Privacy Policy

1. Who we are

This service — a WhatsApp appointment-reminder and messaging platform for appointment-based businesses (working name: Hokzen Agenda, the "Service") — is operated by Hoko Global OÜ, an Estonian company, registry code 16595567, registered address Narva mnt 5, 10117 Tallinn, Estonia ("we", "us"). Contact: info@hokzen.com.

2. Scope and our two roles

• For business customers' account data (registration, billing, configuration), we act as data controller.
• For the personal data our business customers process through the Service — their clients' names, phone numbers, appointment details and message contents — we act as data processor on behalf of the business, which remains the controller. A Data Processing Agreement (DPA) is available on request at info@hokzen.com.

If you are a client of a business that uses the Service (e.g. you received an appointment reminder on WhatsApp), that business is responsible for your data; contact them first, or reach us at info@hokzen.com and we will assist.

3. Data we collect

• Account data: name, email, business name, sector, timezone, language, password (hashed) or Google sign-in identifier.
• Calendar data: with your authorization, we read upcoming events from your connected calendar (Google Calendar, Microsoft Outlook or an ICS feed): event titles, dates/times, and contact details (such as phone numbers) contained in them. We may write appointment status updates back to your calendar.
• WhatsApp messaging data: phone numbers, message contents and delivery metadata of conversations between the business and its clients conducted through the Service.
• AI feature data: if the business enables the AI assistant, message contents are processed by an AI model provider to generate replies (see Section 7).
• Billing data: handled by Stripe; we do not store full card numbers.
• Usage and technical data: logs, feature usage, device/browser information.

4. Why we process data (legal bases)

• To provide the Service (contract): sending reminders and messages on the business's behalf, syncing calendars, showing conversations, billing.
• To secure and improve the Service (legitimate interest): abuse prevention, quality monitoring, aggregated analytics.
• Marketing communications (consent): only if you opt in; unsubscribe anytime.
• We do not sell personal data. We do not use your calendar or message data for advertising.

5. WhatsApp messaging

Messages are delivered through the WhatsApp Business Platform (Cloud API) operated by Meta Platforms. Message content and phone numbers are processed by Meta as part of delivery, under Meta's own terms and privacy policy. Recipients can opt out of messages at any time by replying STOP / BAJA; the Service enforces this automatically.

6. Calendar data and Google API Limited Use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we only use Google Calendar data to provide the Service's user-facing features (detecting upcoming appointments, extracting the contact to notify, and writing back confirmation status); we do not transfer it except as necessary to provide these features, do not use it for advertising, and do not allow humans to read it except with your permission, for security purposes, or to comply with law. AI/ML: calendar data is not used to train generalized AI or ML models. Microsoft calendar data is treated under the same standards.

7. AI features

When a business enables the AI assistant, conversation messages are sent to an AI model provider (such as Anthropic or OpenAI) to generate replies — either through our platform account or through the business's own API key. We configure these integrations so that data is not used to train the providers' models. Businesses can disable the AI assistant at any time; reminders keep working without it.

8. Sub-processors and third parties

Meta Platforms (WhatsApp Business Platform) · Google (Calendar API, sign-in) · Microsoft (calendar) · Supabase (database & authentication, hosted in the EU) · Stripe (payments) · Anthropic / OpenAI (AI replies, if enabled) · telephony/number providers (e.g. Twilio/Vonage, if we provision a number for you) · hosting and error-monitoring providers. A current sub-processor list is available at info@hokzen.com.

9. International transfers

We host core data in the European Union. Some providers (e.g. Meta, AI providers) may process data in the United States; where they do, transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

10. Retention

Account data: for the life of the account and up to 12 months after closure (except invoicing records kept as legally required). Message contents: for the retention window configured by the business (default 12 months). Calendar sync data: only the rolling window needed to operate reminders. Backups: up to 35 days.

11. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to processing: write to info@hokzen.com. You may lodge a complaint with the Estonian Data Protection Inspectorate (AKI) or your local authority (in Spain, the AEPD). If your data was processed on behalf of a business using the Service, we will redirect or assist with your request as processor.

12. Security

Encryption in transit (TLS) and at rest, encrypted storage of credentials and API keys, role-based access, tenant isolation, audit logging, and EU-region hosting.

13. Deleting your data

See our Data Deletion Instructions. Summary: businesses can delete conversations, disconnect calendars, or delete the entire account (Settings → Privacy) — deletion is completed within 30 days; message recipients can contact the business or us at info@hokzen.com.

14. Changes and contact

We will post updates on this page and notify account holders of material changes. Questions: info@hokzen.com.