Privacy Policy

Application: Hermes AI Agent · Website: https://hafizhagent.biz.id · Effective date: 13 October 2026 · Last updated: 13 October 2026

This Privacy Policy explains how Hermes AI Agent ("the Application", "we", "us") accesses, collects, uses, stores, shares and deletes information — including information obtained from Google APIs — when you use the Application. It applies to the Application itself and to this website.

In short: Hermes AI Agent is a personal automation assistant. It accesses your own Google Workspace data only to carry out the instructions you give it. It does not sell your data, does not use it for advertising, and does not share it with third parties for their own purposes. You can revoke access and request deletion at any time.

1. Who we are

Hermes AI Agent is developed and operated by Hafizh Bakrie, an individual developer. For any privacy question or request, contact hafizh.bakrie@gmail.com. This is the data controller for the purposes of this policy.

2. What information the Application accesses

2.1 Information you provide directly

Instructions and prompts you type or speak into the Application, and any files or text you supply as source material.
Configuration data you enter, such as your preferred default services and assistant settings.

2.2 Google user data

When you connect a Google Account through Google's OAuth 2.0 consent screen, the Application may access the following categories of Google user data, strictly according to the scopes you approve:

Google service	Data accessed	Purpose
Gmail	Message metadata, headers, bodies, attachments and labels in your own mailbox (`gmail.readonly`, `gmail.modify`, `gmail.send`).	To search, read, summarise, label, draft and — only on your explicit instruction — send email from your own account.
Google Drive	File and folder names, metadata and file contents you own or can access (`drive`).	To locate, read, download, create and organise files in your own Drive when you ask the Application to do so.
Google Calendar	Calendar list, event details, attendees and free/busy information (`calendar`).	To check your availability, create events and send meeting invitations on your behalf.
Google Docs	Document content you own or can edit (`documents`).	To create and edit documents from source material you provide.
Google Sheets	Spreadsheet content, cell values and structure (`spreadsheets`).	To read and update spreadsheets, append records and maintain recurring reports.
Google Contacts	Names, email addresses and basic contact fields (`contacts.readonly`).	To address email and calendar invitations to the correct people.
Google Account profile	Your name and email address associated with the authorised account.	To identify whose account is connected and to display it in the Application.

The Application requests no scope beyond those listed above, and each scope is used only for the purpose stated in the same row.

2.3 Technical information

OAuth tokens (access and refresh tokens) issued by Google, needed to call Google APIs on your behalf.
Basic diagnostic logs such as timestamps, error messages and API response codes, used to keep the Application working and to troubleshoot faults. These logs do not contain the content of your email, documents or spreadsheets.

3. How we use Google user data

Google user data accessed by Hermes AI Agent is used exclusively to:

Execute the instructions you give. For example, if you ask the Application to summarise this week's email, it reads those messages and produces a summary for you.
Provide the features described on our home page — email management, document generation, spreadsheet automation, calendar coordination and file organisation.
Maintain security and reliability — detecting misuse, diagnosing errors and preventing unauthorised access.

We do not:

Sell or rent Google user data to anyone.
Use Google user data for advertising, marketing, profiling or any form of behavioural targeting.
Use Google user data to train or improve generalised machine-learning models. Data is processed only to answer your own request.
Transfer Google user data to third parties for their own purposes.
Allow humans to read your Google user data, except where you have given explicit consent for a specific request, where it is necessary for security purposes such as investigating abuse, or where required by applicable law.

Limited Use disclosure. Hermes AI Agent's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Where data is processed and stored

Locally on your own machine. Hermes AI Agent runs on hardware you control. Instructions, credentials and any working data are stored on that machine under your control.
Google APIs. Requests to read or modify your Google data are made directly from your machine to Google's servers over HTTPS.
Assistant model processing. To generate a natural-language answer, the content of your instruction — and, where necessary, the specific Google content needed to fulfil it — may be sent to the AI model provider configured by you in the Application, solely to produce the response to your request. Which provider is used is determined by your own configuration, and you can change or remove it at any time. This transfer is for the sole purpose of answering your own request and is not used for advertising or profiling.

5. Retention

OAuth tokens are retained until you disconnect the Google Account or revoke access. Once revoked, the stored token can no longer be used and is deleted on the next cleanup cycle.
Local working data (caches, generated files) is retained on your own machine until you delete it. You can remove it at any time.
Diagnostic logs are retained for a maximum of 30 days and then deleted automatically.

6. Sharing and disclosure

We do not sell, trade or rent your personal information. We disclose information only in these limited situations:

At your direction. When you instruct the Application to send an email, share a document or invite an attendee, that action is performed on your behalf.
Service providers under our control. Infrastructure strictly necessary to operate the Application (for example, hosting or the model provider you configure), which process the data only on our instructions and for the purposes described here.
Legal requirements. Where required by law, regulation or valid legal process, or to protect the rights, property or safety of users or the public.

7. Security

We take reasonable and appropriate measures to protect information, including:

Transport encryption (TLS/HTTPS) for all communication with Google APIs.
OAuth tokens stored with restrictive file permissions, readable only by the account running the Application.
Access to Google APIs limited to the scopes you approve.
No plaintext storage of Google account passwords — authentication is OAuth only.

No method of transmission or storage is 100% secure. While we work to protect your data, we cannot guarantee absolute security.

8. Your rights and choices

8.1 Revoke Google access

You can revoke Hermes AI Agent's access to your Google Account at any time at https://myaccount.google.com/permissions. Once revoked, the Application can no longer access your Google data.

8.2 Request deletion of your data

You may request deletion of any data stored by the Application by emailing hafizh.bakrie@gmail.com with the subject line "Data Deletion Request". We will:

Acknowledge your request within 2 business days.
Delete the relevant data — including stored OAuth tokens and any server-side copies — within 30 days.
Confirm by email once deletion is complete.

You may also delete locally stored data yourself by removing the Application's data directory on your own machine.

8.3 Access, correction and portability

You may request a copy of, or correction to, any personal data we hold about you. Because the Application stores the great majority of its data locally under your own control, most of these requests can be satisfied directly on your machine.

9. Children's privacy

Hermes AI Agent is a professional productivity tool and is not directed at children. We do not knowingly collect personal information from children under 13 (or the minimum age required in your jurisdiction). If you believe a child has provided us with personal information, contact us and we will delete it.

10. International data transfers

Google APIs are operated by Google and may process data in various countries. Where data is transferred internationally, we rely on appropriate safeguards consistent with applicable law and on Google's own compliance framework for its APIs.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be highlighted on this page. Continued use of the Application after an update means you accept the revised policy.

12. Contact

Questions, concerns or requests about this Privacy Policy or your data:

Email: hafizh.bakrie@gmail.com
Application: Hermes AI Agent
Website: https://hafizhagent.biz.id

We aim to respond to all privacy and data-related enquiries within 2 business days.