Privacy Notice

This Privacy Notice explains how HMS Ai ("HMS Ai", "we", "us") collects, uses, shares and protects personal data when you use our AI productivity application and website (the "Service"). HMS Ai is the data controller for the personal data described here — we decide what data is collected and why.

1. Personal data we collect

• Account data — email address, login credentials (stored hashed), display name and profile details you choose to add.
• Content you submit — prompts, uploaded files, images, documents and audio you send to AI tools, plus the generated outputs and your saved items, chat history and favourites.
• Subscription and entitlement data — your plan tier, subscription status, renewal dates and usage credits.
• Usage and technical data — feature and tool usage, request counts, timestamps, device and browser information, IP address, and error/diagnostic logs.
• Support communications — messages you send us and their attachments.

Card and bank details are not collected or stored by us. Payments are processed by our reseller and Merchant of Record, Paddle.

2. Why we use it, and our legal basis

• Create and manage your account, provide the Service and its AI tools — performance of our contract with you.
• Manage subscriptions, entitlements and usage limits — performance of our contract.
• Security, abuse and fraud prevention, service integrity — legitimate interests and legal obligation.
• Customer support — performance of our contract and legitimate interests.
• Product improvement, reliability and troubleshooting — legitimate interests (we use aggregated or minimised data wherever possible).
• Marketing emails, where offered — consent, which you may withdraw at any time.
• Meeting accounting, tax and other legal duties — legal obligation.

3. Who we share data with

• Service providers / subprocessors — hosting and database providers, AI model providers that process your prompts to generate outputs, email delivery, and error monitoring/analytics tooling. They act on our instructions under contract.
• Merchant of Record (Paddle) — for the sale of our products, subscription management, payments, invoicing and tax compliance.
• Professional advisers — legal, accounting and audit advisers where needed.
• Authorities — where required by law or to protect our rights, users or the public.

We do not sell your personal data.

4. International transfers

Our providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

5. Retention

We keep account and subscription data for as long as your account is active, and afterwards only as long as needed for legal, tax, accounting or dispute-resolution purposes. Chat history, generated content and saved items are kept until you delete them or close your account. Security and diagnostic logs are kept for a short period and then deleted or anonymised. When data is no longer needed, we delete or anonymise it.

6. Your rights

Subject to applicable law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests or withdraw consent at any time. You can also complain to your local data protection authority. To exercise a right, contact us using the details below — we aim to respond within one month.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, hashed credentials, database-level access controls and row-level security so users can only reach their own records, and least-privilege access for administrators. No online service can be guaranteed completely secure.

8. Cookies and similar technologies

We use essential cookies and local storage to keep you signed in and to remember preferences such as your theme — these are required for the Service to work. Where we use optional analytics cookies, they help us understand feature usage. You can clear or block cookies in your browser settings, but the Service may not function correctly without essential cookies.

9. Children

The Service is not intended for children under 16, and we do not knowingly collect their personal data.

10. Changes and contact

We may update this notice; material changes will be communicated in the app or by email. Questions or privacy requests: contact HMS Ai at contact support. Billing and refund enquiries are handled by Paddle at paddle.net.