Hints Privacy Policy
This policy explains what personal data Hints handles when your team uses it, why, who else receives it and how long it is kept. Effective date: October 1, 2026.
1. Who we are and what this covers
Hintsflow Inc. ("Hints", "we") runs Hints, the AI sales assistant at hints.so and i.hints.so.
Our own data. For account, billing, security and usage data, we decide how it is used and are its controller.
Your organization's content. For messages, voice notes and CRM data your team gives Hints, your organization is the controller and we process it on its behalf as its processor.
Questions about this policy: ask@hints.so or https://hints.so/contact.
2. Data we collect
Data | Examples | Source |
|---|---|---|
Account | Work email, organization name, role (owner or member), invitations you send or accept | You, when you sign up or are invited |
Sign-in and security | One-time codes and links (stored only as hashes), sign-in attempts, session cookie | Our web app |
Messenger identifiers | Telegram user ID, username and first name; WhatsApp phone number | Telegram and WhatsApp, when you link your messenger |
Messages | Text you send Hints, voice notes and their transcripts, forwarded messages including the original sender's name, Hints' replies | You, through your messenger |
CRM and payments data | Records Hints reads or changes in your CRM, your CRM account and user name, Stripe data you ask about (read-only) | Your connected services, with your permission |
Plans and confirmations | Changes Hints proposed, your confirmation or AUTO setting, outcomes, your time zone | Your use of Hints |
Billing | Stripe customer and subscription IDs, plan status, the owner's billing email (card details stay with Stripe) | Stripe and you |
Usage | Requests used, pseudonymous product events (for example, a request was answered or a CRM connected) | Our servers |
We do not collect special categories of data on purpose. Do not send Hints health, financial account or similar sensitive data unless your work requires it.
3. How we use data and our legal bases
Use | Legal basis (EU/UK GDPR) |
|---|---|
Provide Hints: answer requests, propose and make confirmed CRM changes, transcribe voice notes | Contract with your organization; for content, your organization's instructions |
Accounts, sign-in, invitations and the web app | Contract |
Billing, invoices and tax records | Contract and legal obligation |
Security, abuse prevention, preventing repeat free trials | Legitimate interests in keeping Hints safe and fair |
Service emails (sign-in codes, invitations, billing and plan notices) | Contract |
Pseudonymous product analytics to improve Hints | Legitimate interests in understanding which features work |
Support | Contract and legitimate interests |
We do not sell personal data, use it for advertising, or make automated decisions with legal or similarly significant effects about you.
4. Your CRM data and AI processing
Hints does not copy your CRM. It reads records live through the CRM's official connection, as the member who asked and with that member's permissions, and changes them only as described in our Terms (confirmation or AUTO).
What is kept. Your conversation with Hints, including CRM details that appeared in it, stays in your private Hints workspace so the assistant can follow up. Hints also keeps each proposed change, your confirmation and the outcome as a record.
AI processing. To understand and answer a request, Hints sends the conversation, its instructions and the CRM results it needs to its AI model provider (section 5). Voice notes are transcribed on our own server; the audio is not stored.
No training. We do not train AI models on your data. Our AI model provider receives it only to answer your requests.
Access tokens. The sign-in tokens for your CRM and Stripe stay on our controller server and are never given to the AI model. Disconnecting deletes them.
5. Service providers
We share personal data only with these providers, only for the purpose shown, and under contracts that require them to protect it.
Provider | Purpose | Data it receives | Location |
|---|---|---|---|
Contabo | Hosting of all Hints servers, databases and voice transcription | All data Hints stores | United States |
AI model provider: DeepSeek | Understanding requests and writing answers and plans | Conversations, instructions, CRM results needed for a request | China |
xAI | AI model for some accounts | Same as above, for those accounts | United States |
Telegram | Messenger for members who choose it | Messages, voice notes, Telegram identifiers | United Arab Emirates |
Twilio | WhatsApp messaging for members who choose it | Messages, voice notes, phone numbers | United States |
Resend | Sending sign-in, invitation and notice emails | Email addresses, organization name, sign-in codes and links | United States |
Stripe | Billing and payments | Owner's email, organization ID, payment details (entered with Stripe directly) | United States / Ireland |
PostHog | Pseudonymous product analytics | Pseudonymous IDs, organization ID, event names (no message text, CRM data, emails or phone numbers) | European Union |
Services you connect. Your CRM (HubSpot, Pipedrive or Salesforce) and, if you connect it, your Stripe account receive the requests Hints makes as you. They are your providers, under your own agreements with them.
6. International transfers
Some providers above process data outside your country, including in the United States and China. Where EU or UK law applies, we transfer personal data only with a lawful safeguard: an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses (with the UK addendum), together with an assessment of the transfer. You can ask us for a copy of the relevant safeguards at ask@hints.so.
7. Retention and deletion
Data | How long we keep it |
|---|---|
Sign-in codes and links | 10 minutes; invitation links 7 days; messenger link codes 15 minutes. Expired ones are deleted 30 days later |
Message text and replies in our delivery queue | Deleted when the request finishes; a record without the text (time, status and chat ID) is deleted after 12 months |
Voice audio | Not stored; transcribed in memory |
Conversation history, assistant memory and files the assistant created | While the member's account is active, then deleted within 30 days after the member leaves or is removed, or the organization is deleted. When the organization's paid access ends, it is kept for 30 days (the Plan page shows the date) and deleted after that |
Proposed changes, confirmations and outcomes | While the member's account is active; deleted together with the conversation history |
Access tokens to your CRM and Stripe | Until you disconnect, leave, are removed, or the owner changes the CRM; then deleted |
Account, organization and invitations | While the organization exists; deleted when it is deleted, except the records below |
A minimal record of past organizations and trials | As long as the Hints operates. To prevent repeat free trials and abuse: the email address, which organization, and when the membership ended. |
Billing and tax records | As long as the Hints operates. |
Pseudonymous analytics | 24 months |
Backups | Overwritten within 35 days |
To delete your account, leave your organization (an owner deletes it instead), then email ask@hints.so from the account's address. We delete it within 30 days and keep only the record of past organizations and trials and the billing records above.
8. Security
In transit. All traffic to Hints and to our providers uses HTTPS. Messenger webhooks are verified by signature or secret.
Isolation. Each member's assistant runs in its own isolated container, with its own storage, no administrator rights and no direct internet access; outside requests go through a controlled proxy.
Least access. The assistant never holds your CRM or Stripe sign-in tokens. It acts only with the connected member's own permissions, Stripe access is read-only, and every CRM change goes through a confirmed plan.
Secrets and sign-in. One-time codes and link tokens are stored only as hashes, with attempt and rate limits. Service secrets are kept in a password manager and never in code or logs.
Logs. Our logs record IDs, statuses and errors, not message text.
No system is perfectly secure. If a breach affects your personal data, we will tell your organization without undue delay and as the law requires. Report security issues to ask@hints.so.
9. Your rights
Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Email ask@hints.so from your account's address; we answer within 30 days.
Data in your organization's content (messages, CRM data): we pass your request to your organization, which decides, and we help it answer.
Members can disconnect services and leave their organization in the web app at any time.
Complaints. You can complain to your local data protection authority, for example in the EU or the UK.
California and other US states. We do not sell or share personal data for cross-context behavioural advertising.
10. Cookies and analytics
The Hints web app sets only two cookies, both needed for it to work, and no advertising or third-party tracking cookies:
Cookie | Purpose | Lifetime |
|---|---|---|
session | Keeps you signed in and protects forms | 14 days |
hints_returning | Remembers that this browser signed in before, to skip setup steps | 1 year |
Product analytics run on our servers, not in your browser: we send PostHog pseudonymous events (for example "request answered" or "CRM connected") keyed to a random-looking ID, never message text, CRM data, emails or phone numbers.
11. Children, changes and contact
Children. Hints is for businesses and is not meant for anyone under 18.
Changes. When we change this policy materially, we will email organization owners before the change takes effect and update the date above.
Contact. Hintsflow Inc., 2261 Market Street, Apt 4640, San Francisco, CA, United States; ask@hints.so; https://hints.so/contact.