Privacy Policy
1. Who we are
1.1 Holoh Workspaces (the "Service") is provided by TMRW Spain S.L.U. ("TMRW", "we", "us"), a company registered in Spain.
- Registered address: Av. Jean Claude Combaldieu N5, 03008 Alicante, Spain
- Tax ID (NIF/CIF): B42557777
- Registry details (Registro Mercantil, volume, folio, sheet): Registro Mercantil de Alicante; Tomo 4139; Folio 57; Hoja A-160929
- Privacy contact: info@holoh.com
1.2 This policy explains how we handle personal data when you use the Service at holoh.app, our desktop apps for macOS and Windows, and our websites. It applies under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Spain's Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights ("LOPDGDD").
2. Our two roles: controller and processor
2.1 When your organisation uses the Service, your organisation is the controller of the content in its workspaces: messages, files, meetings, recordings, transcripts, AI conversations and memory. We process that content as a processor on your organisation's behalf, under our Data Processing Agreement (DPA). If you are a member of an organisation, contact your organisation's administrator first about that content. We will help your organisation answer your request.
2.2 We are the controller for:
- (a) account and sign-in data;
- (b) billing and contract data;
- (c) security, abuse-prevention and service logs;
- (d) error reports;
- (e) usage metering used for billing;
- (f) support requests and bug reports you send us;
- (g) business contact data from demo requests and other enquiries.
3. What data we process
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, profile picture, sign-in identifier, preferred spoken language, organisation and role | You, your organisation, our sign-in service |
| Organisation data | Organisation name, members, invitations (invitee email), join requests and their message, workspace settings | Organisation admins and members |
| Workspace content | Chat messages, direct messages, reactions, mentions, drafts and scheduled messages, files and images, whiteboards, pinned items | Users |
| Meeting data | Meeting titles, agendas, invitees (including external email addresses), lobby admit and deny decisions, participation times and durations, call ratings and comments | Users and the Service |
| Meeting audio and transcripts | Each participant's own microphone audio, only while unmuted and when meeting AI, transcription or recording is on; transcripts; recordings when recording is on | Each participant's device |
| Call media | Live audio and video streams, screen shares, display names | Participants, through our call provider |
| Guest data | Display name a guest types to join a meeting; temporary guest identity | Guests |
| AI interactions | Prompts, files and context you give the AI assistant or agents, AI outputs, agent instructions, agent memory (personal and workspace notes, decisions and facts, with revision history), agent task logs | Users and the Service |
| Connected services | Encrypted access tokens for services you connect (for example GitHub, Microsoft 365), and data the AI reads from them at your request | You and the connected service |
| Usage and metering | AI model used, token counts, machine time, included usage and credits used, credit balance and purchases, the person who triggered each AI turn | The Service |
| Technical data | IP address (used briefly for rate limiting and security, not stored in our database), device and browser type, device identifiers, settings saved on your device | Your device |
| Error reports | Technical error details with personal data removed | Your device and our servers |
| Bug reports | Your description, technical context (including your browser's user agent), logs and screenshot you choose to send, optional contact address | You |
| Billing data | Billing contact, company name, VAT ID, billing address, invoices. For purchases in the Service, Stripe is the seller. Card details are held by Stripe, not by us | You, Stripe |
3.1 We do not intentionally process special categories of data (GDPR Art. 9). Meeting and chat content may contain such data if users include it. We do not use voice or video to identify people biometrically. You must give your name and email address to create an account; without them we cannot provide the Service.
4. Why we process data and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Service, accounts and workspaces; process content on your organisation's instructions | Contract (6(1)(b)); for content, your organisation's instructions under the DPA |
| Sign-in, security, fraud and abuse prevention, rate limiting | Legitimate interests (6(1)(f)): keeping the Service secure |
| Billing, invoicing, tax and accounting records | Contract (6(1)(b)) and legal obligation (6(1)(c)) |
| Measuring AI usage against included usage and credits, and billing | Contract (6(1)(b)) |
| Error monitoring and fixing defects | Legitimate interests (6(1)(f)): a working, reliable Service |
| Transactional email (invitations, account email) | Contract (6(1)(b)); for invitations sent to non-users, the inviting organisation's legitimate interests |
| Support and bug reports | Contract (6(1)(b)) or legitimate interests (6(1)(f)) |
| Legal claims and compliance with authority requests | Legal obligation (6(1)(c)) and legitimate interests (6(1)(f)) |
5. AI features
5.1 AI features send the content needed for each task to an AI model run by us or by a provider in the subprocessor list. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.
6. How long we keep data
| Data | Retention |
|---|---|
| Account data | For the life of the account. Deleted accounts can be restored for 30 days. After that, their personal data is permanently deleted within 15 days. Copies in our backups expire within 35 days. |
| Workspace content | Until deleted by users or the organisation. Deleted workspaces can be restored for 30 days. After that, their personal data is permanently deleted within 15 days. Copies in our backups expire within 35 days. |
| Messages of a deleted account in shared channels | Kept, shown as "Former member", until the organisation deletes them |
| Sign-ups that never join an organisation | 30 days |
| Meeting transcript entries used only for live AI | Deleted when the call ends |
| Kept transcripts and recordings | Until deleted by the organisation |
| Guest identities | A guest link stops working after 12 hours, and the guest's identity is deleted within 3 days. |
| Invitations | 7 days, unless accepted |
| Rejected sign-up and join requests | 30 days |
| Agent working records (each agent's own record of its conversations) | While the agent exists; deleted with the agent, its owner's account or the organisation |
| Agent task files | 30 days |
| Agent memory | Until deleted; personal memory is purged when the member leaves the organisation |
| Bug reports | 90 days |
| Unsent uploads | 24 hours |
| Usage and metering records | For the life of the organisation. Records that support an invoice are kept as billing records. |
| Billing records | 6 years, or longer where tax law requires |
| Error reports | Up to 90 days |
| Security audit records | 1 year. Deleting an account does not remove these records early. |
| Server logs | Up to 7 days |
| AI request logs | 30 days |
| Backups | 35 days, then deleted. Data deleted from the Service stays in backups until they expire; a restore does not re-apply it. |
7. Who we share data with
7.1 We use subprocessors to run the Service. The current list, with purpose and location, is at /terms#subprocessors.
7.2 We do not sell personal data. We share data with authorities only where the law requires it, and with professional advisers under confidentiality.
7.3 Data you send to a service you connect (for example GitHub) is handled under that service's terms as well as ours.
8. Where data is stored, and international transfers
8.1 We are based in Spain. We store the Service's data in the EU by default, and calls use Microsoft's EU data location. This is our practice, not a promise that all data stays in the EU.
8.2 Some subprocessors are outside the EU; they are marked in the subprocessor list. Where a subprocessor processes personal data outside the EEA, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses. The subprocessor list shows which applies to each.
9. Your rights
9.1 You have the right to access, correct, delete, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time (without affecting earlier processing).
9.2 To exercise a right, write to info@holoh.com. We reply within one month, extendable by two months for complex requests. We may need to verify your identity. Where we act as processor for your organisation, we pass your request to your organisation and help it respond.
9.3 To request deletion of your account, ask your organisation's admin or write to info@holoh.com. An organisation's owner or admin can request an export of the organisation's shared content.
9.4 Complaints. You can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to the authority where you live or work.
10. Cookies and device storage
10.1 We use only cookies and device storage that are strictly necessary to provide the Service: to keep you signed in, protect sign-in, cache your messages and calendar, and remember your device settings. We use no advertising or analytics cookies.