Privacy Policy

1. Who we are

HunterViz is operated by Ammon Hunter, a sole proprietor doing business as HunterViz, in the State of Utah, United States (“HunterViz”, “we”, “us”). For questions about this policy or your information, email ammon@mobilelifeagent.com.

When a business uses HunterViz, the business decides what data to connect and who can see it. For the business data it connects, we process that data on the business’s behalf and according to its instructions.

2. What we collect

Account information

Your email address, and a password if you create one. Passwords are stored only as a one-way hash (bcrypt); we never see or keep the password itself.
If you sign in with Google: the email address Google confirms for your Google account. We don’t receive your Google password.
If you sign in with Apple (in the Mobile app): the email address Apple confirms for your Apple Account and Apple’s identifier for you. We don’t receive your Apple password. See section 6.
The names you give your workspaces, when you accepted our Terms of Service and read this policy (and which versions), and whether your email address is confirmed.

Workspaces and teams

The workspaces you create or join, the email addresses of members and people you invite, their roles, and which dashboards they can see.
Workspace settings, such as the workspace profile you write for the agents and its data access policy.

Data sources and business data

The settings of the data sources you connect (for example a store address, a spreadsheet or dataset you picked, and a label). Passwords, API keys and access tokens for those sources are kept in Google Cloud Secret Manager, never in our application database, and are never shown back to you or to our AI models.
The business data those sources contain (for example orders, products, inventory and customer records from Shopify, or the rows of a spreadsheet), which we copy into a BigQuery dataset kept separately for each workspace, in the United States.
The links to dashboards you add from other tools (such as Looker Studio, Power BI or Tableau).

Agent Team content

The questions you ask, the conversations (“chats”) with the agents, and the reports, charts and documents they create.
When you use voice, your audio is sent to our AI provider to be understood and turned into text. We don’t store the audio; the text becomes part of the chat.
If you type a question on hunterviz.com before you have an account, we keep it (in your browser and with your session) until you sign in, so it can start for you. It expires after 7 days.

Billing

Payments are handled by Stripe, or by Shopify for a workspace that pays through its Shopify store. Card details go directly to Stripe or Shopify; we never receive or store them. We keep your Stripe customer and subscription identifiers or your Shopify charges (their identifiers, names, amounts and status), your plan, and your credit and token usage.

Things you send us

If you use our contact form: your name, email, phone number, company size and what you’re looking for. We receive it by email.
Emails and support requests you send us. Our staff can read one of your chats only if you choose to share it with support; the share lasts up to 14 days, you can withdraw it at any time, and every view is recorded.
If you report an AI answer (Report, under an agent’s answer, a briefing or a report): the answer as you saw it, the reason you chose and any note you add, with your account and where the answer was. Our staff read that answer, and only that answer, to review it; every reading is recorded. We keep the report until you delete your account or the workspace is deleted.

Security and usage information

An activity (audit) log of important actions in each workspace, such as sign-ins, invitations, data source changes and deletions, with the time, the account and the IP address.
Server logs of requests to the Service (including IP address and browser type), kept by our hosting provider.
Short-lived records used to stop abuse, such as failed sign-in counts and rate limits.
A “known device” cookie that remembers which accounts have signed in on your browser, so we can warn you about sign-ins from new devices.
For each phone or tablet signed in to the Mobile app, a device record (section 6).

Analytics

We use Google Analytics to understand how the Service is used: pages viewed, buttons clicked, how far pages are scrolled, form steps (never what you type into them), errors and page speed, and how you found us. Inside the app we attach a random account identifier, your workspace type, role and plan.
We remove email addresses and long numbers from what is sent, and we never send your questions, chat content, voice transcripts or business data to Google Analytics.
On hunterviz.com, our public website, we also use FullStory, which records how visitors use its pages so we can see what works and what doesn’t. It isn’t on app.hunterviz.com or in the Mobile app. What it collects and how long it keeps it follow its settings and its privacy policy.
The Mobile app’s crash reports and analytics are described in section 6.

3. How we use your information

To provide the Service: sign you in, run your workspaces, load your data sources, show your dashboards, and answer your questions with the Agent Team.
To keep the Service and your account secure: verify your email, detect and stop abuse, investigate problems, and keep an activity log.
To bill you and manage your plan, credits and tokens.
To send you service emails (such as confirmation links, invitations, security notices, receipts and important changes), and to reply when you contact us.
To understand and improve the Service using aggregated analytics.
To meet legal obligations and enforce our Terms of Service.

We don’t sell your personal information, and we don’t use your business data or chats to advertise to you.

4. AI processing

The Agent Team uses Google’s Gemini models on Google Cloud Vertex AI. To answer a question, we send the model what it needs: your question and the chat so far, your workspace profile, the names and columns of your tables, the results of the queries it runs on your data, and (for voice) your audio. Credentials for your data sources are never sent to the model.

Under Google Cloud’s terms, Google does not use this data to train its models. We don’t use your business data or chats to train AI models either.

When an agent searches the web or does deep research, it sends search queries to Google Search. Agents are instructed not to put your private business data into those queries.

AI answers can be wrong. Please check important numbers and decisions; see our Terms of Service.

5. Google user data

If you sign in with Google or connect Google data, we access only the following:

Google sign-in (openid, email, profile): your email address and Google’s confirmation of it, to create your account and sign you in.
Google Sheets and Drive (drive.file): only the specific spreadsheets you choose in the Google file picker, to read their contents into your workspace. We can’t see your other Drive files.
Google BigQuery (bigquery.readonly, cloud-platform.read-only): read-only access to list your Google Cloud projects and datasets and read the dataset you choose, to copy it into your workspace.

We use this Google user data only to provide those features to you. We don’t use it for advertising, we don’t sell it, and we don’t transfer it to others except as needed to provide the Service, to keep it secure, to comply with law, or as part of a merger or sale of the business with your data protected under this policy. People at HunterViz don’t read it unless you ask us to (for support), it’s needed for security or to comply with law. We don’t use Google user data to develop, improve or train generalized AI or machine-learning models.

HunterViz’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove HunterViz’s access at any time from your Google Account’s third-party access settings, or by deleting the data source in HunterViz.

6. The Mobile app

The HunterViz Mobile app for iPhone, iPad and Android phones and tablets (the “Mobile app”) signs in to the same account and shows the same workspaces as app.hunterviz.com, so everything in this policy applies to it. This section covers what is different on a phone.

What the app keeps on your phone

Your session: the app’s sign-in tokens, and a random identifier and secret for this installation, are kept in the iPhone’s Keychain or Android’s encrypted storage, never in plain app storage. They stay on this phone: they aren’t synced to your other devices or moved to a new phone in a backup.
A short cache of the screens you saw last (for example your workspace list, chats and notifications), so the app opens quickly and has something to show offline. It is encrypted (AES-256-GCM) with a key kept in the Keychain or Android’s encrypted storage. Each entry is never used after 7 days and is deleted the next time the app starts. A workspace’s entries are deleted once it is no longer in your list, and the whole cache, with its key, is deleted when you sign out or are signed out remotely.
No files: files are never kept on the phone for offline use. A file you send to another app or the share sheet is written to a temporary file and deleted within minutes.
Settings, such as your appearance choice, and the random identifier for crash reports and analytics (below).

App lock

The Mobile app opens only after Face ID, Touch ID, a fingerprint, face unlock or your phone’s passcode, and asks again after 5 minutes in the background. Your phone’s operating system does this check: HunterViz never receives your fingerprint, face or passcode, only whether the check passed. A phone with no passcode can’t use the app. While the app is locked, and in the app switcher, its screen is hidden.

Your devices

For each phone or tablet signed in to the Mobile app we keep a device record: the random identifier the app made when it was installed (never taken from the phone’s hardware) and a one-way hash of its secret; the name, model and system version the phone reports; the app’s version; when it was first and last seen; and its push token, if you allow notifications. Your devices are listed in your account, where you can sign any of them out: that ends its session and the web pages it opened, and stops its notifications. “Sign out everywhere”, changing your password and deleting your account sign out every device.

Push notifications

If you allow notifications, the app gets a push token through Google Firebase Cloud Messaging (and Apple’s Push Notification service on iPhone and iPad), and we keep it on that device’s record. A push shows the same text as the notification’s email, values from your data included, with a link that opens in the app. It is delivered by Firebase Cloud Messaging and, to iPhones and iPads, by Apple. Whether it shows on your lock screen is your phone’s setting. You choose which kinds of notifications reach you by push, by email and in the app, and you can turn pushes off in your phone’s settings. When you sign out, the app forgets its token and we stop sending to it.

Microphone, camera and photos

The microphone is used only in Voice mode, and only while Voice mode is on screen. Your audio is sent as described in section 4 and is never saved on the phone.
The camera and your photo library are used only when you choose to take or pick a photo or file to upload. What you pick is uploaded where you chose (a chat or a folder); the app reads no other photos.
The app doesn’t ask for your location, contacts or calendar.

Signing in

Google: Google’s sign-in runs in your phone’s browser, and the app receives a one-time code that only it can use.
Sign in with Apple (on iPhone and iPad): we receive the email address Apple confirms for your Apple Account and Apple’s identifier for you. We accept only your real address, not a “Hide My Email” relay address, because workspaces invite and recognize people by their address. Apple may also send your name the first time you sign in; we don’t keep it.

Crash reports and analytics

The Mobile app uses Google Firebase Crashlytics (crash reports) and Google Analytics for Firebase (app analytics). They receive crashes and errors with their stack traces, each error’s type and our error code (never its message); the names of the screens you open and the same event names as the website (such as a sign-in attempt or a dashboard opened), with choices and counts but never what you type; your device’s model, system version, language and the app’s version; and the approximate location (such as the country) Google works out from your IP address. They know the app by a random identifier made when it was installed, not by your account, your email or your device record, and deleting the app forgets it. We never send them screen text, chat content, voice, files, workspace names or business data. We don’t collect the advertising identifier, or Apple’s identifier for vendors. Crashlytics keeps crash reports for 90 days.

Pages shown inside the app

Dashboards, the document editor and reports open inside the app as web pages, from app.hunterviz.com and from a dashboard’s own provider (such as Looker Studio, Power BI or Tableau). The app signs these pages in with a one-time ticket that works only in that page’s web view. They keep their own cookies inside the app (section 12) and use Google Analytics as the website does (section 2); a provider’s page is covered by that provider’s own policy. Other links open in your phone’s browser.

7. Store customers’ data

When a store turns on customer support, HunterViz processes data about that store’s customers (“Store customers”) for the store. They aren’t HunterViz users and have no account. We use it only to run what the store set up: sending email it approved or set rules for, its support inbox, and the refunds, cancellations, replacements and discount codes it approved. We don’t sell it or use it to train AI models. The store decides how its customers’ data is used, so customers should contact the store first. Our Data Processing Agreement sets out how we handle it for the store. This section applies only to a store with customer support on.

What we hold, and why

From the store’s orders: the email address, first name, marketing consent and country of each customer, beside their orders in the store’s dataset, to know who an email can go to and to greet them. Their order history is there too, as it is for every store. On a store connected through the HunterViz Shopify app, these details are loaded only while customer support is switched on for the workspace, and phone numbers and street addresses aren’t kept with the orders. If its switch goes off, we clear them within about an hour. If we switch customer support off for everyone, they go on loading for about a day in case that’s undone, then are cleared. A plan change doesn’t clear them by itself: if the plan is cancelled, loading stops, and they’re deleted with the workspace’s other data 90 days later (section 9).
Emails sent: the customer’s email address and each email’s text, and whether it was delivered, opened or clicked, for the email itself and for the results a store sees (marketing emails only are tracked for opens and clicks).
The support inbox: if a store forwards its support address to HunterViz, each message its customers send, with its attachments, and the replies. An AI model drafts a reply from the message (section 4), and a person sends it, or a rule the store set up does.
Store actions: a refund, cancellation, replacement order or discount code a person at the store proposed or approved, with the customer’s name and email address. To make a replacement order we read the shipping address and phone from Shopify when it’s proposed and applied, and pass them back to Shopify; we don’t keep them.
Likely buyers: scores worked out from a customer’s own order history, to suggest who a sale may interest.

Who sees it

Only the store’s Support team, while customer support is on: its owners and admins, and the members they name. Everyone else’s agents may count and summarize a store’s customers but can’t name them, and neither can anyone’s while the details are being cleared after customer support goes off. This limit covers the agents and alerts in HunterViz; a workspace can still reach its own data in other ways it has set up, such as a dashboard tool connected to it. Our staff can read a chat only if it’s shared with support (section 2).

Sending email, consent and unsubscribing

Emails go through MailerSend, from the store’s own domain or an address of ours in the store’s name. An email about the customer’s own order goes whether or not they signed up for marketing. Any other email goes only to customers Shopify says are subscribed to the store’s marketing just before it goes, never to anyone who unsubscribed, and always with an unsubscribe link and the store’s postal address. Each store has its own unsubscribe list, which isn’t shared with another. It holds scrambled addresses, not the addresses themselves, and stays until the workspace is deleted, so an opt-out outlasts the store leaving and coming back.

How long, and erasure

Emails, conversations, store actions and attachments are deleted after 2 years. After 2 years we also empty what identifies a customer on old order records (name, email, phone, street address and notes); the order’s figures, customer id, country, province and marketing-consent setting stay. When a store turns off customer support, we clear all the customer details we loaded for it. Either can happen sooner when a customer is erased. A store connected some way other than the HunterViz Shopify app keeps these details on its order records as long as its orders. Deleted data can remain in our backups for up to 14 weeks, and in BigQuery’s recovery storage for about 14 days.
A customer’s erasure request reaches us through the store or Shopify. When it does, we erase their emails, conversations and attachments at once. Afterwards we keep their scrambled address so they get no more email, one-way records that a rule already acted for them, a line for each store action with nobody in it, and, for Shopify’s request on a store connected through the HunterViz Shopify app, one-way records of their Shopify customer and order ids so a later copy from Shopify doesn’t load those orders again. MailerSend’s copy goes within hours to days. On a store connected through the HunterViz Shopify app, Shopify’s request also removes their orders from the store’s dataset.
When a store removes the HunterViz app, Shopify’s request 48 hours later erases all of this for that store, except the unsubscribe list and the one-way records above. Deleting the workspace removes them too.
What a member copied into a chat, a file or an agent’s answer stays where they put it until it’s deleted.

If you’re a customer of a store and have a question or request about your information, contact the store. You can also email us; we’ll pass it to the store or act on it as the law requires.

Inside your workspace

Workspace members can see the workspace’s dashboards and data according to their role. Workspace owners and admins can see the workspace’s activity log and its members’ Agent Team chats. A workspace’s data access policy controls whether agents may read its data.

Service providers

We use these providers to run the Service. They process information for us under their own security and privacy commitments:

Google Cloud: hosting (Cloud Run), databases (Firestore), data warehouse (BigQuery), secret storage (Secret Manager), AI models (Vertex AI Gemini), task scheduling and logging. Data is stored in the United States.
Google: Google sign-in, the Google Drive, Sheets and BigQuery connections you choose, Google Analytics, and Google Fonts; in the Mobile app, Google Firebase (crash reports, app analytics and delivering push notifications) and Google Play.
Apple: in the Mobile app, Sign in with Apple, delivering push notifications to iPhones and iPads, and the App Store.
Stripe: payments and subscriptions.
Google Firebase Hosting: hosting for the hunterviz.com website.
FullStory: how visitors use hunterviz.com (section 2).
Google Workspace and MailerSend: sending email. MailerSend also sends a store’s emails to its customers and receives what they send its support inbox (section 7).
Shopify: we read from a connected store with the access you grant and, with customer support on, make the changes a person approves. A workspace that pays through its Shopify store is charged on that store’s Shopify bill.
Other sources you connect: we read from them with the access you grant.

Other reasons

We may disclose information if required by law or to protect the rights, safety or property of our users, the public or HunterViz. If HunterViz is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, and this policy will continue to protect it.

9. How long we keep it

Your account: until you delete it (the Account page, or the Mobile app; see “Deleting your account” below). Deleting your account removes your sign-in details, your Personal workspace and its data, your memberships and your shares. Chats, reports and requests you made inside other people’s workspaces stay with those workspaces, labelled “Deleted user”, because they belong to the business; ask the workspace owner if you want them removed.
Deleted workspaces: hidden at once and restorable for 30 days; then their dashboards, data sources, BigQuery data, chats and reports are permanently deleted.
Deleted data sources: their stored credentials and their tables in your workspace’s BigQuery dataset are removed.
Cancelled paid plans: data loading stops, and the workspace’s BigQuery data is deleted 90 days after cancellation (we email the owner 14 days before).
Chats: until you or a workspace owner or admin deletes them, or the workspace is deleted.
Documents: a file or folder deleted in Documents goes to the trash for 30 days, where it can be restored, and is then permanently deleted with every version (the folder’s owner, or a workspace owner or admin, can delete it permanently sooner). Versions a published update names, or that were signed in a review, are kept as long as those are. Each top-level folder also keeps a history of its changes: who changed what and when, with the names of its files and subfolders and their version numbers, never the files’ contents. A file or subfolder deleted from it, even permanently, is still named in that history until its entries are thinned out as they age (an entry someone named, or one marking a published update or a signed review, is kept longer). The whole history is deleted when the top-level folder is. Files you give an agent in a chat have no trash and no history: deleting them deletes them at once.
Mobile app devices: a device’s record, with its push token, is deleted 60 days after the device was last used, and at once when you delete your account.
On your phone: the Mobile app’s cache is never used after 7 days, and everything the app keeps is deleted when you sign out or delete the app (section 6). Crash reports: 90 days.
Activity log: entries are kept as a record of what happened, but IP addresses are removed after 90 days, and at once when you delete your account.
Server logs: about 30 days. Security records such as rate limits and failed sign-ins: from minutes to a day.
Backups: our database backups are kept for up to 14 weeks, so deleted information can remain in backups until they expire.
Store customers’ data: section 7.
Billing records: kept as long as required for tax and accounting. Stripe and Shopify keep their own records under their policies.

10. Security

The Service runs on Google Cloud. Data is encrypted in transit (HTTPS) and at rest. Data source credentials are kept in Google Cloud Secret Manager. Each workspace’s business data is kept in its own BigQuery dataset, access is limited by role and by each workspace’s data access policy, and important actions are recorded in an activity log. The Mobile app keeps its session in the phone’s secure storage, opens only behind App lock, and keeps only a short, encrypted cache (section 6). No system is perfectly secure, but we work to protect your information and will notify you as required by law if a breach affects it. To report a security issue, email security@hunterviz.com.

11. Your rights and choices

Access and correction: you can see and change your account and workspace details in the app, or ask us for a copy of the personal information we hold about you.
Deletion: delete data sources, chats, workspaces or your whole account on the website or in the Mobile app, or email us (see “Deleting your account” below).
Notifications: choose for each kind of notification whether it reaches you by push, by email or in the app, on the website or in the Mobile app’s notification settings, and turn pushes off in your phone’s settings.
Phone permissions: you can turn off HunterViz’s access to the microphone, camera, photos or notifications in your phone’s settings at any time. The features that need them stop working until you allow them again.
Devices: see every phone and tablet signed in to your account, and sign any of them out, on your Account page.
Google access: revoke it from your Google Account at any time.
Analytics: you can block analytics cookies in your browser or use Google’s opt-out add-on.
Emails: service emails (such as security notices and receipts) are part of the Service; we don’t send marketing email without your permission.

Depending on where you live (for example California, other U.S. states, the EU or the UK), you may have additional rights, such as to know, correct, delete, port or restrict the use of your personal information, and to not be discriminated against for using them. We will honor these requests as the law requires. Email ammon@mobilelifeagent.com; we may need to verify your identity first. If your request is about business data a company connected, we may direct you to that company.

Deleting your account

You can delete your HunterViz account and its data yourself, at any time:

In the Mobile app: More, Account, Delete account.
On the website: sign in at app.hunterviz.com, open your Account page and choose Delete account.
Or email ammon@mobilelifeagent.com from your account’s address, and we will delete it for you.

You can also visit our dedicated Account and Data Deletion Request page to submit an email deletion request and learn more about data erasure and retention.

First hand over or delete any workspace you own other than your Personal workspace. What is deleted, and what stays with other people’s workspaces, is described in section 9. Deleting the Mobile app from your phone doesn’t delete your account.

12. Cookies and similar technologies

Name	Purpose	Lasts
`access_token`, `refresh_token`	Keep you signed in (secure, not readable by scripts)	15 minutes; 7 days
`session`	Sign-in steps, where to return after signing in, a question you typed before signing up	14 days
`hv_device`	Recognize this browser to warn you about new sign-ins	180 days
`hv_ws`, `hv_agent_ws`	Remember the workspace you last used	30–90 days
`hv_webview`	In the Mobile app’s web pages only: ties a page’s one-time sign-in to that web view (the sign-in lasts 4 hours at most)	While the app keeps that web view
`_ga`, `_ga_*`	Google Analytics	Up to 2 years
FullStory’s cookies	On our website’s pages only: how visitors use them	Set by FullStory
Browser storage (`hv.theme`, `hv.sidebar.collapsed`, `hva_*`)	Your theme and layout preferences; how you first found us	Until you clear it

The Mobile app keeps its own data on the phone as described in section 6.

13. Other things to know

Where data is stored and processed: we store data in the United States. If you use the Service from elsewhere, your information is transferred to the U.S. AI requests go through Google’s global service, so they may be processed elsewhere. If a store uses customer support, its customers’ email is handled by MailerSend, which hosts data in the European Union and may process it in the United States and elsewhere.
Children: the Service is for businesses and is not directed to children under 16. We don’t knowingly collect their information; if you believe a child has given us information, contact us and we will delete it.
Do Not Track: browsers’ “Do Not Track” signals aren’t standardized, so the Service doesn’t respond to them.
Changes: we may update this policy. The version and date at the top tell you which one applies. For material changes we will tell you by email or in the app before they take effect.

14. Contact us

Ammon Hunter, doing business as HunterViz
Utah, United States
Email: ammon@mobilelifeagent.com