Privacy policy of Hombee sp. z o.o.

Who is the controller of your data?

Hombee spółka z ograniczoną odpowiedzialnością with its registered office in Długołęka, ul. Modrzewiowa 4, 55-095 Długołęka, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for Wrocław-Fabryczna in Wrocław, 9th Commercial Division of the National Court Register under KRS number 0001113273, NIP: 8961640851, REGON: 529020800, with share capital of PLN 15,000.00, fully paid up.

What data do we collect?

We collect the data needed to operate and improve the Website, contact you, prepare an offer and, when you consent, send marketing emails, including:

1. First and last name
2. Email address
3. Phone number
4. Investment data (e.g. location, type of building)
5. The content and basic metadata of files that you voluntarily attach to an enquiry, such as designs, drawings, BIM/CAD files, documents, photographs or archives
6. Marketing consent evidence, including its scope, time, source, displayed notice version and Pipedrive synchronisation status
7. Google Ads click and campaign identifiers and the related session consent state, when applicable
8. Website usage and technical data collected by PostHog, including page views, page leaves, clicks, the assigned feature-test variant, input-change and form-submission metadata, element text and attributes, browser and device details, performance measurements and errors; before consent or after rejection these events use a daily rotating server-side hash rather than a browser identifier, while accepted optional cookies can also enable a persistent browser identifier, heatmap data and session replay data; standard form inputs are masked in session replay by default

For what purpose do we process your data?

The collected personal data is processed solely for the purpose of:

1. Contacting you to prepare an individual offer.
2. Sending the requested Hombee Home offer and, when selected, its limited 12-message follow-up series.
3. Sending the Hombee newsletter when you separately subscribe.
4. Analyzing Website use, finding errors, understanding interaction patterns, running feature tests, and improving content and user experience.
5. Measuring Google Ads conversions and, with your Google Ads consent, creating Customer Match audiences, remarketing and personalizing ads.
6. Performance of the contract.
7. Archiving correspondence related to the performance of the contract.

Legal basis for data processing

Processing necessary to answer an enquiry, prepare an offer or perform a contract is based on Article 6(1)(b) of the GDPR. Processing Website usage and technical data through cookieless PostHog for security, diagnostics, conversion measurement, product testing and improvement is based on our legitimate interest under Article 6(1)(f) of the GDPR. You can object to this analytics processing for the current browser on the analytics exclusion page. Storing a persistent PostHog browser identifier and using consent-dependent PostHog features, Google Ads advertising storage and submitted contact details for enhanced conversions, Customer Match, remarketing and ad personalization, and recording the related evidence is based on your consent under Article 6(1)(a) of the GDPR and the applicable electronic communications rules. Sending the 12-message Hombee Home series or the Hombee newsletter is based on the separate marketing consent collected with the relevant form. You may withdraw consent at any time without affecting the lawfulness of earlier processing.

How long do we keep your data?

Files attached to a contact enquiry are stored in private cloud storage for up to 180 days and are then deleted automatically. Contract and enquiry data is stored for the period necessary to handle the request or perform the contract and afterwards for the period required by law, but no longer than 5 years. PostHog changes the cookieless server hash every day. After you accept optional cookies, the PostHog browser identifier may remain for up to 365 days unless you withdraw consent, disable analytics or clear browser data. PostHog events, errors, heatmap and feature-flag data, and session recordings are retained according to the retention settings of our PostHog Cloud EU project and no longer than needed to analyze the Website or complete the related test. Google Ads click attribution stored in the browser is retained for up to 90 days after consent is granted. Customer Match membership is configured for up to 540 days and is refreshed while the related Pipedrive consent remains granted. Marketing contact data is used until consent is withdrawn or the limited Hombee Home series ends. Evidence of consent or withdrawal is then retained only for as long as necessary to demonstrate compliance or establish, pursue or defend legal claims.

With whom do we share your data?

Your data may be shared with carefully selected service providers that help us operate the Website, handle enquiries, protect against abuse, send consented marketing communications, analyze Website use, test product changes, and measure or personalize advertising. This includes Cloudflare as our website and infrastructure provider, Pipedrive as our customer relationship and email marketing system, PostHog for product and web analytics, conversion measurement, session replay, heatmaps, error diagnostics and feature flags in PostHog Cloud EU, and Google for consented Google Ads conversion measurement, Customer Match, remarketing and ad personalization, but only to the extent necessary for those purposes or when required by law.

Your rights

You have the right to:

1. access your data,
2. rectify incorrect data,
3. delete data,
4. restrict data processing,
5. object to data processing,
6. object to PostHog analytics for the current browser on the analytics exclusion page, withdraw marketing consent or change the Google Ads consent for the current browser session at any time; requests concerning previously submitted contact data can be sent to the data protection contact below.

Cookies

Our website uses cookies and local storage for website and contact features, analytics, and optional advertising features. Before you choose and after you reject optional cookies, PostHog uses cookieless measurement without storing an analytics identifier in your browser. PostHog generates a daily rotating server-side hash from the project, hostname, IP address, user agent and a daily salt, then removes the IP address before storing the cookieless event. In this mode, PostHog can assign an A/B test variant and record its display, click and outcome without storing the experiment context in cookies or local storage. Session replay is unavailable. If you accept all optional cookies, PostHog stores a first-party browser identifier and related settings in cookies and local storage to associate page views and interactions with the same browser. Under the current SDK defaults, the identifier may remain for up to 365 days. PostHog may then load project-enabled session replay, heatmap and error tracking features. Your analytics choice is stored in local storage. You can disable PostHog completely for this browser on the analytics exclusion page. When the embedded third-party chat widget is loaded, an essential third-party cookie (`__cf_bm`) may be set for bot protection. This cookie cannot be disabled while chat is enabled. Your Google Ads approval or decline is stored separately in a first-party browser-session cookie (`hb_ads_consent`) that contains only `granted` or `denied`.

Embedded YouTube videos

The Website may embed videos from Hombee’s official channels on YouTube. We use the privacy-enhanced mode of the YouTube player (`youtube-nocookie.com`) to limit personalisation by YouTube. According to YouTube, viewing a video in this mode is not used to personalise the user’s YouTube experience or advertising shown outside our Website.

1. the external YouTube player is loaded only on pages where we have embedded a video,
2. after playing a video, going to YouTube, or interacting with the player, data may be processed by Google/YouTube in accordance with the rules of those services,
3. videos are embedded to present Hombee product and technical content without requiring users to leave the Website.

Google Ads consent mode and tag gateway

Website pages initialise a local Google consent queue with advertising storage, advertising user data and ad personalization denied by default and without making a Google Ads network request. To limit performance impact, the external tag is loaded only after a relevant signal, such as a recognised Google Ads visit, the first interaction with a lead form or chat, or an accepted enquiry. If advertising consent is declined or has not been resolved, Google Consent Mode may send cookieless, redacted measurement requests that do not use advertising cookies or include the email address or phone number submitted in a form. After approval, advertising storage, advertising user data and ad personalization are enabled for the session. An accepted form conversion may include the submitted email address and phone number as user-provided data for Google Ads enhanced conversions for web, and normalized, hashed contact details may be used to create Customer Match audiences for remarketing and personalized ads. Tag and measurement requests are routed through Hombee’s Cloudflare Google Tag Gateway endpoint (`/metrics`). Offline conversion measurement is a separate server-side process and uses only attribution data collected with advertising consent. Review or change your optional-cookie choices.

1. ordinary page views without a recognised Google Ads visit, lead-form or chat interaction, accepted enquiry, or earlier approval do not load the external Google Ads tag,
2. declining stores a session-only decline cookie, prevents advertising storage, advertising user data and ad personalization from being used, and may still allow cookieless, redacted measurement requests,
3. Google Ads tag and measurement requests are sent to Hombee’s domain first and are processed by Cloudflare Google Tag Gateway before being forwarded to Google.

Hombee app and plugin data

The app at hombee.app and the Hombee plugin for ChatGPT and Codex process the data needed to provide the features you use. Providing account and installation access data is necessary to use connected-home features. We use this data to authenticate you, enforce household permissions, carry out your requests, synchronise state, maintain conversation history and reports, and investigate errors.

1. Account identifiers, email address, sign-in provider identifiers, profile details, account status, household membership and access permissions.
2. Installation identifiers and connection settings, device and entity names, rooms, live states, sensor readings, energy measurements, automations, logs and history returned by your connected Home Assistant installation.
3. Messages, saved memory, reports, tool-call arguments and results, and files or images that you choose to provide or retrieve through a supported feature.
4. OAuth client registrations, consent records, connection identifiers and tokens needed to authorise a plugin connection. Hombee does not receive your Google or Apple account password.
5. Technical diagnostics, request identifiers, IP addresses, browser or device details, error reports and service logs needed for operation and security. Home data can reveal occupancy and household activity; only connect installations and share information you are authorised to use.

App and plugin recipients

Cloudflare provides hosting, networking, storage and operational logging for Hombee. Google or Apple processes sign-in information when you choose that provider. Hombee sends the conversation content and tool context needed for an AI feature to OpenAI when you use that feature. When you connect the Hombee plugin to ChatGPT or Codex, the OpenAI client sends tool requests to Hombee and receives the corresponding results, which can include home status, history, reports or images. OpenAI handles those requests and results under the terms and privacy settings of the OpenAI product you use; its retention is separate from Hombee’s. Requests to Home Assistant are sent to your configured installation. Other household members receive data according to their installation permissions, and authorised Hombee staff may access data needed for support, security or legal obligations. These providers may process data outside the EEA; applicable transfers require a valid GDPR transfer mechanism. We do not sell app or plugin personal data.

App and plugin retention

Account, permission, installation, conversation and report data remains available while needed to provide the relevant service or until an applicable deletion request is completed. Home Assistant maintains its own history and retention settings. Diagnostic and security records are kept for the period needed to investigate incidents, protect the service or meet legal obligations; we assess their continued necessity rather than applying the Website enquiry-file limit to app data. OAuth access tokens last up to 15 minutes, refresh tokens up to 30 days and dynamically registered client records up to 90 days. Token expiry or disconnecting a plugin ends that connection’s access and does not automatically erase previously stored conversations, reports or results. Closing an account removes its sign-in credentials and ends account access; contact us to request erasure of remaining service records. Records required for legal obligations or claims may be retained for the applicable statutory period.

App and plugin controls

You can choose which Home Assistant entities are exposed, manage installation membership within your permissions, and disconnect the plugin in the OpenAI product. You can request access, correction, portability, restriction or erasure of app and plugin data, or object to processing based on legitimate interests, at hello@hombee.dev. Identity verification may be necessary to protect the account. Processing needed to provide requested app and plugin features is based on Article 6(1)(b) GDPR; security and diagnostics rely on Article 6(1)(f), legal obligations on Article 6(1)(c), and optional consent-based processing on Article 6(1)(a). We do not use home-control outputs to make solely automated decisions with legal or similarly significant effects. You can lodge a complaint with the President of Poland’s Personal Data Protection Office or your competent supervisory authority. The website analytics and advertising sections describe hombee.dev and do not mean that home data is used for advertising.

Data security

We apply appropriate technical and organisational measures to protect your data against loss, destruction, disclosure to unauthorised persons and other forms of unlawful processing.

Changes to the privacy policy

We reserve the right to change this Privacy Policy. We will inform you of any changes through a notice on the website.