Privacy Policy

1. Who we are and what this covers

Tinyhat is a Tinyloop product that provisions and operates dedicated cloud Computers for AI agents such as Hermes. This policy covers the Tinyhat website, account and provisioning services, dedicated Computers we operate for customers, and integrations you choose to connect through Tinyhat.

2. Information we collect

We collect contact and account information you provide, such as your name, email address, phone number, and support messages. We also keep the operational records needed to provision, secure, support, and bill the service, such as account status, Computer identifiers, connection status, payment metadata from our payment provider, and security or service logs.

If you choose an individual Stripe account upgrade when available, we collect your country and explicit consent to create your connected account. With your approval, we share your email address and country with Stripe. Stripe then asks for your legal name and date of birth in a form it provides on the upgrade page. Stripe receives those directly; Tinyhat does not keep them in its own records, although as the platform for your connected account Tinyhat may be able to view account details held by Stripe. Pending details are encrypted while the upgrade is incomplete and removed from Tinyhat’s upgrade record when it completes. We retain the consent receipt, connected-account identifiers, verification status, and spending allowance records. Stripe handles information it receives under its own privacy policy. An incomplete upgrade can be reviewed or removed by contacting Tinyhat support; removing a local record does not itself close a Stripe account or cancel a provider subscription.

We do not sell personal information.

Sophie receptionist calls

Privacy in each call states whether OpenAI hosted audio or browser audio is saved. OpenAI processes the call and may retain conversation data under its API data policy. When a call’s Privacy notice says OpenAI recording is enabled, OpenAI keeps its recording for up to 30 days. Forget removes Tinyhat’s playback access; it does not delete that provider copy.

Privacy in the call states its record policy. Under the temporary-record policy, Slack receives permitted notes and a text transcript, and local delivery content clears after confirmed or uncertain delivery. Under the saved-record policy, Tinyhat keeps notes, a redacted text transcript and outcome for our team for the stated period after the call; Slack receives a short summary and a protected full-call link.

Under the saved-record policy, provided contact details and an assessment of caller tone are saved with the call. Under the temporary-record policy, contact is shared only for a requested reply. Neither policy grants marketing permission. A private key in the caller's tab can restore notes after reload and offer Resume briefly within the original call time. A copied call URL cannot restore them.

Stop sharing removes Tinyhat's saved content, including saved browser audio, and stops new notes, browser recording and sharing. Forget also clears visible notes. OpenAI continues to process the call until it ends. These controls cannot remove content already in Slack, data held by OpenAI, logs or backup history. Slack uses our workspace's retention settings. For access or removal requests, contact privacy@tinyloop.co.

Pressing End normally starts a ten-minute expiry for this tab’s recoverable notes and private call controls. This recovery period is separate from the saved team record. Interrupted calls can keep recovery available longer; returning to the tab can restart that expiry. Resume requests microphone and sound permission again and may have an audio gap. It retains bounded text to continue the same call within its original deadline.

For calls admitted under the saved-record policy, the default retention is six calendar months after call closure. Privacy in the call states the period that applies. Team access ends at that admitted expiry or removal through Privacy; maintenance deletes expired saved content. After a definite delivery failure, maintenance clears temporary delivery content once its retry deadline passes. Delivery metadata remains to prevent duplicates. Confirming facts alone does not request a reply or authorize marketing.

Signed-in owners can review and apply receptionist rule changes. We retain the active rules and up to twenty previous revisions with the acting administrator and time of each change.

Business receptionist calls

Tinyhat saves business call notes and a redacted text transcript for six calendar months by default. Calls admitted with OpenAI hosted recording also offer protected audio playback; OpenAI keeps that recording for up to 30 days. Tinyhat does not keep a separate audio archive. Privacy in each call states its recording and retention policy.

Call notes, a redacted text transcript and outcome are saved for the business owner for up to the retention period stated in each call’s Privacy details. They are removed from owner access at expiry and deleted by maintenance. They are not sent to Tinyhat’s internal team.

Provided contact details and an assessment of caller tone are saved with the call for the business owner. This does not arrange a callback or grant marketing permission. Email addresses and phone numbers are removed from the written transcript where recognized; spoken or unusual formats can remain.

Stop sharing, Forget my notes or asking the receptionist to discard notes removes saved content and stops new notes. Forget and spoken discard also clear the caller’s visible notes. OpenAI still processes the call until it ends.

Reloading does not restore a call. Removal does not erase data held by OpenAI, logs or backup history. For access or removal requests, contact privacy@tinyloop.co.

Website analytics

Google Analytics receives visits to fixed public pages, their titles, the referring site's origin, and technical information such as your browser and IP address. It uses first-party cookies to distinguish visits. We do not send invitation links, URL queries or fragments, or account and Google Workspace content to website analytics.

3. Google Workspace data you choose to connect

Tinyhat does not receive Google Workspace access unless you start a connection and approve Google's consent screen. The exact data an agent can access depends on the scopes shown to you and granted by Google. Tinyhat currently implements permissions only for Gmail, Google Calendar, and Google Drive, plus the basic Google account identity needed to identify the connection. Depending on the scopes you select, this can include:

• Gmail messages, metadata, threads, drafts, labels, and sending;
• Google Calendar calendars, events, attendees, and availability;
• Google Drive file metadata and file content; and
• basic Google account identity used for the connection.

Before Google opens, Tinyhat shows a summary of the requested access. Google then shows the authoritative scopes for your approval. You can decline the request or ask your agent to use more limited access.

4. How Google data is used

Google user data is used only to provide and improve the user-facing functionality you request or configure, such as finding email, preparing drafts, managing inbox labels, updating a calendar, or working with files. Your agent can access a Google service only within the permissions you granted.

When an agent action requires an AI model to reason over Google data, the dedicated Computer may send relevant content to the model provider configured for that agent solely to perform that action. Third-party providers process information under their own terms and privacy policies.

5. Your Google credentials stay on your Computer

Your Google access and refresh tokens are saved only on the dedicated Computer assigned to you. Tinyhat's application servers do not keep a usable copy of those credentials.

• The Computer creates the encryption keys. It creates a one-time key pair for the connection and sends Tinyhat only the public key. The matching private key never leaves that Computer.
• Tinyhat encrypts before storing. After Google returns the tokens, Tinyhat processes them briefly in application memory to complete the OAuth exchange. Before any credential is written to platform storage, Tinyhat immediately encrypts it with the Computer's public key using RSA-OAEP-256.
• The platform holds only a one-time encrypted package. As credential material, Tinyhat stores only that short-lived encrypted package until the Computer saves it and confirms installation. The platform does not have the private key required to decrypt it.
• The Computer saves the usable credential locally. Only the dedicated Computer can decrypt the package. It saves the credential in owner-only local storage, where your agent uses it only for actions you request or configure within the Google permissions you granted.
• The encrypted delivery copy is removed. Tinyhat deletes the encrypted package after the Computer confirms that the credential was saved. If the Computer never retrieves it, the package expires and is deleted.

We may keep non-secret connection metadata needed to operate and support the service, such as the connected account, granted scopes, connection status, and timestamps.

6. Google API Limited Use

Tinyhat's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not sell Google user data.
• We do not use Google user data for advertising.
• We do not use Google user data to train Tinyhat or general-purpose AI models.
• Humans do not read Google user data except with your affirmative permission for support or security, when needed to investigate abuse, or when required by law.

You can read the Google API Services User Data Policy ↗.

7. When information is shared

We use service providers for infrastructure, payments, communications, support, security, and other operations. They may process information only as needed to provide those services. Google user data is shared with service providers only when necessary to deliver user-requested functionality, maintain security, comply with law, or with your consent. We may also disclose information to address fraud, abuse, or a valid legal request.

Mobile opt-in data and consent will not be shared with third parties.

For website analytics, Google processes the public-page visit information described above under the Google Privacy Policy.

8. Retention, revocation, and deletion

A Google OAuth credential remains only on the dedicated Computer while the connection is active. Tinyhat provides a disconnect tool so you can remove it easily: ask your agent to disconnect the selected Google Workspace account and confirm the request. The tool removes the selected credential from that Computer and updates only non-secret connection status on Tinyhat's platform.

You can also revoke Tinyhat from your Google Account. Revocation stops future API access but does not automatically delete items created in Google or data that the agent previously saved elsewhere at your instruction.

To request deletion of Google-derived data and related account records that Tinyhat controls, follow the steps on our support page or email privacy@tinyloop.co. We may retain limited billing, fraud-prevention, security, dispute, or legal records when required for legitimate purposes.

9. Dedicated Computers and security

Tinyhat uses dedicated customer Computers, encrypted transport, access controls, monitoring, and operational boundaries designed to protect customer isolation. Tinyhat does not read the contents of your dedicated Computer — its conversations, files, or logs — as part of routine operations. Humans access a customer Computer or its data only with your affirmative permission for support or security, when needed to investigate abuse or protect the service, or when required by law. No system can guarantee absolute security. If you believe your account or connection is at risk, revoke provider access and contact support promptly.

10. Your choices and rights

You can decline a connection, limit the Google scopes you approve, revoke access, or stop using the service. You may also ask to access, correct, export, or delete personal information Tinyhat controls, subject to identity verification and applicable legal limits.

11. Changes and contact

We may update this policy as the service evolves. Material changes will be reflected by a new "Last updated" date on this page. For privacy questions or requests, email privacy@tinyloop.co.