Privacy Notice
Version 1.4 · Effective 30 August 2026
This is the privacy notice from the legal text available inside Her:Him. Privacy and Terms together describe the service.
2. who operates her:him
Novi Forum d.o.o. operates the Service and is the controller for personal data processed for the Service. Registered office: Ulica Roberta Frangeša-Mihanovića 6, 10000 Zagreb, Croatia. Croatian tax ID (OIB): 92006302133. Website: https://her-web-1055904984243.europe-west3.run.app. Privacy, data-rights and support contact: info@novi-forum.com.
3. what Her is — and is not
Her and Him are AI personas, not people. The Service uses generative AI and can produce inaccurate, incomplete, inappropriate or outdated statements. It may misunderstand speech, memory or external sources. Verify anything important. The Service is for companionship, reflection and entertainment. It is not a doctor, therapist, lawyer, financial adviser, emergency service or substitute for a qualified professional. If you may harm yourself or someone else, contact local emergency services or a crisis service immediately.
4. data we process
Depending on the features you use, we process: account and sign-in identifiers (such as user ID, email and name supplied by Apple, Google or Supabase); profile choices such as language, persona, city, country and timezone; live audio while a call is active; conversation transcripts, titles, timestamps and duration; feedback and settings; bounded turn-taking measurements such as speaking duration, reply pauses, interruptions and word count; and technical, security, usage, cost and audit events. We do not create a voiceprint or use your voice for biometric identification. If you use the device biometric lock, Apple or the device operating system performs that check locally; Her receives only whether the unlock succeeded. Memory data may include facts, preferences, people, projects, decisions, open threads and episodes you discuss. Derived memory may include interaction patterns, recurring themes, links between events, changes over time, likely next steps, confidence and supporting evidence. These are probabilistic AI inferences, not diagnoses or objective facts. If you enable them, we also process public-search queries and results, approximate location for local ideas or weather, push tokens and delivery state, and read-only results from connected Google or Microsoft accounts. Purchases include product, transaction, price, environment, credit and refund status; we do not receive your full payment-card number from Apple or Google. Data comes from you, your device and sign-in or connected providers, public sources selected by search tools, purchase and notification providers, and the inferences described above.
5. why we use data and our legal bases
We process account, conversation, memory, tool and purchase data to provide the Service you request, keep conversations coherent, deliver purchased time and support account controls (performance of our contract). Optional account connections, background discovery and proactive notifications rely on the specific permission you give in the app; you may withdraw it without affecting earlier lawful processing. We use proportionate technical logs, fraud checks, quality controls and safety rules for our legitimate interests in operating a secure and reliable service. We process records when necessary to comply with tax, accounting, consumer, law-enforcement or data-protection obligations. We do not use your personal data for behavioural advertising or sell it. We do not train a public or general-purpose foundation model on your conversations. OpenAI processes Her’s API inputs and outputs under its business/API data controls, which do not use API data for model training by default; limited safety or abuse-monitoring retention may still apply under those controls. A material change to this use would require an updated notice and acceptance where required.
6. conversation, memory and personalisation
Conversation audio is sent for real-time speech and AI processing. Her does not store raw audio; the transcript is stored under your account when a conversation ends. Transcripts and relevant existing memory can be sent to the AI model to answer the current turn and to extract or update memory. Objective turn-taking measurements may be compared with your own earlier conversational baseline. They are not a voiceprint and do not by themselves establish an emotion, motive or personality trait. Her should adapt silently first and mention an observable change only after repeated evidence across conversations. Her may retrieve recent episodes and graph links, consolidate repeated evidence into broader patterns, notice trajectories or expectation changes, and surface a useful connection later. Those mechanisms exist to improve relevance and continuity, not to make legal or similarly significant decisions about you, score you for eligibility, advertise to you, or optimise dependence and attachment. You can inspect and delete individual memories, delete conversations, export all available account data, erase Her’s memory, or delete the account. Disconnecting a source stops future access but does not automatically erase a memory already derived from it; use the Memory screen for that.
7. live web search
When an answer depends on current public information, Her may create a short query and send it to Tavily and Parallel. The providers return sources and excerpts; Her may compare or combine them before answering. Search sources and AI summaries can still be wrong, outdated or misleading. A deterministic privacy gate blocks passwords, passcodes, API keys, access tokens, private keys and similar secrets with no override. Email addresses, phone numbers, exact addresses, health, financial, relationship, private-project and other sensitive or private identifiers are blocked by default. They may be included only when you explicitly ask, in that current turn, to search that specific detail. General acceptance of these Terms, old conversations or stored memory is not permission for a sensitive search. When relevant, an already established preference for a public venue, shop, cultural place or public website may be used to make the query and source ordering more useful. The preference affects relevance only; current schedules, prices, opening times and web claims must still come from current search evidence. Search providers may use fast or turbo retrieval modes so a useful result can return during the same voice turn. Her may open a specific public page only when it was returned by a tool in that conversation or you supplied its URL. Each destination and redirect is checked against private network addresses; page text is treated as untrusted content. Short source cards and links may be retained with the transcript for a limited period.
8. Her initiative and notifications
If you enable the corresponding switches, Her may look for a relevant public news item, event or idea, use an approximate city for local plans, use weather to shape an opening, follow up on something you asked her to remember, or send an occasional push notification. Planning may use your chosen interests, open threads, established public-place or public-source preferences, past delivery history, timezone, quiet hours and conversation count. Background queries are limited to generic public topics. They must not contain names, private projects, health, financial or relationship details, or an exact address. After you explicitly enable it, push can begin as soon as a candidate clears the relevance and safety thresholds; it remains subject to device permission, quiet hours and the frequency level you choose. You can switch each initiative permission off in Connections and disable notifications in device settings.
9. optional Google and Microsoft access
Google connection requests read-only access to calendar lists, events, availability and contacts. It does not request Gmail or Drive access. Microsoft connection requests read-only access to the user profile, Outlook calendars, mail and contacts; work accounts may also grant read-only access to Teams, chats and channel messages. Her cannot create, edit, send, reply to or delete content through these integrations. Short-lived OAuth access tokens are sent to our backend and encrypted at rest. Relevant requests and results may be processed by our backend, OpenAI and Google or Microsoft to answer you. Disconnect first revokes the backend copy; provider-side authorisation can also be removed in your Google or Microsoft account settings.
10. other knowledge and utility tools
When relevant to what you ask, Her may use Wikidata and Wikimedia services for stable public entities and relationships; Semantic Scholar, operated by the Allen Institute for AI (AI2), for scientific papers and citation metadata; and PubMed/NCBI E-utilities for general medical, psychology and biology evidence. Medical queries sent to NCBI must be general and non-identifying, and results are not a diagnosis or personal treatment recommendation. Scientific and medical source material can be wrong, incomplete or unsuitable and important claims should be checked in the original publication. Her may also use Google Maps Grounding Lite for weather and routes; Wolfram for calculations and curated factual data; USDA FoodData Central for generic nutrition data; Open Food Facts for community-supplied product and barcode data; and a contracted, curated psychology reference service for general knowledge. The psychology service receives general reference questions, not personal data intended to identify or profile you. For public YouTube requests, Google’s YouTube Data API may be used to find videos. TranscriptAPI.com and Supadata may receive the public YouTube video ID or URL to retrieve available captions; Supadata may also generate a transcript from the public video when captions are unavailable. Tavily may be used only as a bounded fallback. Her does not send these providers your identity, conversation, memory or private details as part of a video transcript request. All external tools are read-only. Food, allergy, medical, route, weather and calculation results must be independently checked when safety or an important decision is involved.
11. service providers and recipients
Not every provider is used for every user or every conversation. Depending on the feature, data may be processed by: OpenAI (voice, language models, embeddings and AI analysis); Supabase (authentication); Google Cloud (hosting, database, encryption-key and secret infrastructure); Neo4j (graph memory); Tavily and Parallel (public web retrieval); Wikimedia Foundation services including Wikidata (public entity data); Allen Institute for AI/AI2 including Semantic Scholar (scientific publications and metadata); the US National Library of Medicine/NCBI including PubMed and E-utilities (medical and life-science publications); operators of public pages that Her opens from a returned source or at your request; Zero Point Studio d.o.o. through TranscriptAPI.com and Dumpling Software UG through Supadata (public video captions and transcript processing); Apple (sign-in, App Store purchases and push notifications); Google (sign-in, Google Play purchases, Maps, YouTube Data API, Calendar and Contacts); Microsoft (sign-in and Graph services for Outlook and Teams); Wolfram; USDA FoodData Central; Open Food Facts; and our curated psychology knowledge partner. We send only the data reasonably needed for the selected function. Providers also process technical request metadata under their applicable terms, privacy notices and our agreements. We may disclose data when legally required, to protect users or the Service, or as part of a corporate transaction subject to appropriate confidentiality and notice obligations.
12. retention and deletion
Raw conversation audio is not retained by Her. Account data, transcripts, memory, derived patterns, settings and authorized connected-source records are normally kept while the account exists so the requested continuity works, unless you delete the relevant item, conversation, memory or account sooner. External search excerpts, article abstracts, provider payloads and synthesized public facts are not kept as reusable knowledge. Minimal public-source provenance may be kept for transcript links and audit but is never reused to answer. A completed research handoff is available once in the conversation that requested it and normally expires within twenty minutes; pending retry metadata expires within a short operational period. These records are separate from personal memory and are removed with the related conversation or account. Expired or disconnected OAuth access tokens are no longer used; backend token copies are removed on a confirmed disconnect. Device tokens are removed on deregistration or account deletion. Account deletion removes the active account, authentication record, conversations, memory graph, settings, devices and user-linked purchase and audit rows. A minimal deletion marker, payment or transaction notification, fraud-prevention evidence, consent record, security log or other record may be kept separately only for as long as a legal, accounting, dispute or security obligation requires. External providers apply their own documented retention rules to requests they process.
13. security
We use transport encryption, authenticated per-user access, encrypted storage for OAuth tokens, managed key and secret services, provider-scope limits, audit events and deletion controls. Search credentials remain on the backend. No system is perfectly secure; contact us immediately if you believe your account or data has been compromised.
14. international processing
Some providers may process data outside Croatia or the European Economic Area. Where the GDPR requires a transfer mechanism, processing must be covered by an adequacy decision, appropriate contractual safeguards or another lawful mechanism. Contact us for information about the safeguard applicable to a specific provider or transfer.
15. your privacy rights
Subject to applicable law, you may request access, a copy, correction, deletion, restriction, portability or objection; withdraw an optional consent; and lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) or your local supervisory authority. In-app Memory, export, disconnect and account deletion controls provide the fastest route for common requests. For anything else, email info@novi-forum.com. We may need to verify identity before acting.
16. age
The Service is not intended for anyone under 16. Do not create or use an account if you are younger than 16. Contact us if you believe a child has provided personal data contrary to this rule.
21. contact
Questions, complaints and data-rights requests: info@novi-forum.com. Please do not send passwords, access tokens or other secrets by email. Terms and Privacy Notice version 1.4, effective 30 August 2026.
Request deletion without the app
Visit our account deletion page for the in-app steps and an email route if you cannot access the app.