Privacy notice.

HermesAI acts as a controller for website, account, authentication, billing, and direct commercial communications. For newsroom workspace data handled on behalf of a customer organization, HermesAI may also act as a processor under that customer's instructions.

HermesAI currently processes categories that may include:

• account and organization data from authentication flows,
• billing and subscription data,
• newsroom workspace data such as articles, feedback, review state, and settings,
• integration data such as webhook configuration, API key metadata, and delivery logs,
• support or commercial communications,
• technical and operational records needed for product security and troubleshooting.

HermesAI uses personal data to:

• authenticate users and manage tenant access,
• operate billing, invoicing, and subscription flows,
• run newsroom workflows and integrations,
• maintain product security, auditability, and abuse prevention,
• respond to support, privacy, security, or commercial requests.

HermesAI uses third-party providers for authentication, billing, database infrastructure, cache and rate limiting, file storage, and AI routing or model access. Specific subprocessors are listed in the Data Processing Agreement (DPA), available before contract.

HermesAI may process newsroom content through AI systems for synthesis, compose flows, refinement, and related editorial-assist features. Customers remain responsible for determining whether they have the rights and legal basis needed for that processing.

Retention depends on the data category and the reason it was collected. HermesAI retains account, billing, security, and workspace records for as long as needed to run the service, meet legal obligations, resolve disputes, and protect the service.

HermesAI shares data only to the extent needed to run the service, fulfill customer instructions, comply with law, or protect the service and its users. HermesAI does not treat customer or partner content as a free pool for unrelated reuse.

Depending on applicable law, users may have rights of access, rectification, erasure, restriction, objection, and portability. GDPR-specific details are described on the GDPR page.

Some providers may process data outside the country where the customer is based. Where that happens, HermesAI relies on the safeguards made available through the relevant provider terms and customer contract set.