Privacy Policy

Huli is operated by the owner of usehuli.com (“Huli”, “we”). It is a business tool: the person who connects a mailbox is our customer. Their customers, whose emails arrive in that mailbox, are not our users but their personal data passes through Huli, and this policy covers them too.

When you sign in with Google, we request two things separately.

• To sign you in — your email address, name, and Google account identifier (openid, email, profile). We do not read any mail with these.
• To work on a mailbox you connect — https://www.googleapis.com/auth/gmail.modify. This lets Huli read messages in that mailbox, send replies threaded to the original message, and add or remove labels to track what it has handled. It does not permit deleting mail, and Huli never does.

Connecting a mailbox is a separate, deliberate step from signing in. Signing in alone grants no access to any message.

Huli’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Gmail data is used only to provide and improve the user-facing features described in this policy — reading customer email, drafting replies, and sending them.
• We do not transfer Gmail data to others except as needed to provide those features, for security purposes, or to comply with applicable law.
• We do not use Gmail data for advertising, and we do not sell it.
• We do not allow humans to read Gmail data unless we have your explicit consent for specific messages, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymised.
• Gmail data is not used to train generalised artificial intelligence or machine learning models. It is sent to the AI providers listed below to generate a reply to that specific message, under agreements that prohibit training on it.

Huli keeps the following in its own database:

• Messages from the connected mailbox — sender, recipients, subject, body text, and the message headers needed to thread a reply correctly and to detect auto-replies and mailing lists.
• Replies Huli drafts, whether or not they were sent, along with the category, confidence score, and the rules that applied. Records of drafts that were not sent are kept deliberately: they are the audit trail of what the system decided and why.
• Past replies from the connected mailbox, converted into numerical embeddings, so drafts match the account's own writing. These are used only for the account they came from.
• Your Google account email and name, and the operator phone number you connect for approvals.
• Shopify order and customer information retrieved to answer a question, and a record of any change made to an order.

Photographs are never stored. When a customer attaches a photo to a damage claim, Huli fetches it from Gmail, holds it in memory long enough to assess it, and discards it. Only the written assessment is kept.

Google credentials and Shopify tokens are encrypted before they are written to the database.

Huli sends data to the following providers strictly to deliver the service. It is not sold, rented, or shared for advertising.

• Anthropic — message content is sent to classify it, draft a reply, and assess damage photos. Anthropic does not train on data submitted through its API.
• OpenAI — text is sent to generate embeddings used for retrieval. OpenAI does not train on data submitted through its API.
• Linq — the subject line, a short summary, and the proposed reply are texted to the operator’s phone for approval.
• Shopify — queried for order and customer records belonging to the connected store.
• Hetzner — hosts the application server and database.
• Vercel — hosts the dashboard.

We may also disclose data where required by law, or where necessary to investigate a security incident.

Email content, drafts, and audit records are retained for as long as the account is active, because they are what the system reasons from and what lets you reconstruct any decision it made. There is currently no automatic deletion schedule.

Disconnecting a mailbox stops all further access immediately. On request, we will delete the stored data for an account, and deleting an account removes its mail, drafts, embeddings, and audit records. Photographs are never retained at all.

Huli drafts replies automatically, and can send them without a human reading them first — but only where the account owner has switched automatic email on, cleared a specific category of message for it, and the draft has cleared its confidence threshold and the account’s rules. Off is the default.

Some categories can never be answered automatically regardless of settings, including refunds, cancellations, and damage claims. Those always go to a person.

• Revoke access at any time from your Google Account permissions page, or by disconnecting the mailbox in Huli under Mailboxes. Either takes effect immediately.
• Turn off automatic email in Settings, so every reply waits for your approval.
• Disconnect your phone in Settings to stop approval texts.
• Request a copy of, correction to, or deletion of your data by contacting us.

Depending on where you live, you may have additional rights over your personal data, including under the UK and EU GDPR and the CCPA. Contact us to exercise them and we will respond within the period the applicable law requires.

Credentials and API tokens are encrypted at rest. Traffic between the dashboard, the API, and every provider is encrypted in transit. Access to the production database is restricted to the operator. No system is perfectly secure, and we do not claim otherwise; if a breach affects your data we will notify you.

Huli is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

If this policy changes materially we will update the date at the top of this page and notify account owners by email before the change takes effect.

Questions, requests, or complaints: privacy@usehuli.com.