Privacy Policy
Last updated: 2026-09-16 · Effective date: 2026-05-11
Hivium is operated by Quantum Hive LLC, a limited liability company incorporated in the State of Florida, United States. This policy explains what data we collect, how we use it, with whom we share it, how long we retain it, and what rights you have.
1. Data We Collect
When you use Hivium we collect:
- Account information: email, name, password hash, UI preferences, organization / workspace.
- Usage data: pages visited, actions, timestamps, session identifiers, IP address, user agent (audit log).
- Conversations: inbound/outbound messages via connected channels (WhatsApp and the channels you connect), including text content and metadata (phone numbers, timestamps).
- Integration messages: Hivium, WhatsApp Business / Evolution API, Slack — all data that enters through integrations you explicitly connect.
- Knowledge base: documents you upload (PDFs, URLs, text) and vector embeddings generated from those documents.
- Billing: legal name, address, payment method (processed by Stripe, Mercado Pago or Wompi — we do not store card numbers).
- LLM telemetry: prompts, responses, costs, latency (internal anti-abuse and cost-guardrail auditing).
2. How We Use Your Data
- Provide the service (process messages, generate AI responses, index the knowledge base).
- Collect subscription payments (via Stripe, Mercado Pago or Wompi).
- Send transactional emails (welcome, invites, billing, security alerts).
- Detect abuse, fraud, and Terms violations.
- Improve the product using aggregated analytics.
- Comply with legal obligations (taxes, records, valid subpoenas).
We do NOT sell your data. We do NOT share data with third parties for advertising. We do NOT train AI models on the content of your conversations or your knowledge base.
3. Data Shared with Providers (Sub-processors)
To operate the service we share limited data with:
- Supabase — database hosting and authentication (AWS us-east-2).
- OpenRouter — routes calls to third-party AI models (e.g. Anthropic, OpenAI) under their terms.
- OpenAI — embeddings for the knowledge base (USA).
- Stripe, Mercado Pago and Wompi — payment processing.
- Resend — transactional email delivery.
- Sentry — error tracking (optional, scrubbed for PII).
- Meta Platforms — Facebook, Instagram, Meta Ads, catalogs and WhatsApp Business Cloud API, only when you connect those integrations (see “Meta Platform Data”).
- Hostinger — servers (VPS) that run the application.
- PostHog — product analytics (EU region).
- Langfuse — AI model call tracing, self-hosted on our servers.
- Evolution API — WhatsApp connection, self-hosted on our servers.
Only if you use the related feature: GoHighLevel / LeadConnector (CRM), Wavoip, LiveKit, Cartesia, ElevenLabs and Deepgram (voice), Twilio (SMS), Cohere (search), Fal and Replicate (image and video), Mercado Libre, Shopify, Google (Analytics and YouTube), TikTok, Slack and Telegram (integrations), Inngest (scheduled jobs), Vercel (store and file hosting) and Cloudflare (DNS). Crisp is our support chat.
Meta Platform Data
When you connect Facebook, Instagram, Meta Ads, Meta catalogs or WhatsApp Business (Cloud API) to Hivium, we receive data from Meta only for the assets you authorize. We request these permissions, each for the purpose shown:
pages_show_list: list the Facebook Pages you manage so you can choose which one to connect.pages_read_engagement: read posts and engagement metrics of the connected Page.pages_manage_posts: publish to the Page the content you schedule in Hivium.instagram_basic: read the profile and media of the connected Instagram professional account.instagram_content_publish: publish to Instagram the content you schedule in Hivium.business_management: identify the Business Manager assets (Pages, ad accounts, catalogs) you choose to connect.ads_read: read campaigns and metrics from your ad accounts to show you reports.ads_management: create and edit campaigns in your ad accounts when you approve it.ads_mcp_management: operate your ad accounts through Meta's ads connector, with your approval.catalog_management: create and update your store product catalogs on Meta.whatsapp_business_management: subscribe your WhatsApp Business number (Cloud API) to our webhooks so you can receive and reply to your customers’ messages.
Data we may receive: Page and Instagram account identifiers, names and profile details; posts, media and engagement metrics; ad account, campaign and performance data; catalog and product data; WhatsApp Business phone number identifiers and the messages exchanged with your customers; and the access tokens Meta issues to us.
We do not sell Meta Platform Data. We use it only to provide the features you enable, and access tokens are stored encrypted.
Retention: we keep Meta Platform Data while the connection is active. When you disconnect the integration in Hivium, or remove Hivium in Facebook, we stop using its access token.
Data deletion instructions: /legal/data-deletion.
Revoking access: go to Facebook → Settings & privacy → Settings → Business integrations (or Apps and websites), select Hivium and remove it. You can also disconnect the integration from your Hivium settings.
Deleting your data: You can request deletion of your data by writing to hivium@proton.me or via /legal/data-deletion; we process it as soon as possible.
4. Your Rights
4.1 GDPR (EU / UK Residents)
You have the right to:
- Access: view all data we hold about you.
- Rectification: correct inaccurate data.
- Erasure (“right to be forgotten”): delete your account and data.
- Portability: export your data in JSON format.
- Objection: stop processing under certain circumstances.
- Restriction: limit processing while a dispute is being resolved.
- Non-discrimination: we cannot discriminate against you for exercising these rights.
To exercise any right: legal@hivium.app or use our privacy request form. We respond within ≤30 days.
4.2 CCPA / CPRA (California Residents)
Under the California Consumer Privacy Act you have the right to:
- Know what categories of personal data we collect and how we use them (all disclosed above).
- Access your specific data from the preceding 12 months.
- Delete your data.
- Correct inaccurate data.
- Opt-out of sale / sharing: We do NOT sell your personal data. Nor do we share it within the meaning of CPRA with third parties for cross-context behavioral advertising. If this were to change, we would add a “Do Not Sell or Share My Personal Information” link in the footer.
- Limit use of sensitive information (SSN, financial credentials, communications content).
- Non-discrimination for exercising these rights.
To exercise a CCPA right: legal@hivium.app or use our privacy form (DSR endpoint). We respond within ≤45 days. We verify the request by requiring it to be submitted from your account email.
4.3 Other US States (Texas, Colorado, Virginia, Connecticut, etc.)
If you are a resident of a US state with a state privacy law (Texas Data Privacy and Security Act, Colorado Privacy Act, Virginia CDPA, Connecticut CTDPA, etc.) you have rights analogous to those under CCPA: access, correction, deletion, portability, and opt-out of sales / targeted advertising. We apply the same process for all.
4.4 Other Jurisdictions
Argentina (Law 25.326), Mexico (LFPDPPP), Brazil (LGPD), and others: we apply the same principles of access, rectification, deletion, and portability. Contact us.
5. Minors
Hivium is not directed at persons under 18 years of age. We do not knowingly collect data from minors. If you discover that a minor created an account, contact us and we will delete it.
In compliance with state laws such as Texas HB 18 (SCOPE Act) and similar, we do not serve features involving profiling or advertising targeting to minors. If a client integrates Hivium in a context involving minors, that client is responsible for obtaining applicable parental consent and configuring appropriate disclosures.
6. Retention
- Active account data: while you have an account. You can request deletion of your data by writing to hivium@proton.me or via /legal/data-deletion; we process it as soon as possible.
- Backups: rotated under the infrastructure provider’s policy.
- Audit log: 24 months. Operational logs: between 30 and 180 days depending on the type.
- Billing data: as long as tax law requires.
- Integration conversations: while the integration is active. If you disconnect it, we revoke the connection and stop using its token. Deletion is requested through the privacy request form or through Meta’s data deletion request.
7. Security
- Encryption in transit (TLS 1.2 or higher) and at rest, through the infrastructure provider’s encryption.
- Third-party API keys encrypted with AES-GCM in our database.
- Row-Level Security workspace-scoped on all multi-tenant tables.
- Immutable audit log of sensitive actions.
Note: Hivium does not currently hold formal external certifications. The architecture is designed for regular audits (compliance roadmap Q4 2026) and we communicate progress on the status page as concrete milestones are reached.
To report a vulnerability: security@hivium.app.
8. International Transfers
We process data in the USA (AWS us-east-2 via Supabase). For transfers of EU/UK data, the European Commission Standard Contractual Clauses (SCCs) apply.
9. Changes to This Policy
We will notify you by email or in-product of any material changes at least 30 days in advance. Non-material changes (typos, clarifications, broken links) are published without notice.
10. Contact
For any privacy inquiries, to exercise your rights, or to report an incident: legal@hivium.app.
Quantum Hive LLC
4855 W Hillsboro Blvd, B3
Coconut Creek, FL 33073
United States
Last updated: 2026-09-16. We may update this policy; we will notify you via email or in-product.