Privacy Policy

When you create an account or sign in to the Himaya platform, we collect:

• Your email address, used solely to identify your account and send essential service communications
• Basic usage metadata, such as login timestamps and feature access logs

We do not collect sensitive personal data beyond what is strictly necessary for account management and service operation.

Product usage and monitoring. To keep the platform reliable and improve it, we record how the Himaya console is used: which pages are opened and which controls are clicked, identified only by internal user and organization IDs. We use PostHog (hosted in the United States) for product usage analytics and Datadog for application performance and error monitoring. These records never include email content, subjects, sender or recipient addresses, attachment names, or Google user data; on-screen text is masked before anything is sent. Organization administrators can turn product usage analytics off in Settings.

Your email address is used to:

• Authenticate your account and maintain your session
• Send security-related notifications, such as password resets and access alerts
• Deliver product updates and service announcements, if you have opted in

We do not sell, rent, or share your email address with third parties for marketing or advertising purposes.

To detect threats, Himaya processes the email in mailboxes that your organization’s administrator connects, including headers, sender details, message content, links, and attachments. This processing happens only to provide email security and data protection to your organization, within your organization’s tenant. It is not shared externally except where required to perform the service, such as threat intelligence lookups and the AI processing described below.

What Google data we receive. When an organization’s Google Workspace administrator connects Himaya, we receive the organization’s list of users and groups. When the administrator also grants mailbox access through domain-wide delegation, we receive the email in the mailboxes they choose to protect.

How we use it. Only to provide Himaya’s email security and data protection features to that organization:

• Choosing which mailboxes and groups Himaya protects, and keeping that list current
• Detecting phishing, malware, spam, and data loss in those mailboxes
• Quarantining or restoring messages when the organization’s policy says to
• Explaining findings to the organization’s administrators

What we never do with it.

• Use it, whether raw, aggregated, anonymized, or derived, to create, train, or improve any AI or machine learning model, ours or anyone else’s
• Transfer it to a third party that uses it to train AI or machine learning models
• Sell it, or use it for advertising
• Let Himaya personnel read it, except with the organization’s permission, to investigate security issues or abuse, or to comply with the law

AI providers we use. Himaya sends message content to the following AI services only to analyze it for the purposes above: Amazon Bedrock (Amazon Web Services), Microsoft Azure OpenAI and Azure AI Foundry (Microsoft), and the Anthropic API. We use each under paid commercial terms that do not allow the provider to train or improve its models on our customers’ data. Models hosted on Amazon Bedrock and Azure AI Foundry run in the cloud provider’s infrastructure, and the data is not shared with the model’s developer.

Account and operational data is retained for the duration of your active subscription. Upon account termination, personal data is deleted within 30 days, subject to any applicable legal obligations requiring longer retention.

Organization administrators can set how long Himaya keeps email content, message records, quarantined messages, scan history, and audit logs in Settings, within limits that keep security investigations and compliance evidence possible.

You may request deletion of your account at any time by contacting us at legal@himaya.ai.

We use industry-standard security practices to protect your data, including TLS encryption in transit and hashed credential storage at rest. Access to personal data is restricted to authorized personnel only.

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal data. To exercise any of these rights, contact us at legal@himaya.ai.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of the platform after changes constitutes your acceptance of the updated policy.