Draft, not yet reviewed by a lawyer. The English version prevails over translations. Effective date: set at the public launch.
Hibira, the trade name of an individual business operator (sole trader) based in Taiwan ("Hibira", "we"; the operator's name is given without delay on request), runs Hibira Live Chat at chat.hibira.io (the "Service"). This policy covers two groups of people differently:
- Our customers' people: workspace owners, admins and agents, and visitors to chat.hibira.io. For their data we are responsible (controller), and this policy applies.
- Visitors who chat with a business through a widget on that business's website or app. The business decides what is collected and why, and its own privacy notice applies. We process that data for the business under the Live Chat Data Processing Agreement (section 5).
1. What we collect about customers and why
| Data | Source | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|---|
| Email, optional name, preferred language, role and workspace | You, or the admin who invites you | Run the workspace, sign-in links, service and billing emails | Contract | While you are in the workspace, then 30 days |
| Single sign-on details (the user ID and email your company's identity provider sends) | Your company's identity provider | Sign you in and create your agent account | Contract | While you are in the workspace |
Session cookie hlc_session and sign-in link tokens (stored only as hashes) | Set at sign-in | Keep you signed in securely | Contract, legitimate interest (security) | 30 days or until sign-out; sign-in links 15 minutes, invitations 7 days |
| IP address and email used at sign-in | Your browser | Rate limiting and abuse prevention | Legitimate interest (security) | Short-lived counters, hours at most |
| Workspace activity log (sign-ins, agent and settings changes, with time and IP address) | Your use of the portal and inbox | Let admins and us review changes and investigate abuse | Legitimate interest (security) | 1 year, or until the workspace is deleted |
| Plan, subscription status, Creem customer and subscription IDs, renewal date | Creem and you | Billing and plan limits | Contract, legal obligation | Workspace life, then as tax law requires (7 years) |
| Card and other payment details, billing name and address | You, directly to Creem at checkout | Payment, tax and receipts, handled by Creem as merchant of record | Contract | Held by Creem under its own privacy notice; we never see full card numbers |
| Usage counts (conversations, AI replies, seats) per workspace per day | Your use of the Service | Run the Service, enforce limits, show usage | Contract | Daily totals 2 years |
| Server logs (IP address, time, request path, user agent) | Your requests | Security, debugging, capacity planning | Legitimate interest | 90 days |
| Pages visited on chat.hibira.io, with approximate location, device, browser and language, through Google Analytics (IP addresses anonymised; page addresses without conversation or other IDs; once an owner or admin has allowed analytics, also the workspace's sign-up and subscription changes (plan and price), which our server sends to Google Analytics with that browser's analytics ID and a pseudonymous workspace ID) | Your browser, only as section 2 describes | Learn which pages are useful and improve the site | Consent where your region requires it; elsewhere legitimate interest, and you can turn it off | 14 months in Google Analytics |
| Support requests to us | You | Answer you | Contract, legitimate interest | 2 years after the last message |
| Waiting list sign-ups on chat.hibira.io: email, language, optionally your website and team size, and the referral or campaign tag of the link you came from | You; your browser (the tag) | Send you your invitation and Live Chat launch news only, with an unsubscribe link in every email | Consent | Until you unsubscribe, or 30 days after the Service opens |
We do not sell personal data, use it for targeted advertising, or make automated decisions with legal or similarly significant effects. Before you sign in, the chat.hibira.io website sets only the cookies section 2 lists, and Google Analytics cookies only as the rules for your region allow. Its forms may run a Cloudflare Turnstile bot check.
2. Cookies and browser storage
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
hlc_session | Strictly necessary | Keeps agents signed in to the inbox and portal on chat.hibira.io | 30 days |
hlc_site_lang | Preference | Remembers that you chose English on the website | 1 year |
Language and analytics choice (hlc:locale, hlc.analytics-consent, hlc.analytics-notice, in browser storage) | Strictly necessary | Remember your language and your answer about analytics | Until you clear the site's data |
_ga, _ga_<ID> (Google Analytics) | Analytics | Count visits and tell visits apart | Up to 2 years; removed when you turn analytics off |
| Widget storage (browser storage on the business's site) | Strictly necessary | Lets a visitor find their conversation again on the business's site | Until the visitor clears the site's data or the conversation is deleted |
How we ask about analytics cookies depends on where you are, as on hibira.io. In the European Economic Area, the UK, Switzerland, mainland China, Korea, Thailand and Vietnam, and whenever we cannot tell your country, Google Analytics loads only after you choose “Allow analytics”, and “No thanks” is just as easy. In the United States it runs unless you opt out with “Your privacy choices” in the footer, and we treat a Global Privacy Control signal as opting out. Elsewhere it runs with a one-time notice, and “Cookie settings” (in the footer, or the cookie button beside the language menu in the inbox) turns it off. Turning it off removes its cookies. Advertising storage stays off everywhere. Google Analytics never runs in the Hibira Chat mobile app, the operator console, or the widget on businesses' sites. A business may choose to have its widget report chat events (chat opened, chat started, message sent, rating given) to the Google Analytics already on its own site. That tag is the business's, under the business's own consent settings and privacy notice, and these events carry no message text or contact details.
3. Who receives the data
| Recipient | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, attachments and archived conversations; AI replies and search (Amazon Bedrock), only for workspaces that turn them on | Hong Kong (ap-east-1); Japan (Tokyo ap-northeast-1; Osaka ap-northeast-3) for AI replies |
| Neon | Database | Singapore (AWS ap-southeast-1) |
| Cloudflare | DNS, edge network, DDoS protection, bot checks (Turnstile) | Global |
| Amazon SES | Sign-in links and service emails | Hong Kong / Singapore |
| Creem | Reseller and merchant of record for payments | European Union and its providers |
| Google Workspace | Our email (support requests) | Global |
| Google (Google Analytics) | Website analytics, only as section 2 describes | United States |
| Gravatar (Automattic) | Profile pictures for agents who have not uploaded a photo: our servers send Gravatar a SHA-256 hash of the agent's email, never the email itself, and visitors' browsers do not contact Gravatar. An agent can turn this off in their profile | United States |
We also disclose data where the law requires it, and to a successor of the Service under the Terms.
4. International transfers
We are based in Taiwan, our servers run in Hong Kong, our database in Singapore and AI replies in Japan, so your data may be processed outside the country you live in. We protect transfers with contracts that bind recipients to an equivalent level of protection, such as the EU Standard Contractual Clauses, and choose providers with recognised certifications (for example ISO 27001 or SOC 2).
5. Visitors who chat with a business
When you chat with a business through its widget, that business is responsible for your data; please read its privacy notice and send requests about your conversation to it. We process for the business, under its instructions:
- what you type and send: messages, attachments, and any name or email address you give;
- technical details: IP address, approximate location from it, browser, language, the page you chat from, and when you are online in the chat;
- details the business itself passes on when you are signed in to its site, such as your customer ID;
- AI replies and their sources, where the business has turned them on.
We keep conversations secret as section 3 of the Live Chat Terms describes and delete them when the business deletes them, at the end of its plan's history period, or when its workspace is closed. If you cannot reach the business, write to privacy@hibira.io and we will pass your request on.
6. Security
TLS for all traffic; sign-in tokens and sessions stored only as hashes; data encrypted at rest and reached only over private networks or authenticated TLS; least-privilege access with multi-factor authentication; rate limits and bot checks; encrypted backups, monitoring and an incident response procedure.
7. Your rights
Depending on where you live (including under the GDPR, the UK GDPR, Taiwan's Personal Data Protection Act, Japan's Act on the Protection of Personal Information, Korea's PIPA, China's PIPL, Thailand's PDPA and Vietnam's Law on Personal Data Protection), you may ask for access, a copy, correction, deletion, restriction, objection or portability, and withdraw consent. Write to privacy@hibira.io; we do not charge a fee and answer within the time the law requires. You may also complain to your data protection authority.
Taiwan (Personal Data Protection Act). Taiwan's Act is our home law; the collector is the individual business operator trading as Hibira. We collect identification data, including online account, IP address and cookie identifiers (C001), and financial identification data (C002), for contract and similar legal relationships (069), customer management and service (090), information, communications and database management (136) and e-commerce services (148), during the periods in section 1, in the regions in section 3. Under Article 3 you may request access, copies, correction, stopping collection or use, and deletion.
Japan (Act on the Protection of Personal Information). The business operator handling personal information, and the person responsible for it, is the individual business operator trading as Hibira, based in Taiwan; the operator's name and address are given without delay on request. We are in Taiwan, our servers are in Hong Kong and our database in Singapore, and some recipients are in the European Union and the United States; we take security measures with those countries' personal data protection systems in mind, and each recipient is bound by contract to protect the data. Information on those systems is on the Personal Information Protection Commission website, and on request we tell you about each foreign recipient's measures. Requests for notice of purposes, disclosure (including records of provision to third parties), correction, suspension of use, deletion or stopping provision go to privacy@hibira.io, free of charge. You may also contact the Personal Information Protection Commission (ppc.go.jp).
EU and UK (GDPR, UK GDPR). We are the controller for the data in section 1 and a processor for visitors' data (section 5). You may complain to the supervisory authority where you live or work.
Korea (PIPA). Your data is processed abroad in the countries and by the recipients in sections 3 and 4, for the purposes in section 1 and the periods listed there; you may refuse transfers abroad by closing your account, though we then cannot provide the Service. Complaints: the Personal Information Protection Commission (pipc.go.kr).
China (PIPL). Data is processed outside China by the recipients in section 3; you may exercise your rights through privacy@hibira.io.
Thailand (PDPA) and Vietnam (Law No. 91/2025/QH15). We process your data for the purposes and on the bases in section 1 and transfer it abroad as sections 3 and 4 describe, under contracts that require adequate protection. Consent can be withdrawn at any time. If a breach occurs we notify the competent authority within 72 hours of learning of it.
8. Changes
We publish changes on chat.hibira.io with their effective date, and email workspace owners about material ones at least 30 days ahead.
9. Contact
privacy@hibira.io · Hibira, Taiwan. The operator's name and address are given without delay on request.