Privacy Policy
1. Who we are
1.1 Holoh Workspaces (the "Service") is provided by TMRW Spain S.L.U. ("TMRW", "we", "us"), a company registered in Spain.
- Registered address: Av. Jean Claude Combaldieu N5, 03008 Alicante, Spain
- Tax ID (NIF/CIF): B42557777
- Registry details (Registro Mercantil, volume, folio, sheet): Registro Mercantil de Alicante; Tomo 4139; Folio 57; Hoja A-160929
- Privacy contact: feedback@holoh.com
- Data Protection Officer: Not appointed. The law does not require one for our processing (Article 37 GDPR; Article 34 of Organic Law 3/2018). Privacy questions go to the privacy contact above.
1.2 This policy explains how we handle personal data when you use the Service at holoh.app, our desktop apps for macOS and Windows, and our websites. It applies under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Spain's Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights ("LOPDGDD").
1.3 TMRW also operates the product "9pm". The earlier Holoh product at holoh.com has its own privacy notice. This policy covers Holoh Workspaces only.
2. Our two roles: controller and processor
2.1 When your organisation uses the Service, your organisation is the controller of the content in its workspaces: messages, files, meetings, recordings, transcripts, AI conversations and memory. We process that content as a processor on your organisation's behalf, under our Data Processing Agreement (DPA). If you are a member of an organisation, contact your organisation's administrator first about that content. We will help your organisation answer your request.
2.2 We are the controller for:
- (a) account and sign-in data;
- (b) billing and contract data;
- (c) security, abuse-prevention and service logs;
- (d) error reports;
- (e) usage metering used for billing;
- (f) support requests and bug reports you send us;
- (g) opt-in agent-improvement data (clause 6.9);
- (h) business contact data from demo requests and other enquiries. We do not send marketing email;
- Free-plan organisations are professional users like any other, so their workspace content is processed under 2.1.
3. What data we process
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, profile picture, sign-in identifier, preferred spoken language, organisation and role | You, your organisation, our sign-in service |
| Organisation data | Organisation name, members, invitations (invitee email), join requests and their message, workspace settings | Organisation admins and members |
| Workspace content | Chat messages, direct messages, reactions, mentions, drafts and scheduled messages, files and images, whiteboards, pinned items | Users |
| Meeting data | Meeting titles, agendas, invitees (including external email addresses), lobby admit and deny decisions, participation times and durations, call ratings and comments | Users and the Service |
| Meeting audio and transcripts | Each participant's own microphone audio, in speech segments, when meeting AI, transcription or recording is on; transcripts with speaker and language; recordings when recording is on | Each participant's device |
| Call media | Live audio and video streams, screen shares, display names | Participants, through our call provider |
| Guest data | Display name a guest types to join a meeting; temporary guest identity | Guests |
| AI interactions | Prompts, files and context you give the AI assistant or agents, AI outputs, agent instructions, agent memory (personal and workspace notes, decisions and facts, with revision history), agent task logs | Users and the Service |
| Connected services | Encrypted access tokens for services you connect (for example GitHub, Microsoft 365), and data the AI reads from them at your request | You and the connected service |
| Usage and metering | AI model used, token counts, machine time, included usage and credits used, credit balance and purchases, the person who triggered each AI turn | The Service |
| Technical data | IP address (used briefly for rate limiting and security, not stored in our database), device and browser type, device identifiers, settings saved on your device | Your device |
| Error reports | Technical error details with personal data removed (clause 6.8) | Your device and our servers |
| Bug reports | Your description, technical context (including your browser's user agent), logs and screenshot you choose to send, optional contact address | You |
| Billing data | Billing contact, company name, VAT ID, billing address, invoices. For purchases in the Service, Stripe is the seller. Card details are held by Stripe, not by us | You, Stripe |
3.1 We do not intentionally process special categories of data (GDPR Art. 9). Meeting and chat content may contain such data if users include it. We do not use voice or video to identify people biometrically.
4. Why we process data and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Service, accounts and workspaces; process content on your organisation's instructions | Contract (6(1)(b)); for content, your organisation's instructions under the DPA |
| Sign-in, security, fraud and abuse prevention, rate limiting | Legitimate interests (6(1)(f)): keeping the Service secure |
| Billing, invoicing, tax and accounting records | Contract (6(1)(b)) and legal obligation (6(1)(c)) |
| Measuring AI usage against included usage and credits, and billing | Contract (6(1)(b)) |
| Error monitoring and fixing defects | Legitimate interests (6(1)(f)): a working, reliable Service |
| Transactional email (invitations, account email) | Contract (6(1)(b)); for invitations sent to non-users, the inviting organisation's legitimate interests |
| Support and bug reports | Contract (6(1)(b)) or legitimate interests (6(1)(f)) |
| Agent-improvement data (clause 6.9) | Consent (6(1)(a)) |
| Legal claims and compliance with authority requests | Legal obligation (6(1)(c)) and legitimate interests (6(1)(f)) |
5. AI features
5.1 The Service includes an AI assistant ("Holoh"), AI agents, meeting AI, captions, transcription and summaries. When you use them, the content needed for the task is sent to an AI model (clause 8). AI requests through our own model gateway go to models we host ourselves and, through OpenRouter, to providers that do not train on the data. Most keep no data at all (zero data retention); Anthropic and Google may keep requests for a limited time for safety and abuse monitoring. For organisations where the in-call assistant is enabled, the asker's microphone audio is sent directly to Google Vertex AI Live through its EU endpoint, without OpenRouter. We decide which models are available in the Service.
5.2 We do not use your content to train AI models, and we require our AI providers not to train on it. Clause 5.1 says which providers may keep requests, and for what. The only exception is the opt-in agent-improvement data in clause 6.9, and only for its stated purposes.
5.3 Confidential AI. In confidential AI, AI requests are encrypted on our servers and processed only inside confidential-computing hardware operated by Privatemode, whose software is checked by remote attestation. When the provider updates its software, we may use the new version at once and complete our own verification within 96 hours; if verification fails, we stop using it. The AI provider cannot read the content. If verification fails, the request stops; it never falls back to a non-confidential model.
5.4 AI outputs can be wrong. They are labelled as AI-generated in the Service. We do not make decisions with legal or similarly significant effects about you based solely on automated processing (GDPR Art. 22).
6. Meetings, audio, transcripts and recording
6.1 How capture works. Each participant's app captures only that participant's own microphone. The microphone stream may remain open while muted; muted audio is not encoded or sent for meeting transcription or recording. Unmuted audio is compressed and sent to our servers. We do not record other participants from your device.
6.2 Meeting AI. When meeting AI is on, audio is transcribed so that the AI can follow the meeting. Everyone in the call sees an indicator ("AI is present in this call"). The organiser can switch meeting AI on or off for each meeting. Organisation and workspace admins can set defaults and lock it off.
6.3 Transcription and recording. If someone switches transcription or recording on, a transcript (and, for recording, audio) is kept, and a separate indicator is shown. Who can read a transcript is controlled by meeting access.
6.4 Live captions. Captions can run even when meeting AI is off. In that case audio is transcribed live to display captions, and nothing is stored or made available to the AI.
6.5 Your organisation's responsibility. Your organisation decides whether to use meeting AI, transcription and recording, and must give participants (including employees and external guests) the information the law requires, and obtain consent where needed. In Spain this includes the employer's duties under LOPDGDD Arts. 87–89 when meetings are used in employment.
6.6 Microsoft Teams meetings. When you join a Microsoft Teams meeting through the Service, Microsoft and the Teams meeting organiser control that meeting. If the Teams meeting is recorded, you are asked for consent before your audio and video are sent. Holoh does not record or transcribe Teams meetings.
6.7 Guests. Guests join with only a display name. Guest access expires 12 hours after creation. Identity rows, including display names, become eligible for the daily deletion sweep 24 hours after expiry. With the daily sweep, deletion normally occurs about 36–60 hours after creation.
6.8 Error reports. Error reports go to Sentry, in its EU region, and contain errors only, never message content. We remove message content, cookies, headers and request bodies; we do not store IP addresses; and we replace your user identifier with a keyed hash. Confidential workspaces and confidential agents send no error reports.
6.9 Agent-improvement data (opt-in). We may ask to keep the content of AI interactions to improve our prompts, tools and models. It is off by default and needs opt-in at up to three levels: the organisation enables it; each user opts in for their personal assistant; workspace admins opt in per workspace. We keep another person's words only if that person has also opted in. In calls, each speaker's words are kept only if that speaker opted in. Guests' words and confidential AI content are never kept; confidential AI requests are recorded as metadata only (timing, token counts, model), without content. Raw data is kept for 30 days. Selected evaluation examples are kept for up to 12 months. If you withdraw, we stop collecting; data already collected is not deleted. This feature is currently offered to internal TMRW users only.
7. How long we keep data
| Data | Retention |
|---|---|
| Account data | For the life of the account. Deleted within 30 days after you ask us to delete your account (feedback@holoh.com). |
| Workspace content | Until deleted by users or the organisation. Deleted workspaces have a 30-day restore window. Automatic purging is not implemented; their content remains stored after that window. Self-service organisation deletion is not currently available. |
| Meeting transcript entries used only for live AI | Deleted when the call ends |
| Kept transcripts and recordings | Until deleted by the organisation |
| Guest identities | Access expires after 12 hours; identity rows become eligible for daily deletion 24 hours after expiry (normally about 36–60 hours after creation). |
| Invitations | 7 days, unless accepted |
| Agent task files | 30 days |
| Agent memory | Until deleted; personal memory is purged when the member leaves the organisation |
| Bug reports | 90 days |
| Unsent uploads | 24 hours |
| Usage and metering records | For the life of the organisation. Records that support an invoice are kept as billing records. |
| Billing records | 6 years, or longer where tax law requires |
| Error reports | Up to 90 days |
| Server logs | Up to 7 days |
| AI gateway request logs | 30 days, plus up to 35 days in backups |
| Agent-improvement data | 30 days raw (clause 6.9) |
| Backups | 35 days, then deleted. Data deleted from the Service stays in backups until they expire; a restore does not re-apply it. |
8. Who we share data with
8.1 We use subprocessors to run the Service. The current list, with purpose and location, is at /terms#subprocessors.
8.2 We do not sell personal data. We share data with authorities only where the law requires it, and with professional advisers under confidentiality.
8.3 Data you send to a service you connect (for example GitHub) is handled under that service's terms as well as ours.
9. Where data is stored, and international transfers
9.1 We are based in Spain. We host the Service in the European Union by default: our databases, file storage and chat state are held in Cloudflare's EU jurisdiction, and calls use Microsoft's EU data location. This is our practice, not a promise that all data stays in the EU.
9.2 Some subprocessors are outside the EU; they are marked in the subprocessor list. Processing locations and identified transfer mechanisms are listed there. Transfer mechanisms for Tavily and smol machines are not specified in this document. We do not use processors hosted in China for customer content.
10. Your rights
10.1 You have the right to access, correct, delete, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time (without affecting earlier processing).
10.2 To exercise a right, write to feedback@holoh.com. We reply within one month, extendable by two months for complex requests. We may need to verify your identity. Where we act as processor for your organisation, we pass your request to your organisation and help it respond.
10.3 You can request deletion of your account in the Service; we complete it by hand. Self-service data export is not available. An organisation's owner or admin can request an export of the organisation's shared content in the Service (direct messages are not included), and we prepare it by hand.
10.4 Complaints. You can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to the authority where you live or work. We would welcome the chance to address your concern first.
11. Cookies and storage on your device
11.1 We use only cookies and device storage that are strictly necessary to provide the Service. We do not use advertising or analytics cookies. Under Article 22.2 of Spain's Law 34/2002 (LSSI-CE), strictly necessary storage needs no consent.
| Name | Type | Purpose | Duration |
|---|---|---|---|
__hws_session | Cookie (HttpOnly) | Keeps you signed in | 30 days; 12 hours for guests |
__hws_oauth_tx, __hws_oauth_retry | Cookie (HttpOnly) | Protects the sign-in flow | 10 minutes |
hws-chat-v*-<user> | Browser database (IndexedDB) | Caches recent messages so chats open quickly and work offline | Entries expire after 7 days; removed on sign-out; your organisation can switch it off |
| Calendar cache | Browser database (IndexedDB) | Caches your calendar view | Cached entries are used for up to 7 days and removed on sign-out; abandoned caches become eligible for removal after 30 days. |
| Device preferences | localStorage | Camera and microphone choice, recent emoji, last open chat, notices already shown | Until you clear them |
| Desktop sign-in token | Encrypted file in the desktop app | Keeps you signed in on the desktop app, encrypted with your operating system's key store | Until sign-out |
11.2 Fonts are self-hosted; loading them does not send your IP address to Google Fonts.
12. Security
12.1 We use encryption in transit, encryption of stored access tokens (AES-256-GCM), access controls by role, audit logs for administrative actions, and EU data storage by default. Details are in Annex 2 of our DPA.
13. Children
13.1 The Service is for professional use by people acting for a business, organisation or profession. It is not directed at children. If we learn that we hold data of a child under 14 without required authorisation, we delete it.
14. Changes to this policy
14.1 We will post changes here and update the date above. If a change materially affects you, we will tell you by email or in the Service before it takes effect.