Privacy Policy

Hubify Solutions Inc. operates Ash, an AI assistant for businesses, at hiash.ai. This policy explains what personal information we handle, why we handle it, and what you can ask us to do about it.

It covers two different relationships, and the difference decides who is answerable for what. When you visit hiash.ai or become a customer, we are the organisation responsible for your information. When Ash answers calls and messages for your business, we handle your clients' information on your behalf and under your instructions — you remain the organisation your clients deal with, and the one accountable to them.

We operate in British Columbia, Canada and are subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and to British Columbia's Personal Information Protection Act (PIPA).

Almost nothing unless you write to us, and that is deliberate. hiash.ai sets no cookies, runs no analytics, and loads nothing from a third party — the typefaces are served from this domain, and no script, pixel or font is fetched from anywhere else when you open a page. There is no cookie banner because there is nothing to consent to.

The server that serves this site keeps ordinary request logs, which include IP addresses, for security and diagnostics. Cloudflare sits in front of the site and keeps its own logs for the same reasons.

The contact form is the one place this site collects anything about you, and only what you type into it: your name, your email address, what kind of business you run, and whatever you tell us about how it works today. It is delivered to us as an email through Resend, our mail provider, and it is not stored in a database on this site. We use it to reply to you and to work out whether Ash is a good fit. It goes on no mailing list, and the form sets no cookie and runs no tracker — the only thing recorded alongside a submission is the network address it came from, briefly, so that the form cannot be used to send thousands of them.

If you email us instead, we keep that correspondence so we can reply to it and so we have a record of what was agreed.

When a business connects Ash to its phone number, calendar, email and CRM, Ash handles information about the people who contact that business. What it handles depends on what those people say and send.

Ash records the calls it answers. This is the most sensitive thing it handles, so it is set out separately rather than left inside a list.

Recordings are kept for 30 days and then deleted automatically. We do not keep an archive beyond that period, and we cannot retrieve a recording once it has passed.

Within that window, a recording is available to the business the call was placed to — its owner and the people they have authorised. It is not shared with other customers, and we do not listen to recordings except where it is necessary to investigate a fault or a security incident, or where the law requires it.

Under Canadian privacy law an organisation must have meaningful consent to collect personal information, and a person must know that a call is being recorded and why.

The business using Ash is the organisation with the relationship to its callers, and it is responsible for ensuring that its callers are informed and that recording is permitted where it and its callers are located. Our Terms of Service place that obligation on the customer explicitly. We provide the tools and the retention limits; we are not in a position to know what a given business has told its clients.

If you have called a business that uses Ash and you want to know what was recorded or ask for it to be deleted, contact that business directly. They control the record. If you cannot reach them, write to us at [email protected] and we will help you find the right route.

When a business connects its WhatsApp Business number to Ash, messages travel through the WhatsApp Business Platform, which is operated by Meta Platforms, Inc. Meta handles them under its own terms as well as ours.

The WhatsApp Business Account stays the business's own. Ash connects to it as a technology provider, on the business's instruction, and it can be disconnected at any time — which ends our access to it.

Connecting WhatsApp is not like connecting a phone line or a mailbox, and it is set out separately because of that. WhatsApp does not simply forward new messages from the moment it is connected. It also hands over what is already there. That is a larger and more personal body of information than anything else Ash receives, and it should be read before connecting rather than after.

Imported conversations and contacts are held for as long as the WhatsApp connection is in place. They are the record of a business's relationship with the people in them, and discarding them would leave Ash answering the second half of a conversation it never saw the first half of.

When a business disconnects WhatsApp, or closes its account, what was imported is deleted within 30 days. Anything already written into that business's own CRM stays there, because it is theirs — the same rule that applies to every other channel.

We do not use the content of imported conversations to train machine learning models. That commitment is made elsewhere in this policy about everything Ash handles; it is repeated here because this is the material where it matters most.

The business owner did. The people in those conversations did not, and neither did the people in the contact list.

This is the same division of responsibility that applies to call recording, and it lands the same way. The business has the relationship with those people; we handle their information on its instructions. The business is responsible for satisfying itself that importing that history is consistent with what it has told them and with the law where it and they are located. Our Terms of Service place that obligation on the customer explicitly.

If you have messaged a business that uses Ash and want to know what was imported, or want it deleted, contact that business directly — they control the record. If you cannot reach them, write to [email protected] and we will help you find the right route.

To answer calls and messages on behalf of a business, to book appointments in its calendar, to keep a record of its clients in its own CRM, to send its daily summary, and to let its owner review what happened. We also use information to operate, secure and support the service itself.

We do not sell personal information. We do not share it with advertisers. We do not use the content of a customer's calls, messages or client records to train machine learning models.

Some uses are ruled out whatever would be technically possible or commercially convenient. They are listed rather than implied, so that there is something specific to hold us to.

Ash is a tool for businesses and is not directed at children. We do not knowingly collect information about one, and nothing Ash does is designed to.

It answers whoever contacts a business, though, so we cannot rule out that a young person writes to one that uses it. WhatsApp requires its own users to be at least 13, and at least 16 in parts of Europe. If you believe a child's information has reached us and should not have, write to [email protected] and we will delete it.

Ash is built on services provided by other companies, and running it means information passes through them. Each is used for a specific purpose and is bound by its own agreement with us.

Several of these providers operate outside Canada, primarily in the United States. That means information may be stored or processed outside Canada and may be accessible to foreign courts and law enforcement under the laws of those countries. This is disclosed here because British Columbia's PIPA requires it.

Call recordings are deleted after 30 days, automatically.

Imported WhatsApp conversations and contacts are deleted within 30 days of the connection being removed or the account being closed.

Client records written into a customer's CRM belong to that customer and live in their account — we do not control how long they are kept there, and deleting a business's Ash account does not delete what has already been written into their own systems.

A contact form submission is kept as correspondence — it arrives as an email and is retained like any other enquiry, for as long as it is useful and so we have a record of what was discussed. Ask us at [email protected] and we will delete it.

Account and billing records are kept for as long as the account is open and afterwards for the period Canadian tax and corporate law requires. Correspondence is kept while it is useful for support.

You may ask what personal information we hold about you, ask for a copy of it, ask us to correct it if it is wrong, ask us to delete it, and withdraw consent for its use — subject to legal and contractual limits, and noting that withdrawing consent may mean we can no longer provide the service.

Deletion has its own page, because the answer depends on which side of the service you are on and the route differs: see Data Deletion at hiash.ai/data-deletion. It also explains what deletion cannot reach, which is the part most people are surprised by.

For anything else, write to [email protected]. We will respond within 30 days, which is the period PIPEDA sets. We may need to verify who you are before disclosing anything, because handing personal information to the wrong person is itself a breach.

If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner for British Columbia.

Credentials for connected accounts are encrypted. Each business's data is kept separate from every other business's. Access to production systems is limited to the people who need it to operate the service.

No system is perfectly secure, and we would rather say so than imply otherwise. If a breach occurs that creates a real risk of significant harm, we will notify the affected customers and the Privacy Commissioner as the law requires.

We will update this page when what we do changes, and the date at the top will change with it. If a change materially affects how personal information is handled, we will tell customers directly rather than relying on them to notice.

Questions about this policy, or a request about your own information: [email protected].

Hubify Solutions Inc. is incorporated in British Columbia, Canada and operates from Coquitlam. We are a small company and do not publish a street address. If you need one in writing — to serve a formal notice, or to support a complaint to a regulator — ask at [email protected] and we will give it to you.