Privacy Policy

Last Updated: 2025-12-01 Last Reviewed: 2026-05-17

1. Introduction

Hivi (Hivi-x) ("we," "us," or "our") operates Hivi-x (the "Service"), an application that collects and stores your personal information to generate and fill forms and PDF documents. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By using our Service, you agree to the collection and use of information in accordance with this policy. This policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), the Personal Health Information Protection Act (PHIPA), the Health Insurance Portability and Accountability Act (HIPAA), and applicable Ontario and Canadian privacy laws.

2. Contact Information

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

Privacy Officer
Hivi (Hivi-x)
Canada
Email: support@hivi.ca
Phone: N/A

3. Information We Collect

3.1 Personal Information You Provide

We collect any personal information that you voluntarily provide to us through the Service. This may include, but is not limited to:

  • Contact Information: Name, email address, phone number, mailing address, and other contact details
  • Identification Information: Date of birth, Social Insurance Number (SIN), driver's license number, passport number, and other government-issued identification
  • Financial Information: Bank account details, income information, tax information, credit card information, and other financial data
  • Employment Information: Employer name, job title, employment history, salary, and other employment-related details
  • Personal Details: Family information, dependents, marital status, and other personal characteristics
  • Health Information: Medical information, health records, insurance information, and other health-related data
  • Legal Information: Legal documents, court records, immigration status, and other legal information
  • Educational Information: Educational background, qualifications, certifications, and academic records
  • Any Other Information: Any other personal information that you choose to provide to us through the Service

All personal information is provided voluntarily by you. We only collect information that you explicitly provide to us.

3.2 Account and Security Information

We collect the following information for account management and security:

  • User Identifiers: Internal user IDs that uniquely identify your account
  • Authentication Credentials: Information used to authenticate your identity, including:
    • Email and password (for standard authentication)
    • Google account identifier (Google ID) and email address (when you choose to sign in with Google OAuth)
  • TOTP Secrets: Encrypted time-based one-time password (TOTP) secrets used for two-factor authentication (2FA) security
  • Passkey credentials (WebAuthn): When you register a passkey, we store the public key, credential identifier, signature counter, the device label you supply, and the domain (rpID) the passkey is bound to. We never receive or store the corresponding private key — it stays on your device and is unlocked only by your biometric, PIN, or hardware security key.
  • Refresh tokens: When you sign in to a long-lived client (such as our Chrome extension) we issue an opaque refresh token. Only a hashed form is stored on our servers, alongside the client type, an optional device label, the IP and user-agent at issuance, and the issuance and expiry timestamps. Refresh tokens are rotated on every use; any reuse triggers automatic revocation of the entire token family.
  • Device Tokens: Unique tokens associated with devices you choose to "remember" for convenience
  • Account Metadata: Timestamps of when your account was created and last updated
  • User Profile Information: First name, last name, email address, physical address, city, country, postal code, and phone number that you provide in your account settings
  • Authentication Tokens: JWT tokens stored in browser localStorage and cookies for session management
  • Role and Permissions: Your user role and associated permissions for accessing different features of the Service
  • Login Activity: Information about your login history, including last login time and login count

3.3 Automatically Collected Information

  • IP Addresses: We temporarily collect IP addresses in memory for rate limiting and security purposes. IP addresses are also recorded in security and compliance audit logs (see Section 3.12) and retained in accordance with our audit log retention policy.
  • Usage Data: We may collect information about how you interact with our Service, including pages visited, features used, and time spent on the Service.

3.12 Security and Compliance Audit Logs

For security, fraud prevention, and compliance with applicable laws (including PIPEDA, PHIPA, HIPAA, and provincial privacy laws), we maintain audit logs in a separate, restricted system. These logs may include:

  • Timestamp of the event
  • User identifier (internal account ID, not your name or email)
  • IP address
  • Action performed (e.g. login, access to a resource, administrative action)
  • Resource (e.g. type of data or feature accessed)
  • Result (e.g. success or failure)

We do not store in audit logs: your personal information, health information, passwords, authentication tokens, or other sensitive content. Audit logs are used only for security monitoring, incident investigation, and meeting legal and regulatory requirements. Access to audit logs is restricted to authorized personnel for these purposes only.

3.4 Person Records and Contact Information

When you create and manage person records through our Service, we collect and store:

  • Identity Information: First name, last name, and other identifying details
  • Contact Information: Addresses, phone numbers, email addresses, and other contact methods
  • Relationship Information: Family members, friends, emergency contacts, and organizational relationships
  • Employment Information: Employment history, employer details, job titles, and related employment data
  • Educational Information: Educational background, qualifications, certifications, and academic records
  • Any Additional Information: Any other personal information you choose to include in person records

3.5 Client Information

When you create and manage client records, we collect and store:

  • Client Personal Information: Names, contact information, and other details about your clients
  • Client Documents: Documents associated with clients, including signed documents and document lists
  • Client Checklists: Checklists and checklist results associated with clients
  • Client Relationships: Information about relationships between clients and other entities in the Service

3.6 Checklist Data

We collect and store information related to checklists you create and manage:

  • Checklist Items: Individual checklist items, their status (completed/incomplete), and results
  • Checklist Summaries: Summary information and notes associated with checklists
  • Checklist Templates: Templates you create or use for generating checklists
  • Checklist Metadata: Timestamps, associations with clients, and other metadata

3.7 Voice Recordings

When you use the voice recording feature:

  • Local Storage: Voice recordings are temporarily stored in your browser's IndexedDB storage before upload. These recordings include:
    • Audio data in WebM format
    • Recording duration and timestamps
    • Audio metadata (sample rate, channels, bit rate)
    • Unique identifiers (UUIDs) for each recording
  • Server Storage: After upload, voice recordings are stored on our servers and may be processed for transcription purposes
  • Transcription Data: Transcribed text from voice recordings may be stored and associated with checklists or other records
  • Recording Metadata: Information about recording status (pending, processing, completed, failed), file size, and associated records

Note: Voice recordings stored locally in your browser are cleared when you log out or clear your browser data. You can also manually delete recordings through the Service interface.

3.8 Document and Form Data

We collect and store:

  • Generated Documents: PDF documents and forms generated through the Service
  • Form Submissions: Data submitted through secure form links
  • Document Templates: Templates used for document generation
  • Document Sharing Tokens: Secure tokens used for sharing documents with others
  • Document Signatures: Electronic signatures and signing information

3.9 Team and Collaboration Data

If you use team features:

  • Team Membership: Information about teams you belong to and your role within teams
  • Shared Resources: Documents, clients, and other resources shared within teams
  • Collaboration Data: Information about collaborative activities within teams

3.10 Payment and Subscription Information

If you use paid features:

  • Subscription Plans: Information about your subscription plan and payment tier
  • Payment History: Records of payments and transactions (processed through Stripe payment processor)
  • Billing Information: Billing email address and subscription details (payment card information is handled directly by Stripe, not stored by us)
  • Stripe Customer ID: Stripe customer identifier associated with your account for payment processing purposes

Important: We do NOT store, process, or have access to your payment card numbers, CVV codes, or full payment card details. All payment card information is collected, processed, and stored directly by Stripe in accordance with Stripe's Privacy Policy and PCI-DSS compliance standards.

3.11 Cookies and Similar Technologies

We use cookies and similar technologies for the following purposes:

  • Essential Cookies: These cookies are necessary for the Service to function properly. They enable device remembering functionality for two-factor authentication and cannot be disabled.
  • Device Remembering: When you choose to "remember this device" for two-factor authentication, we set a secure, HTTP-only cookie that allows you to skip 2FA verification on that device for a specified period (default: 30 days). This cookie:
    • Contains a unique device token
    • Is encrypted and signed for security
    • Expires automatically after the configured period
    • Can be cleared by you at any time through our Service
  • Authentication Cookies: Cookies used to maintain your authenticated session, including when using Google OAuth authentication
  • Third-Party Cookies: When you use Google OAuth authentication, Google may set cookies on your device in accordance with Google's Privacy Policy and cookie practices. We do not control these cookies, and they are subject to Google's Privacy Policy

3.13 Calendar and Reminder Data

When you use calendar features, we collect and store:

  • Calendar Events: Event title, optional description, start/end date and time, all-day flag, event type (birthday/reminder/note), recurrence rules, and reminder settings
  • Calendar Metadata: Event source (local or google), internal event IDs, timestamps, and related metadata needed to display and sync events
  • Google Calendar Metadata: Google event IDs and calendar IDs for linked events
  • Reminder Delivery Tracking: Records that a reminder was sent, to prevent duplicate reminder emails
  • Google Calendar Tokens: Encrypted Google Calendar OAuth access/refresh tokens and token expiry metadata (when you connect Google Calendar)

4. How We Use Your Information

We use the personal information we collect for the following purposes:

  1. Form and Document Generation: To generate, populate, and fill forms and PDF documents with your information using our own AI running on our own servers
  2. Service Delivery: To provide you with the core functionality of our Service, including document creation and management
  3. Account Management: To create and manage your account, authenticate your identity, and provide access to our Service
  4. Authentication Services:
    • To authenticate your identity using email/password credentials
    • To authenticate your identity using Google OAuth (when you choose this option)
    • To manage authentication tokens and session information
  5. Security: To protect your account from unauthorized access through two-factor authentication (2FA) and prevent abuse through rate limiting
  6. Device Management: To remember trusted devices and provide a convenient authentication experience
  7. Notifications: To send you important notifications via email using Google Workspace/Gmail email delivery services, including:
    • Account-related updates
    • Security alerts
    • Service notifications
    • Document generation confirmations
  8. Customer Support: To respond to your inquiries, provide technical support, and address service issues
  9. Legal Compliance: To comply with applicable laws, regulations, and legal processes
  10. Service Improvement: To maintain, improve, and enhance our Service functionality and security
  11. Person Records Management: To store, organize, and manage person records and contact information you create
  12. Client Management: To manage client information, documents, and checklists associated with your account
  13. Checklist Functionality: To create, manage, and track checklists and their completion status
  14. Voice Recording and Transcription: To process voice recordings, generate transcriptions using our own AI on our own servers, and associate transcriptions with checklists and other records
  15. Document Sharing: To enable secure sharing of documents through secure token-based links
  16. Team Collaboration: To facilitate team features, shared resources, and collaborative workflows
  17. Payment Processing: To facilitate subscription payments through Stripe payment processing services and manage your account's payment and plan information (payment card details are handled directly by Stripe, not by us)
  18. Access Control: To enforce role-based permissions and control access to different features based on your user role
  19. Security and Compliance Auditing: To maintain audit logs of security-relevant events (e.g. authentication, access to sensitive data, administrative actions), investigate security incidents, and meet legal and regulatory requirements for audit trails (including under PIPEDA, PHIPA, HIPAA, and provincial privacy laws)
  20. Calendar Features: To create, display, edit, and delete calendar events, process recurrence/reminders, send reminder emails, and support birthday event generation
  21. Google Calendar Synchronization: When enabled by you, to synchronize calendar events between Hivi-x and your Google Calendar (including periodic sync jobs and manual sync)

5. Legal Basis for Processing

We process your personal information based on:

  • Consent: By accepting our Terms of Service, you consent to the collection and use of your information as described in this policy
  • Contractual Necessity: Processing is necessary to provide the 2FA service you have requested
  • Legitimate Interests: Processing is necessary for security, fraud prevention, and service operation

6. Data Storage and Location

All personal information is stored on our own servers located in Canada. We do not transfer your personal information outside of Canada unless required by law or with your explicit consent.

Local Storage: Some data is temporarily stored in your browser:

  • Voice Recordings: Voice recordings are stored locally in your browser's IndexedDB before upload. These recordings are automatically cleared when you log out or can be manually deleted through the Service.
  • Authentication Tokens: Authentication tokens are stored in browser localStorage and cookies for session management. These are cleared when you log out.

Server Storage: All other data, including uploaded voice recordings, documents, person records, client information, and checklist data, is stored on our servers in Canada.

7. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may disclose your information only in the following circumstances:

  • Service Providers: We may share information with trusted service providers who assist in operating our Service, subject to strict confidentiality agreements. This includes:
    • Stripe: For payment processing (payment information is handled directly by Stripe, not stored by us)
    • Google: For OAuth authentication (when you choose to sign in with Google), calendar synchronization (if you connect Google Calendar), and email delivery services (Google Workspace/Gmail)
    • Other Service Providers: Infrastructure, hosting, and other operational services (all subject to confidentiality agreements)
  • Legal Requirements: We may disclose information if required by law, court order, or government regulation
  • Security and Safety: We may disclose information to protect our rights, property, or safety, or that of our users or others
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections

Third-Party Service Limitations:

  • We are not responsible for the privacy practices, data handling, security measures, or service availability of third-party service providers
  • Third-party service providers operate under their own terms of service and privacy policies
  • You acknowledge that your use of third-party services (Google OAuth, Stripe payments, Google email delivery) is subject to those providers' terms and privacy policies

8. Data Retention

We retain your personal information for the following periods:

  • Active Accounts: We retain your information while your account is active and in use
  • Inactive Accounts: If your account is inactive for 3 years, we will delete your personal information
  • Account Deletion: Upon your request to delete your account, we will delete your personal information within 30 days
  • Device Tokens: Device tokens automatically expire based on cookie settings (default: 30 days) and are removed from our systems
  • IP Addresses: IP addresses are only stored in memory temporarily for rate limiting and are not permanently retained
  • Voice Recordings (Local): Voice recordings stored in your browser's IndexedDB are cleared when you log out or can be manually deleted at any time
  • Voice Recordings (Server): Voice recordings uploaded to our servers are retained in accordance with your account status and can be deleted upon request
  • Person Records: Person records are retained while your account is active and deleted when your account is deleted
  • Client Information: Client information is retained while your account is active and deleted when your account is deleted
  • Checklist Data: Checklist data is retained while your account is active and deleted when your account is deleted
  • Documents: Generated documents are retained while your account is active and can be deleted upon request or when your account is deleted
  • Calendar Events and Reminder Tracking: Calendar events and reminder delivery tracking records are retained while your account is active and are deleted when your account is deleted, subject to legal obligations
  • Google Calendar Tokens: If you disconnect Google Calendar, we remove stored Google Calendar tokens from your account; tokens are also removed when your account is deleted
  • Authentication Tokens: Authentication tokens in localStorage and cookies are cleared when you log out
  • Security and Compliance Audit Logs: Audit logs are retained for 7 years (or as required by applicable law, e.g. HIPAA) for security monitoring and compliance. Audit logs are stored separately from your personal data, do not contain your personal or health information, and are not used for marketing or profiling. Access to audit logs is restricted to authorized personnel for security and compliance purposes only.

After the retention period expires, we will securely delete or anonymize your personal information in accordance with applicable laws.

9. Your Privacy Rights

Under Canadian privacy laws, you have the following rights regarding your personal information:

9.1 Right to Access

You have the right to request access to the personal information we hold about you. To exercise this right, please contact us at support@hivi.ca with your request.

9.2 Right to Correction

You have the right to request correction of inaccurate or incomplete personal information. Please contact us at support@hivi.ca to request corrections.

9.3 Right to Deletion

You have the right to request deletion of your personal information. To request deletion, please contact us at support@hivi.ca. We will process your request within 30 days, subject to legal and contractual obligations that may require us to retain certain information.

9.4 Right to Withdraw Consent

You may withdraw your consent to the collection, use, or disclosure of your personal information at any time by contacting us at support@hivi.ca. Note that withdrawing consent may affect your ability to use our Service.

9.5 Right to Object

You have the right to object to certain processing of your personal information. Please contact us to discuss your concerns.

9.6 Right to File a Complaint

If you believe we have not handled your personal information in accordance with applicable privacy laws, you have the right to file a complaint with:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: https://www.priv.gc.ca

Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400
Toronto, Ontario M4W 1A8
Phone: 416-326-3333
Website: https://www.ipc.on.ca

10. Security Measures and Compliance

We implement comprehensive security measures to protect your personal information and comply with applicable privacy laws:

10.1 Compliance Standards

We are committed to compliance with:

  • PIPEDA (Personal Information Protection and Electronic Documents Act) - Canadian federal privacy law
  • PHIPA (Personal Health Information Protection Act) - Ontario health information protection law
  • HIPAA (Health Insurance Portability and Accountability Act) - U.S. health information protection law
  • GDPR (General Data Protection Regulation) - European privacy law

10.2 Security Measures

We implement comprehensive security measures to protect your personal information:

  • Encryption in Transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
  • Encryption at Rest: We encrypt sensitive personal information stored in our databases using AES-256-GCM encryption. This includes:
    • Personal identification information (names, national IDs, passport numbers, driver's license numbers, dates of birth)
    • Contact information (addresses, phone numbers, email addresses)
    • Financial information (bank account details, tax records, income information)
    • Biometric data (facial images, fingerprints, voice prints, retinal scans)
    • Health information and other sensitive personal data
    • Client information (names, contact details, addresses)
  • TOTP Secrets: TOTP secrets are encrypted using AES-256-GCM encryption before storage
  • Secure Storage: All data is stored on secure servers with restricted access
  • Access Controls: We implement strict access controls and employee training on data protection. Role-based permissions control access to different features and data
  • Regular Security Audits: We conduct regular security audits and assessments
  • Backup Procedures: We maintain secure backup procedures to protect against data loss
  • Incident Response Plan: We have an incident response plan in place to address security breaches
  • Rate Limiting: We implement rate limiting to prevent abuse and unauthorized access attempts
  • Signed Cookies: Device tokens are cryptographically signed to prevent tampering
  • Local Storage Security: Voice recordings stored locally in IndexedDB are isolated to your browser and cleared on logout
  • Secure Token Management: Authentication tokens are stored securely and automatically cleared on logout
  • Secure Document Sharing: Documents shared via secure tokens use cryptographically secure token generation
  • Self-Hosted AI: All AI processing happens on our own servers - we never send your data to third-party AI services
  • Data Isolation: Your personal information is processed and stored entirely on our infrastructure
  • Audit Logging: We maintain tamper-resistant audit logs of security-relevant events (e.g. authentication, authorization failures, access to sensitive data, administrative actions) to support security monitoring and compliance. Audit logs do not contain your personal information, health information, passwords, or tokens. They are stored separately with restricted access and retained in accordance with Section 8.

Despite these measures, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

11. Data Breach Notification

In the event of a data breach that poses a risk of significant harm to you, we will:

  1. Notify affected users by email as soon as reasonably possible
  2. Provide details about the nature of the breach and the information affected
  3. Explain the steps we are taking to address the breach
  4. Advise you on steps you can take to protect yourself
  5. Report the breach to relevant privacy authorities as required by law

12. Age Requirements

Our Service is intended for users who are at least 13 years of age. If you are under 13, please do not use our Service. If you are between 13 and 18 years of age, you must have your parent's or guardian's consent to use our Service.

If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly.

13. Cookies and Device Tracking

13.1 Types of Cookies We Use

  • Essential Cookies: These cookies are necessary for the Service to function properly. They enable device remembering functionality for two-factor authentication and cannot be disabled.
  • Authentication Cookies: Cookies used to maintain your authenticated session

13.2 Local Storage

We use browser localStorage to store:

  • Authentication Tokens: JWT tokens for maintaining your authenticated session
  • User Preferences: Theme preferences and other user settings

These are automatically cleared when you log out. You can also clear them manually through your browser settings.

13.3 IndexedDB Storage

We use browser IndexedDB to temporarily store:

  • Voice Recordings: Audio recordings before they are uploaded to our servers

Voice recordings in IndexedDB are automatically cleared when you log out. You can also delete them manually through the Service interface.

13.4 Managing Cookies and Local Storage

You can manage cookies through your browser settings. However, disabling cookies may affect the functionality of our Service, particularly the "remember device" feature for two-factor authentication.

To clear the remember-device cookie through our Service, you can use the device management features in your account settings or contact us for assistance.

You can clear localStorage and IndexedDB data through your browser's developer tools or privacy settings. Note that clearing this data may require you to log in again and may result in loss of unsaved voice recordings.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by:

  • Posting the updated policy on our website with a new "Last Updated" date
  • Sending an email notification to the email address associated with your account (for significant changes)

Your continued use of our Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

15. Links to Other Services

Our Service may integrate with or link to other services. This Privacy Policy applies only to our Service. We are not responsible for the privacy practices of other services. We encourage you to review the privacy policies of any third-party services you use.

16. Document Storage and Retention

Documents and forms generated through our Service may be stored on our servers. We retain generated documents in accordance with our data retention policy outlined in Section 8. You may request deletion of specific documents or all documents associated with your account at any time by contacting us at support@hivi.ca.

16.1 Document Sharing

When you share documents through secure token-based links:

  • Documents are accessible to anyone with the secure token link
  • Secure tokens are cryptographically generated and difficult to guess
  • You can revoke access by deleting the shared document or changing sharing settings
  • We recommend sharing documents only with trusted parties

16.2 Form Submissions

When you create and share forms through secure token links:

  • Form submissions are associated with your account
  • Submitted form data is stored on our servers
  • You can access and manage form submissions through your account
  • Form data is retained in accordance with our data retention policy

17. Terms of Service

This Privacy Policy should be read in conjunction with our Terms of Service. By using our Service, you agree to both this Privacy Policy and our Terms of Service.

18. International Users

While our servers are located in Canada, if you are accessing our Service from outside Canada, please note that your information may be transferred to, stored, and processed in Canada. By using our Service, you consent to the transfer of your information to Canada and the processing of your information in accordance with this Privacy Policy and Canadian privacy laws.

19. Voice Recording and Transcription

19.1 Voice Recording Collection

When you use the voice recording feature:

  • We request access to your device's microphone
  • Audio is recorded in WebM format with Opus codec
  • Recordings are temporarily stored locally in your browser's IndexedDB before upload
  • You can pause, resume, and stop recordings at any time
  • Recordings have a maximum duration limit (typically 1 hour)

19.2 Voice Recording Processing

After upload, voice recordings are:

  • Transcribed using our own AI running on our own servers
  • Associated with checklists or other records in the Service
  • Processed to extract relevant information using our own AI infrastructure

Important: All transcription and processing happens on our own servers. We never send your voice recordings or any personal data to third-party AI services (such as OpenAI, Google, Anthropic, or any other external AI providers).

19.3 Voice Recording Storage and Deletion

  • Local Storage: Recordings in IndexedDB are automatically cleared on logout or can be manually deleted
  • Server Storage: Uploaded recordings are stored on our servers and can be deleted through the Service interface or upon account deletion
  • Transcription Data: Transcribed text is stored with associated records and deleted in accordance with our data retention policy

19.4 Microphone Access

The Service requires microphone access to record audio. You can:

  • Grant or deny microphone access when prompted by your browser
  • Revoke microphone access through your browser settings
  • Use the Service without voice recording features if you prefer not to grant microphone access

20. AI Processing and Third-Party Services

20.1 Our AI Infrastructure

We use our own AI running entirely on our own servers. We never send your personal information, documents, voice recordings, or any other data to third-party AI services.

All AI processing, including:

  • Document scanning and information extraction
  • Voice transcription
  • Text analysis and processing
  • Form filling and document generation

Happens entirely on our own secure servers. Your data never leaves our infrastructure and is never sent to external AI providers such as OpenAI, Google, Anthropic, or any other third-party AI services.

20.2 Google OAuth Authentication

We offer Google OAuth as an optional authentication method. When you choose to sign in with Google:

  • Data Collection: Google provides us with your Google account email address and basic profile information (name, profile picture) that you have authorized Google to share
  • Data Controller Relationship: Google acts as a data controller for authentication data. We act as a data processor for the information Google provides to us
  • Google's Privacy Policy: Your use of Google OAuth is also governed by Google's Privacy Policy (https://policies.google.com/privacy) and Google APIs Terms of Service
  • Data Storage: We store only the Google account identifier (Google ID) and email address associated with your account for authentication purposes
  • Revocation: You can revoke our access to your Google account at any time through your Google Account settings
  • Optional Service: Google OAuth is optional. You can create and use an account with email and password without using Google authentication

By using Google OAuth, you acknowledge and agree that:

  • Google's collection, use, and disclosure of your information is governed by Google's Privacy Policy
  • We are not responsible for Google's privacy practices or data handling
  • You have reviewed and agree to Google's Terms of Service and Privacy Policy

20.3 Google Calendar Integration

If you choose to connect Google Calendar:

  • Scope Requested: We request Google Calendar API scope needed to read and write calendar events for synchronization (https://www.googleapis.com/auth/calendar)
  • Two-Way Sync: Hivi-x may import events from Google Calendar into Hivi-x and may create/update linked events in Google Calendar based on events you create in Hivi-x
  • Sync Frequency: Synchronization may run periodically (for example, approximately every 15 minutes) and may also be triggered manually
  • User Controls: You can disconnect Google Calendar from the Service at any time
  • Google Policies: Use of Google user data is subject to the Google API Services User Data Policy and Google Terms

20.4 Payment Processing (Stripe)

If you use paid features, payment processing is handled by Stripe, Inc. ("Stripe"), a third-party payment processor:

  • Payment Card Information: We do NOT store, process, or have access to your payment card numbers, CVV codes, or full payment card details. All payment card information is collected, processed, and stored directly by Stripe
  • Stripe's Role: Stripe acts as both a data controller (for subscription and licensing data) and a data processor (for transaction data on our behalf)
  • Stripe's Privacy Policy: Stripe's collection, use, and disclosure of your payment information is governed by Stripe's Privacy Policy (https://stripe.com/privacy) and Stripe's Terms of Service
  • Data Shared with Stripe: We share with Stripe only the information necessary to process payments, including: billing email address, subscription plan details, and transaction amounts
  • PCI Compliance: Stripe is PCI-DSS Level 1 certified, the highest level of payment card industry security certification
  • Dispute Resolution: Any disputes regarding payment processing, refunds, or billing are subject to Stripe's terms and dispute resolution procedures

By using paid features, you acknowledge and agree that:

  • Stripe's collection, use, and disclosure of your payment information is governed by Stripe's Privacy Policy and Terms of Service
  • We are not responsible for Stripe's privacy practices, data handling, or payment processing errors
  • You have reviewed and agree to Stripe's Terms of Service and Privacy Policy
  • We are not liable for any issues, errors, or disputes arising from Stripe's payment processing services
  • You are solely responsible for providing accurate payment information to Stripe

20.5 Email Delivery Services (Google Workspace/Gmail)

We use Google Workspace (Gmail) for email delivery services:

  • Email Service Provider: Email messages sent through our Service are delivered via Google Workspace/Gmail infrastructure
  • Google's Role: Google acts as a data processor for email delivery on our behalf
  • Data in Transit: Email content, recipient addresses, and email metadata are transmitted through Google's email infrastructure
  • Google's Privacy Policy: Google's handling of email data in transit is governed by Google's Privacy Policy (https://policies.google.com/privacy) and Google Workspace Terms of Service
  • Email Content: Email content may include personal information, document links, and service notifications
  • No Email Storage by Google: We do not use Google's email storage services. Emails are sent through Google's infrastructure but are not stored in Google's systems beyond normal email delivery processes

By using our email notification features, you acknowledge and agree that:

  • Email delivery is handled by Google's infrastructure
  • We are not responsible for Google's email delivery practices or any delivery failures
  • Email content may be transmitted through Google's systems in accordance with Google's Privacy Policy

20.6 Other Third-Party Services

We may use other third-party services to provide functionality such as:

  • Infrastructure and hosting services
  • Analytics services (if applicable, and only with anonymized data)

Important:

  • We do not use third-party AI services. All AI processing is performed on our own servers
  • All third-party service providers are required to maintain appropriate security measures and are subject to confidentiality agreements
  • We are not responsible for the privacy practices, data handling, or service availability of third-party service providers
  • Your use of third-party services is subject to their respective terms of service and privacy policies

20A. Hivi Autofill Browser Extension

The "Hivi Autofill" Chrome extension is an optional companion to the Service that helps logged-in users fill saved profile data into web forms and capture LinkedIn profiles or job postings into their Hivi account. This section describes what the extension does and what data it sends.

20A.1 Activation and per-site control

  • The extension does not transmit any data to Hivi until the user signs in with their Hivi account credentials inside the extension popup.
  • Autofill is off by default for every website. The user must explicitly toggle "Autofill" on for a given site in the extension popup before the extension reads form fields on that site.
  • The extension does not run on browser-internal pages (chrome://, edge://, chrome-extension://, moz-extension://).

20A.2 Data sent to Hivi while autofill is on

When autofill is enabled for a site and the user focuses a text-like input, the extension sends to the Hivi backend:

  • Field metadata: the input's name, id, placeholder, aria-label, and the parsed visible label (if any). These are HTML attributes the website itself uses to identify the field.
  • Frame origin: the origin of the document that contains the focused field (e.g. https://example.com).
  • Page URL: the full URL of the page where the field is focused. This is used to associate unrecognized field names with the website where they were seen so administrators can later add a mapping. The page URL and field metadata are stored together in our "unrecognized autofill fields" admin list.
  • Bearer authentication token: identifies the user's account so Hivi can return suggestions from that user's saved profile.

The extension does not read or transmit page content, page text, the values typed into fields, cookies, browsing history, or fields on sites where autofill is turned off.

20A.3 AI autofill suggestions

If the user clicks the "AI suggestions" button inside the autofill dropdown, the field metadata and page URL described above are passed to Hivi's AI to generate a suggested value from the user's saved profile. AI processing is performed on Hivi's servers; we do not send this data to third-party AI providers.

20A.4 LinkedIn profile import

When the user is on a LinkedIn profile page (linkedin.com/in/...) and explicitly clicks Import LinkedIn profile in the extension popup, the extension parses the visible profile in the page and sends the following to the user's Hivi account: full name, headline, location, photo URL, profile URL, About text, work experience entries, education entries, skills, and any contact information visible on the page. This action runs only on user click and only on the active LinkedIn profile tab.

20A.5 Job posting capture

When the job applications tracker feature is enabled on the user's account and the user explicitly clicks Add to job search, the extension parses the active tab's job posting (using the page's structured data and visible text) and sends company, role, location, salary, HR name and contacts, notes, and the job link to the user's latest job search in Hivi. This action runs only on user click.

20A.6 Local storage in the browser

The extension stores the following in the browser's local extension storage (chrome.storage.local) on the user's device:

  • The Hivi authentication token (cleared on sign-out and on session expiry).
  • A per-origin map of which sites the user has enabled autofill for.
  • A per-origin map of the user's chosen light/dark theme for the autofill dropdown.

This data is local to the browser profile and is not synced to Hivi servers.

20A.7 Permissions used by the extension

PermissionPurpose
storageSave the auth token, per-site enabled flag, and per-site theme listed above.
activeTabAllow user-initiated actions ("Fill all", "Import LinkedIn profile", "Add to job search") to run against the user's currently focused tab.
scriptingInject the optional in-page profile-search widget when the user clicks "Open search widget"; re-inject the content script after extension updates.
host_permissions: https://hivi.ca/*Allow the extension's service worker to call the Hivi backend API.
content_scripts on <all_urls>The autofill suggestions feature must be able to detect a focused input on whichever site the user has enabled autofill for. The script does not transmit anything until the user has signed in and explicitly toggled autofill on for that site.

20A.8 Limited Use of user data (Chrome Web Store)

Hivi-x's use of information received through the Hivi Autofill Chrome extension and through any Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:

  • We use the data described in this Section 20A only to provide the user-facing features of the extension (returning autofill suggestions, importing the user's LinkedIn profile into their Hivi account, capturing a job posting into their Hivi job search, and operating the in-page profile search widget).
  • We do not transfer this data to third parties except as necessary to provide or improve the Service, comply with applicable law, or as part of a merger, acquisition, or sale of assets, in each case with appropriate notice to users.
  • We do not use this data for serving advertisements, including personalized or retargeted advertising.
  • We do not allow humans to read this data, except (a) with the user's explicit consent for specific instances, (b) when necessary for security investigations or to comply with applicable law, or (c) when the data has been aggregated and anonymized for our own internal operations.

20A.9 How to revoke access

The user can stop the extension from sending any further data by any of the following:

  • Toggling autofill off for a site in the popup.
  • Signing out of the extension (popup → "Sign out").
  • Removing the extension from Chrome (chrome://extensions/).
  • Requesting deletion of their Hivi account by contacting support@hivi.ca.

21. Data Portability

You have the right to request a copy of your personal information in a structured, commonly used, and machine-readable format. To request your data, please contact us at support@hivi.ca. We will provide your data within 30 days of your request.

22. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Privacy Officer
Hivi (Hivi-x)
Canada
Email: support@hivi.ca
Phone: N/A

We will respond to your inquiry within 30 days.

23. When You Use the Service as a Business (Processor Role)

If you use the Service as a business user (e.g., as a realtor, lawyer, healthcare provider, or other professional) to collect personal data, including identification documents or health information, from your clients or end-users:

  • You are the data controller for that data. You determine the purposes and means of the processing. You are responsible for having a lawful basis, providing a privacy notice to your clients, and complying with applicable laws (including PIPEDA, PHIPA, HIPAA, and GDPR where applicable).
  • We act as a data processor for that data. We process it only on your instructions, as set out in our Data Processing Agreement (DPA) and Business Terms. We do not use your clients' data for our own purposes beyond providing the Service to you.
  • Our Business Terms and DPA set out your obligations as a controller and our obligations as a processor. If you collect health information (PHI), you may need to enter into a separate Business Associate Agreement (BAA) or PHIPA-compliant terms with us; contact support@hivi.ca.

24. If You Are a Client of a Business Using the Service

If you are a client or customer of a business that uses Hivi-x to collect documents or information from you (for example, you received a form or document request from your realtor, lawyer, or doctor):

  • That business is the data controller for the information you provide to them through the Service. They are responsible for telling you why they collect it and how you can exercise your rights. Please contact that business directly for questions about their use of your data.
  • We ( Hivi (Hivi-x) ) act as a data processor: we store and process your data on behalf of that business so they can provide their services to you. We do not use your data for our own purposes beyond operating the platform.
  • For more detail, see our short notice For clients of businesses using Hivi-x. For technical and security details of how we process data, see the rest of this Privacy Policy. To contact our Privacy Officer: support@hivi.ca.

Effective Date: 2025-12-01
Last Updated: 2025-12-01

Fill forms in seconds – hiviTerms of ServiceData Processing AgreementBusiness TermsFor Clients of BusinessesPrivacy PolicyTrustData RequestsContact Privacy Officer