Legal
Privacy Policy
Effective and last updated: October 1, 2026
Information we collect
We process account and workspace information, project content, Business Profile knowledge sources, customer conversations, booking and CRM records, usage and billing events, and technical logs needed to operate and secure Humainum. When you connect Instagram, we process the professional account identifier, username, access token, direct messages, comments, and publishing actions you authorize through Meta.
How we use information
We use information to provide the features you enable, generate AI responses, deliver messages, publish approved social content, maintain CRM and booking workflows, measure usage, prevent abuse, troubleshoot problems, and comply with legal obligations. We do not sell personal information.
AI processing
Humainum sends only the context required for a requested AI operation to the configured AI provider. AI output may be inaccurate and should be reviewed before important decisions. Workspace controls, usage limits, and human handoff settings determine how automated responses are used.
Connected services
If you connect services such as Instagram, Google, GitHub, Stripe, or an external database, Humainum processes data according to the permissions you grant. Those providers also process information under their own privacy terms. You can disconnect a service from the relevant module settings.
Google data: access and use
When you connect Google, Humainum processes your Google account email, OAuth authorization tokens and the data needed for the Google feature you select. Reporting uses selected Analytics properties, aggregate traffic and engagement metrics, and Search Console site and search-performance data. Business Profile features use business listings, locations and reviews. Google Ads features use advertising account, campaign and reporting data to manage the campaigns you request. Optional property setup creates or configures Analytics properties, web streams and Search Console site verification only when you request that setup and grant the additional permissions. We do not request Google Drive or Google Calendar access in these connection flows.
Google data: sharing and disclosure
Google user data is processed by Innoqa LLC to provide Humainum and is disclosed to authorized users of the relevant project according to their access rights. Microsoft Corporation (Azure) provides hosting and infrastructure and processes data needed to operate the service on our behalf. When you request an AI-assisted feature using connected Google data, the relevant context may be sent to OpenAI or the AI service provider you have selected in Humainum for that feature; that provider processes it to return the requested result. Google receives API requests needed to perform your selected actions. We do not sell Google user data or disclose it to data brokers. Transfers are limited to delivering the requested user-facing features, security, or applicable legal obligations; Google user data is not shared for third-party advertising or used to train generalized AI models.
Google data: protection mechanisms
Humainum uses HTTPS/TLS for communication with Google APIs. Google access and refresh tokens are encrypted before database storage using ASP.NET Core Data Protection and are not returned to the browser as integration status data. Integration operations check the signed-in user and their access to the project. OAuth callbacks validate a protected, expiring state value and recheck project access before saving credentials. These measures restrict unauthorized access to sensitive Google authorization data. Tokens are used server-side to call the services you authorize.
Google data: retention and your control
We retain Google integration tokens and configuration while the connection is enabled and needed to provide the service. Disconnecting Google in Humainum deletes the stored integration record, including its tokens, and stops future access through that connection. You can also revoke Humainum access in your Google Account permissions. Disconnecting does not automatically delete reports, generated content or other project records created earlier; request deletion of those records through support@humainum.com. Data needed for legal obligations may be retained as required. Humainum use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
TikTok, Facebook and YouTube data: access and use
When you connect TikTok, a Facebook Page or a YouTube channel, Humainum processes the account or Page identifier, display name, the permissions you granted, and OAuth access and refresh tokens. For TikTok we request basic profile information to show which account is connected, and permission to upload and publish videos; for Facebook we request the list of Pages you manage and permission to read and publish posts on the Page you choose; for YouTube we request permission to upload videos and read basic channel information. Humainum uses this access only to publish the content you prepare and explicitly choose to publish, and to show the result of that publication. We do not read your private messages, followers or viewing history on these platforms, and we do not post anything without your action.
TikTok, Facebook and YouTube data: sharing, retention and control
Media and captions you publish are sent to the selected platform, which processes them under its own terms: TikTok (tiktok.com/legal/privacy-policy), Meta (facebook.com/privacy/policy) and Google (policies.google.com/privacy). By using YouTube features in Humainum you also agree to the YouTube Terms of Service (youtube.com/t/terms). Tokens are encrypted before storage, used only server-side, and never sold or shared for advertising. We keep them while the connection is enabled; disconnecting the account in Social Media Management deletes the stored connection and its tokens and stops future access. You can also remove Humainum from your TikTok app permissions, Facebook Business Integrations, or Google Account permissions (myaccount.google.com/permissions). Posts already published remain on the platform until you delete them there.
Storage, security and retention
Credentials and integration tokens are encrypted at rest. We use access controls, transport encryption, monitoring, and data minimization safeguards. Project and conversation data is retained while needed to provide the service or for the retention period selected in your settings, then deleted or anonymized unless a longer period is legally required.
Your choices and rights
Depending on your location, you may request access, correction, export, restriction, objection, or deletion of personal information. Workspace owners can remove knowledge sources, conversations, connected accounts, and projects from Humainum. Disconnecting Instagram removes the stored Instagram authorization token and stops future collection.
Data deletion requests
Instagram, TikTok, Facebook and YouTube users may disconnect the account from Social Media Management → Connection. Meta deauthorization and data-deletion callbacks are also handled automatically. For another privacy or deletion request, contact Innoqa LLC through inno.qa and include the Humainum account or workspace concerned.
International processing
Humainum and its service providers may process information in countries other than yours. Where required, we use appropriate contractual and organizational safeguards for international transfers.
Children
Humainum is a business productivity service and is not directed to children. We do not knowingly collect personal information from children below the age required by applicable law.
Changes to this policy
We may update this policy when our services or legal requirements change. The current version and effective date will always be published on this page.
Contact
Innoqa LLC is responsible for Humainum. Privacy and data-protection requests can be submitted through inno.qa. We may need to verify your identity and authority over the relevant account before completing a request.