Privacy Policy

1. Data we collect

Account data. Your email address, and your password if you sign up with one. Passwords are stored only as a salted hash; we never see or store them in plain text. If you sign in with Google instead, Google sends us your email address, your name and a link to your profile photo, together with an identifier for your Google account. We keep only your email address and that identifier, so we can recognise you next time, and we never receive your Google password.

Your agent's content. The messages and files you send to your Hermes Agent, its replies, and what it keeps to work for you: long-term memory, skills it has learned, scheduled tasks and custom instructions. This is stored in the private environment dedicated to your account.

Connected apps. If you connect your agent to Telegram, WhatsApp, Discord, WeChat or Feishu/Lark, we store the credentials needed for that connection (for example a bot token or a linked session) and process the messages exchanged through it.

Apps your agent connects to. If you ask your agent to connect an app such as Gmail, Google Calendar or Notion, the connection is made through Composio, an app-connection service. You sign in on the app's own page and choose what to allow. The access you grant is held in our Composio account, kept separate for your agent, and your agent uses it only to do what you ask. When the app tells us which account you signed in with, such as your email address for Gmail, we show it next to that app on your Apps page so you can tell your accounts apart. You can withdraw that access at any time in the app's own account settings.

Your servers and your computer. If you give your agent SSH access to one of your servers, or connect your own computer, the connection runs over Tailscale using the key you provide. On your computer your agent can only use the folders you choose, and saving files and running commands stay off unless you switch them on. What your agent reads there is handled like the rest of its content.

Your own AI provider key. If you add your own key for an AI provider, it is stored in your agent's configuration on our servers and used only for your agent's requests to that provider. Our website keeps only a short preview of it so you can recognise which key is set.

Subscription and payment. If you subscribe, DIGTECH AI LTD sells you the subscription and Stripe processes the card payment for us. Stripe collects your card or wallet details and billing address directly; we never see or store your full card number. We receive what we need to run your subscription and keep tax records: your email, name and billing country, the plan, its status, billing dates and invoices. If you subscribed before 21 October 2026 through Waffo Pancake, that company remains the merchant of record for your subscription: it collects your payment details directly and shares with us your email, the plan, its status and billing dates.

Usage information. Records of how much of the service your agent uses, so we can run the free trial fairly and keep the service reliable.

Website analytics. When you visit readyhermes.com we log which page you viewed, when, your device type (desktop, mobile or tablet), your browser's identifier string (its user agent, such as “Chrome on Android”, used to tell visitors apart from automated crawlers), your browser's language setting, the website that referred you, and whether the page finished loading in your browser. To count unique visitors we store a one-way hash of your IP address and browser identifier combined with a secret that changes every day. The hash cannot be turned back into your IP address or linked across days, and we do not store your IP address in this log. We also look up the approximate location of your IP address (city, region and country) and keep only that place name. These records are deleted after 120 days.

Server logs. Like any website, our servers record technical request information such as IP address, time and requested address for security, abuse prevention and troubleshooting. These logs are kept for a limited period.

Support and chat messages. If you email us or write to us in the live chat on our website, we keep your messages, any email address you give us and our replies. Live chat messages reach our team through Telegram.

Service notices to our team. We get an automatic notice when an account is created, a plan changes, a setting such as a connected app is changed, or something goes wrong, so we can keep the service working and help you. These notices contain your email address and what happened, never the content of your conversations.

2. How we use it and our legal bases

• To provide the service (performance of our contract with you): creating your account, running your Hermes Agent, delivering its replies, running your scheduled tasks, connecting the apps you choose, and managing your free trial and subscription. This includes the app, server and computer connections you set up and your own AI provider key if you add one.
• To keep the service safe and working (our legitimate interests): preventing abuse and fraud, enforcing fair-use limits, securing our systems, fixing problems and the service notices to our team described above.
• To keep payment and tax records (legal obligation): records of payments and invoices required by UK tax law.
• To answer you (our legitimate interests, or our contract with you when it is about your account): replying to support emails and live chat messages.
• To understand and improve the website (our legitimate interests): the aggregated, privacy-preserving analytics described above.
• To meet legal obligations (legal obligation): for example responding to lawful requests from authorities.

3. How your messages are processed by AI

Hermes Agent is open-source software created by Nous Research. To generate a reply, the content of your conversation (and relevant memory) is sent to a third-party large-language-model provider, for example through a model routing service such as OpenRouter to the developer of the underlying model. When your agent searches the web, your search query is sent to search engines through our search service. Voice messages you send are first turned into text by a speech-to-text model through the same kind of routing service.

We do not use your conversations to train AI models ourselves, and we do not sell your personal data. Please avoid sharing sensitive information (such as health data, passwords or payment card numbers) with your agent unless you need to.

4. Who we share data with

We share personal data only with service providers that help us run ReadyHermes, under contracts that require them to protect it:

• Hetzner Online and netcup, which run our servers in data centres in Germany and Austria (European Union).
• Waffo Pancake (Waffo.com Limited, Hong Kong), which processes subscription payments as merchant of record for subscriptions bought before 21 October 2026 and handles tax. Waffo is a separate controller for the payment data it collects, under its own privacy policy.
• Stripe (Stripe Payments UK, Ltd.), which processes our card payments, and acts as a separate controller for some of that data under its own privacy policy.
• AI model providers and routing services that process your messages to generate replies and transcribe voice messages, as described above. If you add your own provider key, that provider also processes your requests under its own terms.
• Google, if you choose to sign in with Google. Google is a separate controller for your Google account data under its own privacy policy.
• Composio, which makes and holds the connections to apps you ask your agent to connect.
• Tailscale, which provides the secure connection if you give your agent access to your servers or your computer.
• IPinfo (ipinfo.io), which receives the IP address of a website visit and returns its approximate city, region and country for our website analytics. We keep only that place name, never the address.
• Telegram, which our team uses to receive live chat messages and the service notices described above.
• Search engines, which receive the search queries your agent makes (not your account details).
• Messaging platforms you connect (such as Telegram or WhatsApp). Their own privacy policies apply to data processed on their platforms.

We may also disclose data if required by law, to protect the rights and safety of our users or the public, or as part of a sale or reorganisation of our business, in which case this policy will continue to apply.

5. International transfers

Your account and agent data are hosted in the European Union. Some of the providers listed above, such as AI model providers, Composio, Tailscale, Stripe, Google and Telegram, may process data outside the UK and EU, for example in the United States, and Waffo Pancake is based in Hong Kong. Where personal data is transferred to such countries we rely on adequacy decisions or on appropriate safeguards such as the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum. You can ask us for a copy of the relevant safeguards at support@readyhermes.com.

6. How long we keep data

• Account data and your agent's content are kept while your account is active.
• When you delete your account, your account, your Hermes Agent and the data stored in it are deleted within 30 days, except the payment records described below. Residual copies in our backups are removed as backups rotate.
• Website analytics records are deleted after 120 days.
• Subscription records (plan, status and billing dates) are kept while your account exists. Records of payments and invoices are kept for as long as UK tax law requires, normally six years from the end of the financial year they relate to, including after you delete your account. For subscriptions bought through Waffo Pancake before 21 October 2026, Waffo keeps its own payment and tax records for as long as the law requires.
• Support correspondence is kept for as long as needed to help you and for our records, typically no longer than two years.

7. Cookies

We use only cookies that are needed for the site to work, all set by readyhermes.com itself:

• a session cookie that keeps you signed in (30 days);
• a cookie that remembers your language choice if you switch languages (1 year);
• a cookie that links you to your live chat conversation if you use the chat before signing in (30 days);
• a short-lived cookie that protects the Google sign-in step (10 minutes);
• a short-lived cookie that remembers which payment page you chose, if you follow one of our payment links (1 hour).

Your browser's local storage also keeps a few small settings on your own device, such as which notifications you have already seen, whether you have opened the live chat, and a request or plan you picked before signing up. You can clear them at any time in your browser settings. We do not use advertising cookies or third-party tracking cookies.

On the home, sign-up and log-in pages we load Google's sign-in script, so you can sign in with your Google account in one click (Google One Tap and the "Continue with Google" button). It is loaded from Google's servers, so Google receives the usual details of that request, such as your IP address and browser, and may use its own cookies to recognise your Google session. Google handles that under its own privacy policy. We receive nothing about your Google account unless you choose to continue with it.

8. Your rights

Under UK and EU data protection law you have the right to access your personal data, to correct it, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. You can export your data and delete your account yourself from your account settings, or email us at support@readyhermes.com. We will respond within one month.

If you are unhappy with how we handle your data, you can contact us and we will try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live.

9. Security

Each account's Hermes Agent runs in its own isolated environment. Traffic to readyhermes.com is encrypted with HTTPS, passwords are hashed, and access to our infrastructure is restricted. No system is perfectly secure, so please use a strong, unique password.

10. Children

ReadyHermes is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will change the "last updated" date above and, for significant changes, notify you by email or in the product.

12. Contact

DIGTECH AI LTD, trading as ReadyHermes. Registered office: 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom. Email: support@readyhermes.com. Phone: +44 7704 581481. See also our Terms of Service.