Privacy policy
What data Hilo processes, why, with whom, and your rights.
Last updated: October 19, 2026 · Español
1. Who is responsible
Hilo is a service by Camilo Gómez, an individual based in Colombia operating as SNC Designs ("Hilo", "we"). For any privacy matter, write to camilo@snc-designs.com.
2. Two different roles
- Your account data (you, your team, your studio): we are the controller.
- Your clients' data that you upload or receive in Hilo (messages, files, projects, contracts): you are the controller and Hilo acts as processor: we only process it to provide the service, under your instructions, and never sell it or use it for other purposes.
3. Data we process
- Account: name, email, photo, language, time zone, role and permissions.
- Work content: clients, projects, phases, chat messages, documents, files, approvals, contracts and meetings.
- Connected channels (if you connect them): WhatsApp Business messages and emails you forward to your Hilo address, with sender, subject and content.
- Integrations (if you connect them): from Google Drive, the list of your files (name, type, link, last edited date and who edited it) so you can search and pick them from Hilo, only if you grant that permission; if you also let Hilo view your files, the thumbnail Google generates for each one, only to show it to you while you pick, without storing it; and the Google Docs Hilo creates in the "Hilo" folder of your Drive when you send it a document; from Google Calendar, the meetings you create from Hilo; from Notion, only the pages you share with Hilo (title, icon, link and last edited date) and the pages Hilo creates in your Notion when you send it a document; from Zoom, the meetings you create from Hilo (topic, date, duration and link). Also the email of the Google or Zoom account, or the name of the Notion workspace, you connected.
- Kai (AI assistant): what you ask, its answers, drafts and what it "remembers" (preferences and working agreements; never passwords or payment data).
- Usage and security: trusted devices, sign-in dates, product usage events (without the text of your messages) and technical logs.
- Cookies: only those needed to keep you signed in, remember this device and your preferences (theme, text size, language). No advertising cookies.
4. Why we use it
- To provide Hilo: your client portal, the Inbox, notifications and the apps.
- So Kai can help you: reading the context of projects and conversations in your own workspace to prepare daily plans, summaries and drafts. Kai never sends anything to your clients without your approval on the topics you decide (price, scope, deadlines, complaints), and your clients' messages are treated as data, not as instructions.
- To send service emails and notifications (sign-in, alerts, daily plan, weekly summary).
- Security, abuse prevention, support and product improvement with aggregated metrics.
5. Artificial intelligence
Kai runs on Anthropic (Claude) models through their API. Under their commercial terms, content sent through the API is not used to train their models. We only send what each task needs, always within your workspace.
6. Who we share it with
We do not sell personal data. We use these providers (processors) to run the service: - Supabase (database, authentication and files; United States). - Vercel (web and API hosting; global network). - Anthropic (Kai's AI models; United States). - Resend (sending and receiving email; Brazil and United States). - Meta / WhatsApp Business Platform (only if you connect your WhatsApp). - Google (Drive and Calendar, only if you connect your Google account). - Notion (only if you connect your Notion workspace). - Zoom (only if you connect your Zoom account). - Apple (iPhone and Mac apps). We only share data with authorities when the law requires it.
Google, Notion and Zoom data. Hilo uses the data it receives from Google, Notion and Zoom only for the feature you asked for: showing and opening in Hilo the files and pages you linked, creating in your Notion and in the "Hilo" folder of your Google Drive the copies of the documents you send from Hilo (and updating them if you send them again), and creating, updating or cancelling in your Google Calendar the meetings you schedule from Hilo (with their Google Meet link and guests), and creating, updating or cancelling in your Zoom account the Zoom meetings you schedule from Hilo. From the content of your Drive files we only ask Google for its thumbnail to show it to you while you pick: we don't read, store or analyze it. We also don't read other Notion pages or other calendar events; we don't sell this data, we don't use it for advertising and we don't use it to train AI models. Access tokens are stored encrypted and you can revoke them at any time from Settings › Integrations or from your Google account. Hilo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Connector for AI assistants (MCP). If you want, you can connect your own AI assistant (Claude, ChatGPT or other MCP-compatible clients) to your Hilo workspace, with your permission via OAuth. The assistant sees and writes only what you can see in Hilo, and only what you authorized on the permission screen. Data is sent to your assistant only when you ask it to. Nothing is sent to a client without your approval in Hilo: what the assistant writes stays as a draft for you to review. You can disconnect it at any time from Settings › Integrations. Hilo logs which tool was used and when, without storing the content.
7. International transfers
Some providers are outside Colombia (mainly in the United States and Brazil). We use providers that offer adequate security and confidentiality safeguards, for the purposes described here.
8. How long we keep it
While your account is active. If you close it or ask us to delete your data, we delete it within 30 days; backups roll over within up to 30 additional days. We keep what the law requires (e.g. billing) only for the required time.
9. Your rights
Under Colombia's Law 1581 of 2012 (and equivalent laws where you live, such as the GDPR) you can access, update, correct and delete your data, withdraw your consent, ask for proof of it and file complaints with the Superintendencia de Industria y Comercio (SIC) or your local authority. Write to camilo@snc-designs.com: we answer requests within 10 business days and complaints within 15 business days. If you are a client of a studio that uses Hilo, you can contact the studio (controller) or us, and we will coordinate with them.
10. Security
Encryption in transit (HTTPS), per-workspace data isolation enforced in the database, encrypted channel credentials, email verification of new devices and an audit log of Kai's actions.
11. Children
Hilo is for professionals and businesses. It is not directed at anyone under 18.
12. Changes
If we change this policy in a meaningful way, we will notify you by email or inside Hilo before it applies.