia Manager, Hamia API, and Hamia Pay. This policy explains how we collect, use, and protect information across hamia.io and our products.

Our registered address is Plot 21, Ikota Road, Lekki, Lagos State, Nigeria.

2. What This Policy Covers

This policy covers hamia.io, our product dashboards, and Hamia Agent, Hamia Studio, Hamia Manager, and Hamia API (Hamia Pay is not yet live). It applies to visitors to our site, business owners and staff who use Hamia, and the customers who message a business through Hamia on that business's behalf.

3. Information We Collect

We collect information you provide directly to us, including:

• Account information, such as your name, email address, and sign in details
• Payment information, processed securely by our payment providers. We do not store full card numbers ourselves
• Communications you send to us directly, such as through our contact form

We also collect certain information automatically when you visit hamia.io, including your IP address, browser type, device information, and pages visited. Section 4 below covers two further categories in more detail: information a business provides about itself, and information exchanged in that business's customer conversations.

4. Business Data and Customer Communications

We treat these as two distinct categories, because they come from different places and belong to the business in different ways.

Business Data

Information the business itself provides to set up and run its AI assistant: its business profile, products, services, pricing, policies, opening hours, assistant name and voice, its knowledge base content, and any payment details it adds so it can receive payments from its own customers.

Customer Communications

When a business connects a channel (see section 7), Hamia processes the messages, attachments, contact information, conversation history, and related data sent through that channel, on the business's behalf. This is the business's own customer data, sent to Hamia so the business can serve its customers. Hamia does not own this data. See section 10, Data Ownership and Control.

5. How Hamia Uses Information

We use the information we collect to:

• Operate and improve Hamia Agent, Hamia Studio, Hamia Manager, Hamia API, and Hamia Pay
• Generate AI assistant responses from a business's own knowledge base, on that business's behalf
• Process payments and manage subscriptions
• Send account and service related communications
• Provide a business with analytics and reporting on its own conversations and performance
• Comply with legal obligations and protect our legal rights

6. AI Processing

Hamia uses a third-party AI model provider to generate a business's assistant responses. When a customer message needs a response, only the information necessary for that specific request is sent to the model provider, such as the relevant part of the business's knowledge base and recent conversation context, not a business's or customer's full account.

Hamia's current AI model provider is Anthropic, using its Claude models. Anthropic's commercial and API terms, which govern how Hamia uses Claude, contractually exclude customer data sent through the API from being used to train Anthropic's models. This is separate from Anthropic's own consumer product, which operates under different terms. If Hamia ever changes AI model providers, we will update this section to reflect the new provider and its terms, rather than treating this as a permanent promise that could become inaccurate later.

7. Connected Communication Platforms

A business can connect Hamia to WhatsApp, Instagram, Messenger, Telegram, LINE, Viber, website chat, and email, with phone and voice calling planned as a future capability.

For each channel a business connects, Hamia acts as a processor, a service provider carrying out that business's own communications on its behalf, not as an independent party collecting that data for itself. The underlying platforms (for example Meta for WhatsApp, Instagram, and Messenger) are covered further in section 9, but the more important point is this processor relationship: the conversation belongs to the business and its customer, and Hamia is the technology carrying it, not a party using it for its own purposes.

8. How We Share Information

We do not sell your personal information to third parties. We may share information with:

• Our AI model provider, as described in section 6
• The messaging and social platform providers behind each channel a business connects, to send and receive messages on that channel
• Payment processors, to handle billing and subscriptions
• Legal authorities when required by law or to protect our rights and the safety of our users

9. Third-Party Service Providers

Hamia relies on established third-party providers to deliver each connected channel and to process payments, including Meta for WhatsApp, Instagram, and Messenger, and Telegram, LINE, and Viber for their own respective platforms, along with Paystack and Flutterwave for payment processing. Each of these providers processes information under its own terms and privacy practices, alongside Hamia's own commitments in this policy.

10. Data Ownership and Control

The business owns its own customer relationships and data. Hamia provides the technology that processes communications on a business's behalf, we do not claim ownership of a business's customer data or conversations. A business controls what goes into its own knowledge base, decides which channels to connect, and can request export or deletion of its data, see section 16, Your Privacy Rights.

11. Data Isolation

Every business's data on Hamia is kept logically separate from every other business's data. This is a platform level requirement, enforced at the data layer and not only in our application code, so one business cannot access another business's information. This is a standing architecture requirement for how Hamia is built, not an optional safeguard added on top.

12. Data Retention and Deletion

Retention depends on the type of information, not one blanket rule:

• Account information: retained while your account is active, and deleted or anonymised within 90 days of closing it, except where we are required by law to retain it for longer
• Conversations: retained according to the connected business's own retention settings and policy
• Business Knowledge Base data (a business's products, pricing, policies, and FAQs): preserved through the 7 day grace period after a subscription lapses, so reactivating is instant, and deleted if the grace period ends without renewal
• AI-generated responses: retained as part of the conversation they belong to, under the same conversation retention above
• Connected platform access tokens: retained until the business disconnects that platform, then deleted
• Payment records: retained as required for accounting, tax, and other legal obligations
• Security logs and API logs: retained for a defined period, typically up to 12 months, to protect against abuse and support security investigations, then deleted

13. Security

We take reasonable technical and organisational measures to protect your information, including encrypting stored platform access tokens, hashing API keys, keeping each business's data isolated from every other business's, and enforcing role based access controls so only authorised people can reach a given business's data. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

14. International Data Transfers

Hamia operates globally, and the providers described in this policy may process information in countries other than your own. Where this happens, we apply appropriate safeguards consistent with applicable data protection laws in the regions where Hamia operates, including standard contractual protections where required.

15. Cookies and Analytics

We use cookies and similar technologies to operate hamia.io, remember your preferences, and analyse usage. You can control cookies through your browser settings. Disabling certain cookies may affect how the site functions.

We use Google reCAPTCHA to help protect our services from spam and abuse. reCAPTCHA collects hardware and software information, such as device and application data, and sends this data to Google for analysis. This is governed by Google's own Privacy Policy and Terms of Service.

16. Your Privacy Rights

Depending on applicable law in your region, including the GDPR for users in the EU and the CCPA for users in California, along with other applicable data protection laws in the regions where Hamia operates, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Object to or restrict how we process your information
• Request a portable copy of your data
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at privacy@hamia.io.

17. Business Customer Responsibilities

A business controls who on its own team can access its Hamia account and its customer data, through role based access: owner, admin, agent manager, developer, support, or viewer. Granting a staff member or an agency access to a business's account does not change Hamia's role as a processor described throughout this policy, the business remains responsible for who it grants access to, and for meeting its own obligations to its customers.

18. AI Discoverability and Visibility Opt-In

Separately from the AI processing described in section 6, a business may choose to opt into AI Discoverability, so customers can find it when they ask search engines or AI assistants like ChatGPT or Gemini for recommendations. Opting in means specific business information, such as its name, category, general offerings, and general location, becomes deliberately public and indexable by search engines and AI crawlers.

This is a materially different kind of exposure than the internal AI processing Hamia otherwise carries out on a business's behalf, so it is always its own clear, separate choice, never folded into general processing consent.

19. Children's Privacy

Hamia's products are not directed at children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at privacy@hamia.io so we can address it.

20. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a notice on hamia.io. Your continued use of Hamia after any changes means you accept the updated policy.

21. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at privacy@hamia.io, or write to us at our registered address.