Privacy,
made clear.

What This Policy Covers

This Privacy Policy explains how Hermia handles personal information in connection with its CRM-agnostic intake, qualification and business-operations service. It covers what we collect or receive, why we use it, who we may disclose it to, how long we keep it, and the privacy rights available to you.

Hermia supports businesses across industries and does not generate, purchase, source, or advertise for leads. On a client’s instructions, Hermia can organise relevant enquiry or operational details from connected email, messaging, forms, CRM platforms, and other supported business systems, then prepare or route that information through the client’s configured setup.

Hermia is operated from Victoria, Australia. This policy is designed to support the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and it should be read with the Hermia Service Agreement. Where the Service Agreement deals with subscription, trial, refund, or cancellation terms, those terms continue to apply.

Your Data & Your Customers’ Data

There are two broad categories of information involved when a business uses Hermia. The distinction matters because the business, not Hermia, owns the customer relationship and decides how its enquiries are handled.

Business and account data includes information about the client business and its authorised users, such as business and contact details, ABN, selected subscription tier, billing and invoice records, account configuration, and support history. Hermia uses this information to establish and manage the service.

Customer, enquiry, and operational data includes information a client already receives or creates in the course of its business. This may include names, contact details, site or account information, requests, documents, photos, video, voice notes, availability, configured fields, and other qualification responses. The client remains responsible for that data and Hermia processes it only to provide the service on the client’s instructions.

Information We Handle

Depending on how a client uses Hermia, we may handle the following categories of information.

How We Use Information

Hermia uses information only for purposes reasonably connected with providing, administering, securing, and supporting the service. This includes the following activities.

• Reading, organising, and qualifying existing enquiries from the business inboxes and channels the client has connected.
• Using the client’s configured questions and custom fields to identify the detail needed to prepare an enquiry for action.
• Processing customer-provided text, photos, video, or voice notes to understand the service request, urgency, site context, and supporting job detail.
• Preparing and routing approved enquiry or operational information into the client’s connected CRM or business system, including relevant customer, account, site, and request context.
• Supporting communications, notifications, summaries, and follow-up steps that the client has chosen to use within the service.
• Managing the client’s plan, 2-day trial, subscription, invoicing, payment status, refund or cancellation request, and support relationship.
• Counting each client’s enquiries every month, and keeping a record of each enquiry counted (the person’s name, email address or phone number, the date and time, and the channel), so the client can see how its plan was worked out and billing questions can be resolved.
• Maintaining service quality, preventing misuse, investigating faults, and complying with legal obligations.

When Hermia communicates with an end customer through a client’s approved setup, its first message says that it is the business’s digital assistant and names the business, for example: “Hi Sam! I’m Hermia, the digital assistant for Harbour Plumbing.” This identifies Hermia as an automated assistant and the client as the business responsible for the request. Hermia never presents itself as a person: if a customer asks whether they are talking to a person, Hermia says that it is an AI assistant. A customer can ask for a person at any time: Hermia gives them the contact details the business set for this, and sends the person the business nominated (or the people who receive its briefs) the customer’s name, number, what they have said and their answers so far, so that person can contact them. A customer can stop messages at any time by replying STOP (or QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE).

Operational replies to an enquiry are treated differently from marketing. Hermia does not decide that a person should receive marketing. The client must select the purpose, provide the relevant lawful basis or consent, identify itself as the sender where required, and provide a clear way to unsubscribe. Hermia may record and apply an opt-out or suppression request so future automated messages are not sent through that setup.

Automated Steps & Decisions

Hermia uses computer programs, including artificial intelligence, to carry out the steps of the service quickly and the same way every time. Hermia does not decide anyone’s legal rights, and the client’s team makes the business decisions about each enquiry.

The guide on the setup page. While a business sets up Hermia, an animated guide explains each step, out loud if the visitor leaves its voice on, and answers questions about setting up Hermia. A question typed or spoken to the guide is sent to our artificial intelligence and speech providers only to answer it; a spoken question is turned into text first. The guide is given the question, the step being shown, the industry, the plan chosen and the options on that step. It is not given the name or contact details typed into the setup page; anything else the visitor types or says in a question is sent with it (web and email addresses are removed first). Hermia does not keep the questions or the recordings. The microphone is used only from when the visitor taps the guide’s microphone until it stops listening, and the browser asks the visitor’s permission first.

The chat on our website, and emails to us. A message typed into the chat on our website is sent to our artificial intelligence providers only to write Hermia’s reply, and Hermia does not keep it after answering. An email to info@hermia.au may be read by the same providers to write a first reply about Hermia; the email itself stays in our mailbox, like any other email we receive.

From 10 December 2026, the Australian Privacy Principles require a privacy policy to explain when a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person. We describe Hermia’s automated steps here even where that threshold may not be met, so clients and their customers can see how they work.

Sharing & Safeguarding Data

Hermia only discloses personal information where that is necessary to provide the service, where a client has directed us to do so, or where the law permits or requires it. Depending on the client’s configuration, this can include the following.

• The client’s connected email, messaging, CRM, forms, and other business systems that the client has chosen to connect, so relevant enquiry or prepared operational information can be handled as instructed.
• Payment and billing providers used to process subscriptions, invoices, trial conversions, refunds, or cancellations. They handle payment information under their own privacy terms.
• Trusted service providers that help Hermia operate and support the service, where they are required to protect the information and use it only for the relevant service purpose.
• Regulators, courts, law-enforcement agencies, or other parties where disclosure is required or authorised by law, or is necessary to protect legal rights, safety, or the integrity of the service.

Hermia’s main database is hosted in Australia. Some of the providers that help run the service process information in other countries, mainly the United States and countries in the European Union, and their global networks may carry information through other countries. Hermia uses contractual, technical, and organisational safeguards appropriate to the service and will identify relevant provider categories in the client’s service documentation where required. Clients remain responsible for assessing their own overseas-disclosure notices and obligations, and Hermia will reasonably assist with that assessment. How Hermia processes customers’ information for its clients, including the terms for transfers between countries, is set out in the Data Processing Terms.

How information is held. Information is held electronically in secured cloud systems. It is encrypted in transit, and Hermia’s main storage is encrypted at rest. Each client’s information is kept separate: every record is tied to that client’s account, and Hermia’s systems check that link before anything is read, changed or sent. Access is limited to authorised personnel, systems and service providers with a legitimate need to know.

Hermia uses commercially reasonable organisational and security safeguards designed to protect personal information against unauthorised access, misuse, loss, and disclosure. No system can guarantee absolute security, so clients should also protect their own email, CRM, and account access.

If Hermia suspects a security incident affecting personal information, we will investigate, contain and remediate it and notify the affected client promptly where reasonably practicable. Whether individuals or the OAIC must be notified depends on the applicable law, the relevant APP entity, and whether the breach is likely to result in serious harm.

Retention & Data Lifecycle

Hermia retains business-account information for as long as is reasonably necessary to provide the service, manage the subscription and billing relationship, resolve enquiries or disputes, and meet legal or record-keeping obligations. Enquiry and operational data is handled only for the period reasonably necessary to provide the service the client configured.

Enquiry records for plans. For each enquiry Hermia counts towards a client’s plan, Hermia keeps the person’s name, email address or phone number, the date and time, and the channel for 6 months, and then deletes the name and contact details. The count itself and the monthly totals are kept without personal details. Only the client the enquiry was made to can see these records, through a private link that opens only with its customer ID.

Agreement records. The record of each client’s acceptance of Hermia’s terms — the name, position and business legal name typed at payment, the email used, what was ticked, and exact copies of the documents accepted — is kept as a legal record for seven years after the client’s agreement ends, or longer if it is needed for a legal claim.

Information that has been placed in a client’s own mailbox, CRM, or other connected business system remains under that client’s control. The client is responsible for managing, correcting, retaining, or deleting information stored in those systems according to its own obligations and settings.

When a client disconnects a service or ends its subscription, Hermia will stop processing future information through that connection, subject to the client’s directions and any information we must keep for legal, accounting, security, or dispute-resolution purposes.

Hermia does not record live calls or private conversations. Voice notes and videos a customer sends, and voicemail messages left with the Missed calls feature, are written out as text so the customer’s answers can be read and checked. If a client enables call recording or a similar feature, the client is responsible for providing any required notice and obtaining any consent required by the applicable state, territory, or country. Recording data is used only for the approved purpose and is subject to the applicable retention settings.

Your Rights, Access & Deletion

You may ask Hermia for access to, or correction of, personal information that Hermia holds about you. You may also ask us to delete personal information that we no longer need to hold. This may include account details, account configuration, inbox or CRM connection records, qualification and configuration records, and other information held in connection with your Hermia account.

For a verified request, we will respond within 30 days. Where deletion is appropriate, we will delete or de-identify the relevant information within that period unless we are required or permitted to retain it for legal, billing, security, or dispute-resolution reasons. We will confirm the outcome by email.

Where information has already been routed to a client’s CRM or other connected system, or remains in the client’s connected inbox, the client controls that copy. We can explain what remains in the client’s environment, but the client will need to manage deletion or correction there.

For customer or enquiry data, an individual should normally contact the business they dealt with, because that business collected or controls the relevant relationship. Hermia will reasonably assist its client with a request that relates to the Hermia service.

If you have a privacy complaint, please first contact us at info@hermia.au. We will investigate and respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au.