Privacy Policy

1. Who is responsible

Haven Technologies Inc., a corporation organised under the laws of the State of Washington, United States, is the controller for the data described here. You can reach us at support@gongongai.com, by phone on +1 360-402-1932, or by post at 2103 Harrison Ave NW STE 1034, Olympia, WA 98502, United States.

For the content you upload and the audience data your connected networks return, you are the controller and we act as your processor. Our Data Processing Addendum covers that relationship.

2. What we collect

Five categories, and nothing beyond what the service needs:

• Account data — your name, email address, a hashed password or a federated identity, your workspace memberships and role, your language and timezone, and if you enable two-factor authentication, an encrypted secret and hashed recovery codes.
• Content data — posts, drafts and their version history, comments, uploaded media and its alt text, source material you paste or upload including transcripts, brand kits, writing-style profiles, prompt templates, and the inputs and outputs of every AI generation you run.
• Connected-network data — the profile, posts, metrics, comments, mentions, reviews and direct messages that the networks you connect return to us. Section 3 covers this separately, because much of it is about other people.
• Operational data — the IP address and browser or device details recorded when you sign in or use the mobile app, entries in our audit log, and short-lived records used for rate limiting and to make retried requests safe.
• Billing data — your plan, subscription state, credit balance and usage counters, plus the identifiers our payment processor gives us. We never receive or store card numbers; those are entered on the processor’s own pages.

3. People who are not our customers

When you connect a social account, the networks send us the public comments, mentions and reviews on your posts, and — where you grant that permission — your direct messages. Those items carry other people’s display names, handles, profile pictures and words.

We store them so your unified inbox works, score each one for sentiment so you can triage a busy queue, and include the message text when you ask us to draft a reply, which means it is sent to the model provider handling that request. We do not build profiles of these people beyond the conversation they are part of, we do not sell or share this data, and we do not use it for advertising.

Our lawful basis for holding it is legitimate interests — yours in managing your own audience, and ours in providing the service — balanced against the limited and expected nature of the processing: this is your own inbox, containing messages people chose to send you.

Two related cases. If you invite someone to a workspace, we hold their email address until the invitation is accepted or revoked. If you share a post for review by a link that needs no login, we store the reviewer’s comments labelled simply as a client reviewer, without their name.

This data lives inside your workspace and is deleted when you delete that workspace or your account.

4. Why we process it

• To provide the service you asked for, including publishing to the accounts you connect — performance of a contract.
• To keep the service secure, prevent abuse, enforce limits and diagnose failures — legitimate interests.
• To operate your unified inbox, which necessarily involves messages from other people — legitimate interests, as described in section 3.
• To send you service, security and billing email — performance of a contract. Marketing email only with your consent, withdrawable in one click.
• To meet tax, accounting and legal obligations — legal obligation.

5. AI processing

When you generate something, the prompt and the material it needs — which may include your drafts, your writing-style profile, your source text, and in the inbox, the message you are replying to — are sent to the model provider handling that request. They are sent to produce your output and for no other purpose.

Requests are not tagged with your identity: your workspace and trace identifiers are stripped at our boundary and never reach a provider.

We do not train any model of ours on your content, analytics or writing-style profiles, and we never pool them across customers. Each provider’s own handling of the inputs it receives is governed by that provider’s terms.

Text generation uses OpenAI first, then Anthropic, then Google’s Gemini API as an automatic fallback when the earlier providers are rate-limited or unavailable. All three process this material in the United States.

Our weekly learning loop looks at what your workspace published and how it performed, and updates that workspace’s own prompts and writing-style profile. It runs once a week and reads only within a single workspace. It never compares you to another customer.

A note on the word "voice": a voice profile here is a description of how you write — tone, vocabulary, words to avoid, sentence rhythm. It is not a voiceprint. We do not create voice biometrics, and we do not perform face recognition. Where you upload audio or video, we may transcribe it because you asked us to, and both the file and the transcript are your content.

6. Who else processes it

We use a small number of providers to run the service. Each is bound by a written agreement, receives only what its job requires, and may not use your data for its own purposes.

Separately from this list, you direct us to send your content to the social networks you connect, and to any webhook endpoint or automation you configure. Those are recipients of your choosing rather than providers of ours.

7. Cookies, and the trackers we do not run

We run no advertising networks, no third-party analytics, no session recording, and no cross-site tracking of any kind. There is no analytics tag, no advertising pixel and no data broker in this product. Our pages load no scripts and no fonts from anyone else’s domain — even our typefaces are served from ours — so no third party learns that you visited us.

That is why you have never seen a cookie banner here: every cookie we set is strictly necessary to run the service or a preference you set yourself, and neither requires consent.

We also store your theme choice in your browser’s local storage. It never leaves your device.

8. How we protect it

Specific measures rather than adjectives:

• Traffic is encrypted in transit with TLS, and browsers are instructed to refuse an unencrypted connection to us.
• Tokens for your connected social accounts, and two-factor secrets, are encrypted at rest with AES-256-GCM authenticated encryption, with versioned ciphertext so keys can be rotated without downtime.
• Passwords are hashed with Argon2id at the current OWASP baseline. API keys and session tokens are stored only as one-way hashes — we cannot recover them, which is why a key is shown once.
• Data is scoped to a workspace on every read, and an automated suite runs against a real database on every build to prove one workspace cannot reach another’s posts, media, inbox, analytics, reports or keys. A request for another tenant’s record is answered as if it does not exist, so identifiers cannot be probed to learn what exists.
• Staff access requires two-factor authentication, is time-boxed to 30 minutes, requires a written reason, cannot change billing, team membership or ownership, and is recorded in an audit log along with administrative and destructive actions.
• Rate limits apply per IP address, per user, per API key and per connected account.
• Credentials are stripped from logs structurally rather than by convention, and personal data in logs is reduced: email addresses are masked and IP addresses are truncated to their network.
• Outbound requests to addresses you supply are checked against internal networks, re-checked on every redirect, to prevent our servers being used to reach systems that are not yours.
• No system is perfectly secure, and we do not claim otherwise. If you find a vulnerability, write to us before disclosing it publicly.

9. How long we keep it

The honest summary: we keep your account and content data for as long as your account exists, and we delete it when you delete it. We do not silently expire your work, and we do not promise an automatic clean-up we do not perform.

• Deleting a workspace removes its posts, media, inbox history, analytics and connected-account records, including the third-party data described in section 3.
• Deleting your account removes your personal data. Content you authored inside a workspace that continues without you is retained by that workspace with your authorship anonymised.
• Cancelling does not delete anything. Your content stays where it is until you delete it — we would rather you came back and found your work than lose it to a timer. When you do want it gone, delete the workspace or the account, or ask us and we will do it.
• Short-lived operational records expire on their own: records that make a retried API request safe after 24 hours (35 days for payment-provider notifications, which can be re-sent for that long), dispatched internal events after 24 hours, rate-limit counters within an hour, and background-job history within a week.
• Other operational records are cleaned up on a schedule: outbound webhook delivery logs after 30 days; in-app notifications 90 days after you read them, and a year after they were sent in any case; sign-in, email-verification and password-reset links once they expire; unused team invitations and mobile-app sign-ins 30 days after they expire; and internal events that could not be delivered after 30 days.
• For each published post we keep the numbers our reports show — its latest metrics and its first-48-hour growth curve — rather than every hourly reading in between.
• Audit-log entries are kept for 400 days, and billing records longer, because their purpose is to be checkable afterwards and because tax law requires it.
• We back up the database continuously and keep encrypted snapshots that let us recover it to any point in the previous 7 days. Stored media is held in versioned storage, where a deleted or replaced file stays recoverable for 30 days. Both sit in the same cloud account as the live service — we do not yet keep a copy in a separate account, and we will say so here when we do. So a deleted item can persist in a backup for up to 7 days, or 30 days for media, after it is gone from the live service.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict or object to the processing of your personal data, and to complain to your supervisory authority.

You can export your data and delete your account from account settings. If you own an organization that other people are still members of, we will ask you to hand it over before you go, so their work does not disappear with you; the screen names the organizations and what to do. You can also write to support@gongongai.com and we will act within the statutory window — one month under the UK and EU GDPR, 45 days under California law.

If you are in California: we do not sell or share personal information as those terms are defined by the CCPA as amended, we have not done so in the preceding twelve months, and we do not knowingly process the personal information of minors under 16. We will not discriminate against you for exercising a right.

We honour Global Privacy Control signals where they reach us. Since we run no advertising or cross-site tracking, there is nothing for them to opt you out of.

We do not make decisions producing legal or similarly significant effects about you by automated means. AI features generate drafts for you to review; they do not decide anything about you.

11. Where data goes

Our servers, database and stored media are in the United States — Amazon Web Services’ us-east-1 region in Northern Virginia. So if you are in the UK or the EU, using the service involves a transfer to the United States from the outset, not only when a model provider is called.

That transfer, and the onward transfers to the providers in section 6, rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum where UK data is involved, alongside the measures described in section 8.

Every model provider we use is established in the United States. We previously listed a text fallback established in China; it has been removed from the service, and no content is sent there.

12. Children

The service is for business use and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.

13. Changes to this policy

When we change this policy materially — a new category of data, a new purpose, or a new subprocessor — we announce it in the product and by email before it takes effect, and update the date at the top of this page. Adding a subprocessor is announced in the changelog.

14. Contact

Privacy questions and rights requests go to support@gongongai.com, or by post to Haven Technologies Inc., 2103 Harrison Ave NW STE 1034, Olympia, WA 98502, United States.

We do not currently have an establishment in the EU or the UK, and have not appointed an Article 27 representative. If you are in either and want to raise something, write to the address above and we will treat it with the same deadlines as if we had.