1. Introduction
WhoBe (“WhoBe”, “we”, “our”, or “us”) is an AI relationship agent built by HowBe LLC (“HowBe”) that helps you remember the people you meet and activate your network. WhoBe is designed to be privacy-first: your core contact records are stored in Google Sheets that you own. This Privacy Policy explains how we collect, use, and safeguard information when you use the WhoBe mobile applications (iOS and Android), the WhoBe web application, Google Sheets templates, automations, and related services (collectively, the “Services”).
By using the Services, you agree to the practices described here. You retain ownership of the data you store in your Google Sheets.
2. Information We Collect
Account Information
- Name, email address, and Google account identifiers you use to sign in.
- Profile details you optionally provide (role, company, tags).
Contact & Network Data
- Contacts you add or import (names, emails, social handles, notes).
- Contact fields such as company, job title, phone numbers, and email addresses.
- Metadata such as tags, events, where you met, and relationship history.
- LinkedIn URLs or other enrichment inputs you supply.
Content You Provide
- Notes, message drafts, reminders, and follow-up prompts.
- Voice transcripts or dictated inputs, if you use voice features.
- Images of business cards you upload for scanning or extraction.
Sheet Activity
- Automations we run to keep your Google Sheets organized.
- Usage diagnostics (e.g., sync status, script execution errors).
Support & Feedback
- Messages or attachments you send to our support email.
- Survey responses or beta-program feedback.
通讯录与个人信息收集声明 (Contacts and Personal Information Collection)
为了提供联系人导入、去重及同步功能，WhoBe 会在获得您明确授权后，读取您设备通讯录中的信息（包括联系人姓名、电话号码及电子邮件地址），通过加密通道经由我们的服务器处理后，写入您自己拥有的 Google 表格。我们不会在服务器上保留您完整的通讯录副本；服务器仅保留用于网络功能的联系人邮箱哈希索引，以及本政策第 5 节所述的运营数据。
(To provide contact import, deduplication, and synchronization, WhoBe will, after obtaining your explicit authorization, read information in your device's address book (contact names, phone numbers, and email addresses), process it through our servers over an encrypted connection, and write it into the Google Sheet you own. We do not keep a copy of your full address book on our servers; the server retains only a hashed index of contact email addresses used for network features, plus the operational data described in Section 5.)
Because you control the Sheets, you decide what information to store. Please ensure you have the right to store and share contact details, especially for EU/UK residents.
3. How We Use Information
- Provide, maintain, and improve the WhoBe experience within Google Sheets.
- Sync, organize, and enrich your network using data you supply (e.g., LinkedIn URLs).
- Power AI features you request, such as summaries, message drafts, business card extraction, and follow-up suggestions.
- Deliver automation (tagging, reminders, deduplication, notifications) at your request.
- Process payments and manage subscriptions.
- Respond to support tickets and communicate updates or security alerts.
- Analyze usage and performance to improve reliability and user experience.
- Comply with legal obligations and enforce our terms of service.
4. AI Features & Data Sharing
What data is sent: When you use AI features, we may send the following data: text you enter, contact fields (name, company, job title, phone, email), notes, message drafts, voice transcripts, and images of business cards.
Who the data is sent to: We send this data to Google Cloud Vertex AI (Gemini) to process AI requests.
Why it is sent: We use the AI service to generate summaries, draft messages, extract business card details, and provide follow-up suggestions.
Consent: We ask for your permission in the app before sending personal data to the AI service.
Retention & protection: We only send what is necessary to fulfill the request. Data is transmitted securely. We do not sell personal data.
5. Storage & Ownership in Google Sheets
WhoBe operates inside your Google account. All core contact data is stored in Google Sheets that you own. We do not copy your full contact database to our servers. We do keep a limited, derived set of data on our servers to run network features: a SHA-256 hash of each contact's email address (used to find mutual connections without storing the address itself), follow-up and “Daily 3” state, saved views, and AI relationship memory embeddings generated from interactions you record. These are deleted when you delete your account.
Data storage: Core contact records live in your Google Sheets. Operational data needed to run platform features is stored on our servers and with processors such as Google Firebase and RevenueCat. This includes authentication records, app configuration, subscription status and AI credit balances, and data you create through events, organizations, referrals, and AI assistant features. If you choose AI features, request data is transmitted to Google Cloud Vertex AI for processing as described in Section 4.
- You manage sharing permissions on the Sheets (view, edit, transfer).
- You can export, duplicate, or delete the Sheets at any time.
- Our scripts temporarily process the data to complete actions you initiate (e.g., enrichment, tagging) and then relinquish access.
If you uninstall WhoBe or revoke access, automations stop running, but your Sheets remain intact within your Google Drive.
7. Third-Party Processors
We use third-party processors to provide and operate the Services. These providers are required to protect your data with protections equal to or stronger than our own and may use the data only to provide services to us.
- Google Cloud Platform (GCP): database hosting (Cloud SQL), backend services (Cloud Run), and object storage for encrypted voice memos (Cloud Storage). Region: United States, under EU Standard Contractual Clauses.
- Google Cloud Vertex AI (Gemini): AI processing of user-provided content and AI embeddings.
- Google Firebase (Auth, Core, Storage): authentication, app initialization, and storage of user files/images where applicable.
- Google Sign-In: OAuth sign-in and permissioned access.
- Google Drive API: storing your contact spreadsheet and file attachments based on the scope you authorize. Production builds currently request only the
drive.filescope (access limited to files WhoBe creates or that you open with WhoBe). Google Contacts import (contacts.readonly) and Google Photos attachments (photoslibrary.appendonly) are temporarily unavailable while those permissions complete Google's verification process, and will be requested only if you choose to use those features once re-enabled. - RevenueCat: subscription management and receipts.
- Stripe, Inc.: payment processing, credit billing, event ticketing checkout, and host payouts (Stripe Connect). Region: United States.
8. Data Retention
Because your contacts live in your Google Sheets, you determine their retention. Operational data on our servers is kept only as long as needed to deliver the Services and comply with legal obligations, according to the schedule below.
Account Deletion & Statutory Data Retention
You may initiate the deletion of your account and associated personal data at any time via Settings → Privacy & Data → Delete Account & Data in the WhoBe mobile or web app, or by submitting a request via our public portal at whobe.howbetech.com/delete-account.html.
Upon submission, your local session credentials, on-device cache, and active tokens are purged immediately. Backend erasure then proceeds in accordance with our retention schedules:
- Core Personal & Relationship Data (immediate deletion): contacts, notes, scanned card images, AI relationship memory embeddings, and voice memos stored in Google Cloud Storage are permanently deleted from production databases and object stores. Downstream OAuth tokens (e.g., Google Drive) are revoked, and Firebase Auth identities are erased. Your own Google Sheets remain under your control; the deletion screen offers to move the WhoBe files you own to your Drive trash.
- Event Ticket & Community Aggregate Records: attendee personal identifiers (name, email, phone) are permanently redacted and anonymized. Aggregate ticket counts and payment tallies are retained solely to preserve host event history and financial integrity.
- Financial & Payment Records (7-year statutory retention): transaction records, receipts, and invoice records are preserved for 7 years as required by tax laws, with your identity removed. Host payout bank linkages on Stripe Connect are severed.
- Compliance Audit Proof (3-year zero-PII ledger): to demonstrate compliance without retaining personal data, we keep an irreversible cryptographic audit log (HMAC-SHA256 digest) for 3 years. It records timestamps and execution status without storing plaintext personal information.
- Database Backups: automated database backups expire on a rolling 30-day cycle. If a backup is restored for disaster recovery, suppression replay prevents previously deleted accounts and data from being resurrected.
Right to Withdraw: you may cancel a queued deletion request before processing begins, directly within the app.
9. Security
We implement encryption in transit, OAuth-based authentication with Google, access controls, and monitoring to protect the automations that interact with your Sheets. No system is perfectly secure, so we recommend enabling two-factor authentication on your Google account and reviewing Drive sharing settings to minimize exposure.
数据传输与存储安全 (Data Transmission and Storage Security)
您导入的通讯录信息将通过加密通道传输至我们的服务器处理后，写入您自己拥有的 Google 表格；我们不会在服务器上保留完整副本。我们承诺这些数据仅用于实现应用的核心功能，不会将其共享给任何第三方用于营销目的。
(Contact information you import is transmitted over an encrypted channel to our servers for processing and then written into the Google Sheet you own; we do not keep a full copy on our servers. We promise that this data is used only to deliver the core functions of the application and is not shared with any third party for marketing purposes.)
10. Your Rights & Choices
Data Portability & Your Right to Export
You have the right to receive personal data you have provided to WhoBe in a structured, commonly used, and machine-readable format. You may generate and download a complete archive of your data at any time directly within the WhoBe application under Settings → Privacy & Data → Export My Data (Takeout). Your exported archive includes your contact cards, imported contact directories, event participation records, and Daily 3 follow-up notes in JSON format.
- Access, edit, or delete your contact data directly in Google Sheets.
- Delete your account and the data we hold from Settings → Privacy & Data in the app, or at whobe.howbetech.com/delete-account.html (see Section 8).
- Disable or uninstall WhoBe automation scripts at any time.
- Request data deletion of operational logs by emailing whobe@howbetech.com.
- Depending on your region (e.g., GDPR, CCPA), exercise additional privacy rights by submitting a verifiable request.
11. Children’s Privacy
WhoBe is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us data, contact us so we can remove it.
12. Changes to This Policy
We may update this Privacy Policy as our practices evolve. The “Last updated” date reflects the most recent revision. Material changes will be communicated through the product or via email where required.