Legal
Hints Privacy Policy
This policy explains what personal data Hints handles when your team uses it, why, who else receives it and how long it is kept. Effective date: October 1, 2026.
1. Who we are and what this covers
Hintsflow Inc. (“Hints”, “we”) runs Hints, the AI sales assistant at hints.so and i.hints.so.
Our own data. For account, billing, security and usage data, we decide how it is used and are its controller.
Your organization’s content. For messages, voice notes and CRM data your team gives Hints, your organization is the controller and we process it on its behalf as its processor.
Questions about this policy: ask@hints.so or https://hints.so/contact.
2. Data we collect
Data
Examples
Source
Account
Work email, organization name, role (owner or member), invitations you send or accept
You, when you sign up or are invited
Sign-in and security
One-time codes and links (stored only as hashes), sign-in attempts, session cookie
Our web app
Messenger identifiers
Telegram user ID, username and first name; WhatsApp phone number
Telegram and WhatsApp, when you link your messenger
Messages
Text you send Hints, voice notes and their transcripts, forwarded messages including the original sender’s name, Hints’ replies
You, through your messenger
CRM and payments data
Records Hints reads or changes in your CRM, your CRM account and user name, Stripe data you ask about (read-only)
Your connected services, with your permission
Plans and confirmations
Changes Hints proposed, your confirmation or AUTO setting, outcomes, your time zone
Your use of Hints
Billing
Stripe customer and subscription IDs, plan status, the owner’s billing email (card details stay with Stripe)
Stripe and you
Usage
Requests used, pseudonymous product events (for example, a request was answered or a CRM connected)
Our servers
We do not collect special categories of data on purpose. Do not send Hints health, financial account or similar sensitive data unless your work requires it.
3. How we use data and our legal bases
Use
Legal basis (EU/UK GDPR)
Provide Hints: answer requests, propose and make confirmed CRM changes, transcribe voice notes
Contract with your organization; for content, your organization’s instructions
Accounts, sign-in, invitations and the web app
Contract
Billing, invoices and tax records
Contract and legal obligation
Security, abuse prevention, preventing repeat free trials
Legitimate interests in keeping Hints safe and fair
Service emails (sign-in codes, invitations, billing and plan notices)
Contract
Pseudonymous product analytics to improve Hints
Legitimate interests in understanding which features work
Support
Contract and legitimate interests
We do not sell personal data, use it for advertising, or make automated decisions with legal or similarly significant effects about you.
4. Your CRM data and AI processing
Hints does not copy your CRM. It reads records live through the CRM’s official connection, as the member who asked and with that member’s permissions, and changes them only as described in our Terms (confirmation or AUTO).
What is kept. Your conversation with Hints, including CRM details that appeared in it, stays in your private Hints workspace so the assistant can follow up. Hints also keeps each proposed change, your confirmation and the outcome as a record.
AI processing. To understand and answer a request, Hints sends the conversation, its instructions and the CRM results it needs to its AI model provider (section 5). Voice notes are transcribed on our own server; the audio is not stored.
No training. We do not train AI models on your data. Our AI model provider receives it only to answer your requests.
Access tokens. The sign-in tokens for your CRM and Stripe stay on our controller server and are never given to the AI model. Disconnecting deletes them.
5. Service providers
We share personal data only with these providers, only for the purpose shown, and under contracts that require them to protect it.
Provider
Purpose
Data it receives
Location
Contabo
Hosting of all Hints servers, databases and voice transcription
All data Hints stores
United States
AI model provider: DeepSeek
Understanding requests and writing answers and plans
Conversations, instructions, CRM results needed for a request
China
xAI
AI model for some accounts
Same as above, for those accounts
United States
Telegram
Messenger for members who choose it
Messages, voice notes, Telegram identifiers
United Arab Emirates
Twilio
WhatsApp messaging for members who choose it
Messages, voice notes, phone numbers
United States
Resend
Sending sign-in, invitation and notice emails
Email addresses, organization name, sign-in codes and links
United States
Stripe
Billing and payments
Owner’s email, organization ID, payment details (entered with Stripe directly)
United States / Ireland
PostHog
Pseudonymous product analytics
Pseudonymous IDs, organization ID, event names (no message text, CRM data, emails or phone numbers)
European Union
Services you connect. Your CRM (HubSpot, Pipedrive or Salesforce) and, if you connect it, your Stripe account receive the requests Hints makes as you. They are your providers, under your own agreements with them.
6. International transfers
Some providers above process data outside your country, including in the United States and China. Where EU or UK law applies, we transfer personal data only with a lawful safeguard: an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission’s Standard Contractual Clauses (with the UK addendum), together with an assessment of the transfer. You can ask us for a copy of the relevant safeguards at ask@hints.so.
7. Retention and deletion
Data
How long we keep it
Sign-in codes and links
10 minutes; invitation links 7 days; messenger link codes 15 minutes. Expired ones are deleted 30 days later
Message text and replies in our delivery queue
Deleted when the request finishes; a record without the text (time, status and chat ID) is deleted after 12 months
Voice audio
Not stored; transcribed in memory
Conversation history, assistant memory and files the assistant created
While the member’s account is active, then deleted within 30 days after the member leaves or is removed, or the organization is deleted. When the organization’s paid access ends, it is kept for 30 days (the Plan page shows the date) and deleted after that
Proposed changes, confirmations and outcomes
While the member’s account is active; deleted together with the conversation history
Access tokens to your CRM and Stripe
Until you disconnect, leave, are removed, or the owner changes the CRM; then deleted
Account, organization and invitations
While the organization exists; deleted when it is deleted, except the records below
A minimal record of past organizations and trials
As long as the Hints operates. To prevent repeat free trials and abuse: the email address, which organization, and when the membership ended.
Billing and tax records
As long as the Hints operates.
Pseudonymous analytics
24 months
Backups
Overwritten within 35 days
To delete your account, leave your organization (an owner deletes it instead), then email ask@hints.so from the account’s address. We delete it within 30 days and keep only the record of past organizations and trials and the billing records above.
8. Security
In transit. All traffic to Hints and to our providers uses HTTPS. Messenger webhooks are verified by signature or secret.
Isolation. Each member’s assistant runs in its own isolated container, with its own storage, no administrator rights and no direct internet access; outside requests go through a controlled proxy.
Least access. The assistant never holds your CRM or Stripe sign-in tokens. It acts only with the connected member’s own permissions, Stripe access is read-only, and every CRM change goes through a confirmed plan.
Secrets and sign-in. One-time codes and link tokens are stored only as hashes, with attempt and rate limits. Service secrets are kept in a password manager and never in code or logs.
Logs. Our logs record IDs, statuses and errors, not message text.
No system is perfectly secure. If a breach affects your personal data, we will tell your organization without undue delay and as the law requires. Report security issues to ask@hints.so.
9. Your rights
Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Email ask@hints.so from your account’s address; we answer within 30 days.
Data in your organization’s content (messages, CRM data): we pass your request to your organization, which decides, and we help it answer.
Members can disconnect services and leave their organization in the web app at any time.
Complaints. You can complain to your local data protection authority, for example in the EU or the UK.
California and other US states. We do not sell or share personal data for cross-context behavioural advertising.
10. Cookies and analytics
The Hints web app sets only two cookies, both needed for it to work, and no advertising or third-party tracking cookies:
Cookie
Purpose
Lifetime
session
Keeps you signed in and protects forms
14 days
hints_returning
Remembers that this browser signed in before, to skip setup steps
1 year
Product analytics run on our servers, not in your browser: we send PostHog pseudonymous events (for example “request answered” or “CRM connected”) keyed to a random-looking ID, never message text, CRM data, emails or phone numbers.
11. Children, changes and contact
Children. Hints is for businesses and is not meant for anyone under 18.
Changes. When we change this policy materially, we will email organization owners before the change takes effect and update the date above.
Contact. Hintsflow Inc., 2261 Market Street, Apt 4640, San Francisco, CA, United States; ask@hints.so; https://hints.so/contact.