Privacy Policy

1. Introduction

Squad as a Service SL ("we", "us", or "our") operates Hilo. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR).

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, and authentication credentials
• Payment Information: Processed securely through Stripe (we do not store card details)
• Profile Information: Any additional information you choose to provide
• Support Communications: Messages you send to our support team
• Conversations and uploads: Messages, voice recordings, images and files you send to Hilo, role instructions and chosen avatars
• Hilo Notes: Meeting recordings, transcripts, participant information, summaries and sharing preferences when you use Notes

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent on the Service
• Device Information: IP address, browser type, operating system
• App identifiers: Account and device identifiers and notification tokens used for authentication, synchronization and message delivery
• Log Data: Server logs including access times and errors
• Cookies: Session cookies for authentication and preferences

2.3 Bot Instance Data

• Server Metrics: VPS status, resource usage, uptime
• Configuration Data: Channel connections, bot settings
• Provisioning Events: Installation progress, health checks

3. How We Use Your Information

We use the collected information for the following purposes:

• Providing and maintaining the Service
• Processing your subscription and payments
• Provisioning and managing your bot instances
• Sending service updates and notifications
• Providing customer support
• Improving and optimizing the Service
• Detecting and preventing fraud or abuse
• Complying with legal obligations

4. Third-Party Services

We use the following third-party services to operate Hilo:

5. Data Storage and Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest
• Access controls and authentication
• Regular security audits and updates
• Data backup and disaster recovery procedures
• Staff training on data protection

Your bot instances run in isolated VPS environments. We do not access your bot data except for technical support purposes with your explicit consent.

6. Data Retention

We retain information while your account is active or as needed to provide the Service. Subscription cancellation, signing out and uninstalling the app are distinct from requesting whole-account deletion. A deletion request covers account content, Notes and provider-held copies; active-data removal and backup cleanup are separate steps. Limited billing, security and deletion-audit records may remain for legal obligations, fraud prevention and preventing deleted data from being recreated. See the account deletion page for how to request deletion, check its status and ask about any retained records.

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to certain data processing activities
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at help@hilo.cx. We will respond within 30 days.

8. Cookies and Tracking

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication and service functionality
• Preference Cookies: Remember your settings (e.g., theme preference)
• Analytics: Understand how you use the Service. Older native app versions may include account-linked Clarity analytics; Clarity is disabled starting with iOS and Android version 1.4.2. Browser cookie controls do not control native SDK collection.

You can control cookies through your browser settings. Note that disabling essential cookies may affect Service functionality.

9. International Data Transfers

Your data is primarily processed and stored within the European Union (Hetzner servers). When we transfer data outside the EU, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

10. Children's Privacy

Our Service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The "Last updated" date at the top indicates when the policy was last revised.

12. Contact Us

For questions about this Privacy Policy or to exercise your data protection rights, contact us: