Privacy Policy

Last updated: 30 October 2026

1. Who we are

Holmes AI Inc. ("Holmes", "we", "us") makes Holmes, procurement intelligence software for businesses. Holmes helps companies understand their contracts, suppliers, spend, bills and prices. We also make Enola, a version of Holmes for small and medium-sized companies. In this policy, "Holmes" includes Enola unless we say otherwise.

Holmes AI Inc., a Delaware corporation
4101 Dublin Blvd Ste F #1066, Dublin, CA 94568, United States
Email: support@holmesops.ai. Privacy questions and requests: legal@holmesops.ai

This policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and the choices you have.

2. What this policy covers

This policy covers:

• Holmes: the web app at https://holmesprocure.com and https://ask.holmesops.ai, Holmes in Slack and Microsoft Teams, the Holmes API, and Holmes tools that you use from other AI assistants, such as Microsoft 365 Copilot.
• Enola: the web app at https://enola.holmesops.ai, and Enola in Slack.
• Our website, https://www.holmesops.ai, and the emails we send.

It covers information about:

• people who use Holmes for their company ("members");
• people who visit our website or contact us;
• people whose information is in what our customers put into Holmes or connect to it, for example a supplier's sales contact in an email, or a worker in an HR tool;
• people at suppliers whose details are in documents our customers file, such as tax forms, bank-detail letters and insurance certificates;
• people at suppliers whose business contact details are published.

Business customers. Holmes is for businesses. When a company uses Holmes, the company controls the information in its Holmes workspace: its documents, its chats and the data from the tools it connects. We process that information for the company, under our agreement with it, as its service provider (also called a "processor"). If your employer uses Holmes and you have a question about that information, ask your employer. We will help it answer.

Tools you connect to Holmes, and Slack, Microsoft and other services, have their own privacy policies. This policy does not cover them.

3. What we collect

4. How we use information

We use information to:

• Provide Holmes: answer questions, read and file documents, compare prices with benchmarks and contracts, track renewal dates, monitor suppliers, prepare briefs, contact suppliers when you ask, and prepare payment requests that your company approves.
• Run your account: sign-in, billing, support and service messages.
• Keep Holmes secure: prevent abuse and fraud, investigate problems, and keep an audit record.
• Improve Holmes: fix errors, measure quality and build features. Section 7 explains what we use, and never use, to train AI models.
• Meet legal duties: comply with the law and enforce our terms.
• Market Holmes: send news about Holmes to business contacts. You can unsubscribe at any time. We never use your workspace's content, or data from connected tools, for marketing.
• Do what you ask, or what you agree to.

We do not sell personal information.

5. Data from tools you connect

5.1 How connecting works

A workspace admin or member connects a tool in Holmes, under Settings, Connections, or by asking Holmes in Slack or Teams. You sign in on the tool's own page (for example Google, Microsoft, Intuit, Plaid or DocuSign) and approve access, or you give Holmes a key or token that the tool issues. The connection screen tells you what Holmes will read before you connect.

• Each connection is read-only, unless an admin gives a payment tool permission to pay (section 5.4).
• A mailbox, drive or calendar is read only for the person who connected it.

5.2 What Holmes reads, by kind of tool

The list in Settings, Connections is always the current one.

5.3 How Holmes uses data from connected tools

• Holmes uses it only for the features you ask for and see in Holmes.
• We do not sell it.
• We do not use it for advertising or marketing.
• We do not use it to decide credit-worthiness or for lending.
• We do not give it to data brokers or information resellers.
• We do not show it, or figures made from it, to other customers, and we do not use it in benchmarks.
• We never use it to train or improve any AI model (section 7).

5.4 Payment requests you allow

If a workspace admin connects BILL, Brex, Mercury or Ramp with permission to pay, Holmes can submit a payment request in that tool for a bill your company approved in Holmes. The tool's own approvals and controls still apply. If a supplier's bank details changed, Holmes holds payments to that supplier until an admin confirms the change by phone. Holmes never holds or moves money itself.

5.5 Who can see it

• In your workspace. Documents you import are filed in your company's workspace, where other members can see them, as with uploads. Answers appear where you asked: in Holmes, in a Slack or Teams conversation, or in the AI assistant you used. Section 5.9 says who sees bank balances and transactions.
• At Holmes. See section 8.8.

5.6 How Holmes protects it

• Holmes seals (encrypts) every login, token and key for a connected tool with AES-256-GCM before storing it. The key is held only in our hosting environment. Holmes opens a login only for the moment of a request.
• For Google, Microsoft, Dropbox, Zoho and several other tools, Composio holds the sign-in and makes the requests. For enterprise systems such as NetSuite, SAP, Workday and Coupa, StackOne does. For Brex and Ramp, Pipedream does. Holmes keeps only a sealed reference.
• Every request to a connected tool goes through one gateway in Holmes. The gateway allows only listed read operations, and payment requests where an admin allowed them. It records each request. Workspace admins can see recent requests in Settings.

5.7 Disconnecting and deletion

You can disconnect a tool at any time in Settings, Connections, or in the tool itself. Holmes then stops reading it and asks the tool to end Holmes's access, where the tool allows that. Section 9 says what Holmes keeps and for how long. You can ask us at any time to delete what Holmes read from a tool: write to legal@holmesops.ai.

5.8 Google user data

This section applies when you connect a Google account to Holmes. It adds to the rest of this policy. Where they differ, this section governs Google user data. "Google user data" means information Holmes receives from Google APIs.

What Holmes accesses. You choose what to connect. Each connection is read-only. Holmes cannot send, change, share or delete anything in your Google account.

• Gmail: your messages, attachments and labels. Holmes uses them to:
  • read the invoices, quotes and contracts you ask it to read (PDF and Word attachments from a sender or a period you name), and file them in your Holmes workspace;
  • show which senders send you procurement documents, using only senders, subjects and attachment names (the mailbox map);
  • find a supplier's reply to a price request you sent through Holmes, only in mail from that supplier received after your request;
  • if you turn on the subscription watch, read receipts and sign-up emails, then look once a day, so Holmes can warn you before a software subscription charges you;
  • list, read or import your mail when you ask for it through Holmes from another AI assistant you connected to Holmes, such as Microsoft 365 Copilot.
• Google Drive: your files, folders and their details. Holmes uses them to read the contracts, price lists and quotes you ask it to read, from a folder you name or a link you give (Holmes reads Google Docs as PDF copies); to show a map of your folders by name, type, size and date, without opening any file, so you can choose what to import; and to import a large folder in steps you approve.
• Google Calendar: your events. Holmes reads one day of your own calendar at a time to list your meetings with suppliers in your morning brief. It matches a meeting to a supplier by the guests' email domains or the supplier's name in the title.

A mailbox, drive or calendar is read only for the person who connected it.

How Holmes uses it. Only to provide the features above, which you start and see in Holmes. We do not sell Google user data. We do not use it for advertising, including retargeting and personalized or interest-based ads. We do not use it to decide credit-worthiness or for lending. We do not give it to data brokers or information resellers.

AI. To give you a result, Holmes sends what it reads from your Google account to AI models that work for Holmes: Sherlock, Holmes's own model, and Google Gemini. This includes the documents Holmes fetches from Gmail or Google Drive for you. Holmes does this only while Sherlock is running, and only to produce your result. The documents you import become documents in your Holmes workspace. While your Google account or another tool stays connected, Holmes reads them again later (for example, to check renewal dates across your contracts) in the same way: only while Sherlock is running, and only with Google Gemini. If you disconnect every tool, documents you imported earlier are read like documents you upload (section 6).

We do not use Google user data to develop, improve or train any AI or machine-learning model, including Holmes's own model.

Who else processes it. Only the service providers that run Holmes for us, on our instructions: Composio (holds the Google sign-in and makes the read-only requests), Supabase (database and file storage), Vercel (hosting), RunPod (servers for Sherlock), Google (Gemini), DeepSeek and xAI (only as described under AI), and Sentry (error reports, which can include small parts of the data being handled). Slack or Microsoft deliver Holmes's answers when you ask in Slack or Teams, and the AI assistant you use Holmes from receives what you ask for there. We share Google user data with no one else, except: to comply with the law; for security, for example to investigate abuse; or as part of a merger, acquisition or sale of assets, and then only after your explicit consent.

People at Holmes. Our staff do not read your Google user data, unless you ask us to and agree (for example, for support), it is needed for security (such as investigating a bug or abuse), the law requires it, or the data is aggregated and anonymized and used for our internal operations.

Storage and security. The documents you import stay in your Holmes workspace, like documents you upload. The mailbox map keeps senders, subjects and file names. The drive map keeps file and folder names, types, sizes and dates. The subscription watch keeps the text of the receipts it read, with the subscription it found. Composio holds the Google sign-in, and Holmes keeps only a sealed reference to it. Data is encrypted when it travels over the internet.

Your choices and deletion. You can disconnect a Google account at any time in Holmes, under Settings, Connections. Holmes then stops reading it and asks Google to revoke its access. You can also remove Holmes at https://myaccount.google.com/permissions. To delete what Holmes read from a Google account, write to legal@holmesops.ai. We delete it within 30 days, unless the law requires us to keep it. Documents you imported stay in your workspace until you delete them. Tell us if you want those deleted too.

Limited Use. Holmes AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google Workspace User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy), including the Limited Use requirements.

5.9 Bank and card accounts connected through Plaid

Holmes connects to business bank and card accounts through Plaid Inc. ("Plaid"). A workspace admin signs in to the bank on Plaid's page. Holmes never sees or stores bank usernames or passwords. Plaid collects and handles your data as its End User Privacy Policy describes: https://plaid.com/legal/#end-user-privacy-policy. When you connect an account, you allow Holmes and Plaid to get the information below from your bank, for the uses below.

What Holmes gets. Account names and types, the last four digits of account numbers, balances, and transactions: date, amount, currency, merchant or payee name, the bank's description, category and status. Holmes does not get full account or routing numbers. Holmes cannot move money through this connection.

What Holmes uses it for. To find repeat charges and subscriptions; to match payments to your suppliers, contracts and invoices; to check that a bill was not already paid before you pay it; and to answer your workspace's questions about cash and payments in Holmes, Slack or Microsoft Teams. Only admins of your workspace see balances, transactions and the subscriptions found in them, and Holmes shows them only in a direct message with Holmes in Slack or in Microsoft Teams, never in a shared channel. Supplier spend totals that include bank payments appear wherever Holmes shows spend to your workspace.

AI. Payee names and statement lines go only to Sherlock, Holmes's own model, and Google Gemini, and only while Sherlock is running.

Who processes it for us. Vercel (hosting) and Supabase (database), in the United States. Google (Gemini) and RunPod (servers for Sherlock), to classify payees and charges. DeepSeek, only as described under AI. Sentry, for error reports. Slack or Microsoft, when Holmes answers you there.

What Holmes never does. Holmes does not sell or rent bank data. It does not use it for advertising or credit decisions. It does not use it to train AI models. It does not show it, or figures made from it, to any other customer.

How long Holmes keeps it. While the account is connected, and never more than 25 months after the transaction date. When you disconnect the account in Settings, Connections, Holmes ends the connection at Plaid at once, and deletes the account's transactions and the spend records made from them within 30 days. If you close your Holmes workspace, Holmes does the same for every account. Holmes keeps audit lines (which tool was called, when, and the result, without the data) for 12 months.

Your choices. You can disconnect at any time in Settings, Connections. You can also see and remove the connection in the Plaid Portal: https://my.plaid.com. To ask us to delete your data, write to legal@holmesops.ai.

Security. Holmes seals each Plaid access token with AES-256-GCM before storing it. The database is encrypted at rest. All traffic uses TLS.

Other bank, card and payment tools. Holmes uses, protects and keeps data from Mercury, Wise, PayPal, Ramp and Brex in the same way.

5.10 Accounting, ERP and spend tools (QuickBooks Online and others)

When a workspace admin connects QuickBooks Online, Holmes reads the company's profile, bills, purchase orders, vendors and bill payments. Holmes never writes to QuickBooks.

We use this data only to run Holmes for the workspace that connected it: to answer questions about bills and suppliers, to list open bills in the morning brief, to add vendors to the workspace's supplier list when an admin asks, and to track what the company pays for each item and compare it with its supplier contracts when an admin asks. Holmes's code works out every amount, total and price change. AI models do not calculate them.

When an answer that lists bills or prices is part of a chat, Sherlock and Google Gemini may read it to answer the next question. If your workspace asks Holmes to research or monitor a supplier, the supplier's name, which may have come from QuickBooks, is sent to our search and AI providers to find public information about that supplier.

We do not sell this data. We do not show it to other customers or use it in figures shown to anyone outside the workspace. We do not use it to train AI models. We process it as our own service to you, not on Intuit's behalf.

Our service providers process it for us under written agreements: hosting (Vercel), database (Supabase), error tracking (Sentry), and Holmes's AI providers as described above.

We seal the sign-in tokens before we store them. We keep a log of each request Holmes makes to QuickBooks, which workspace admins can see in Settings.

An admin can disconnect at any time in Settings, Connections, or inside QuickBooks. When an admin disconnects in Holmes, Holmes revokes its access at Intuit, deletes the stored sign-in and deletes the item prices it read. If you end the connection inside QuickBooks, tell us at legal@holmesops.ai and we delete those prices within 30 days. Suppliers added to your supplier list stay until you delete them. To ask us to delete anything Holmes read from QuickBooks, write to legal@holmesops.ai.

Other accounting, ERP, procurement and spend tools. Holmes handles Xero, Zoho Books, FreshBooks, BILL, Business Central, NetSuite, SAP S/4HANA, Oracle, Odoo, Coupa, Procurify, ApprovalMax, Spendesk, Moss and inventory tools in the same way. Holmes reads them. It writes nothing to them except the payment requests an admin allowed (section 5.4).

5.11 E-signature and contract tools (DocuSign and others)

When you connect DocuSign, you allow Holmes access on DocuSign's own page. Holmes then reads your completed envelopes: their details (subject, sender and dates), the list of documents in each, and the signed documents as one PDF, without DocuSign's certificate of completion. It also reads your DocuSign account's name and id, and your name and email address. When you ask Holmes to read your signed contracts, it also looks once a day for newly completed envelopes, until you tell it to stop or you disconnect. Holmes never creates, sends, signs, voids or changes an envelope.

Holmes uses this only to file your signed contracts in your Holmes workspace, with their parties, dates, renewal terms and prices, and to watch their renewal and notice dates for you.

Holmes reads the signed documents only while Sherlock is running, and only with Google Gemini. While DocuSign or another tool stays connected, the same applies when Holmes reads a contract again later (for example, to check renewal dates). If you disconnect every tool, contracts you imported earlier are read like documents you upload (section 6).

Holmes never uses DocuSign data, or information gained from it, to train, calibrate or validate any model or system.

Holmes keeps the signed documents and the contract details it read until you delete the contract or close your workspace.

When you disconnect DocuSign in Holmes, Holmes stops calling DocuSign and deletes its stored tokens. You can also remove Holmes in DocuSign: Manage Profile, Connected Apps, Revoke.

Holmes handles other e-signature and contract tools (Dropbox Sign, PandaDoc, DocuSeal, Contractbook, Ironclad, SpotDraft and Oneflow) in the same way.

5.12 Slack and Microsoft Teams

Slack. When your company installs the Holmes app in Slack, Holmes reads the messages you send it directly, messages that mention it, and files you send it in a direct message. It also reads the names and email addresses of people in your Slack workspace, to match them to Holmes accounts. Holmes keeps no Slack message text. It keeps only ids, times and what it did, and reads earlier messages in a thread back from Slack when it needs them. A file you send Holmes to read is kept as a document in your Holmes workspace, like an upload. AI models answer your Slack questions (section 6). Holmes never uses Slack data to train or improve any AI model, and it does not send your Slack messages to its memory provider, Zep.

Microsoft Teams. Holmes reads the messages you send its Teams app and keeps the conversation in your Holmes chat history, like a chat in the web app. If you also connect Microsoft Teams as a tool, Holmes searches the messages you can see when you ask it to, and lists what it finds without an AI model reading them.

6. How Holmes uses AI

Holmes uses AI models to read documents, answer questions and sort information. These are the models:

• Sherlock, Holmes's own model. It runs on servers with graphics processors that Holmes rents from RunPod, in the United States. Holmes controls it. Sherlock answers questions in Ask Holmes by default.
• Google Gemini, from Google, through Google's paid API.
• DeepSeek, a company based in China, and xAI (Grok), based in the United States. Holmes uses them only as backups: when Sherlock is offline, when another model does not answer, or when you choose Third Party Models in Ask Holmes.

What each model may receive:

Each provider handles what it receives under its terms with Holmes. Google's paid Gemini API terms and xAI's API terms say they do not use it to train their models. DeepSeek processes what it receives in China.

AI output can be wrong. Our Terms of Service explain how to use it.

7. Training AI models

Holmes trains and tests its own model, Sherlock. Holmes never uses your content to train, test or improve Sherlock or any other AI model. Your content includes:

• questions you ask Holmes, and Holmes's answers, in the web app, Slack, Microsoft Teams, the API or another AI assistant;
• documents you upload, forward or email to Holmes, and the contract details, prices and other facts Holmes reads from them;
• data from tools you connect, including Google user data, bank and card data, accounting data and e-signature data, and anything Holmes makes from it, such as contract details read from a document imported from Google Drive, or spend made from bank transactions;
• Slack messages.

Aggregated information about how Holmes is used (section 8.7) is not your content.

8. Who we share information with

We do not sell personal information. We share it only as this section describes.

8.1 Service providers

These companies process information for Holmes, on our instructions, to run Holmes.

8.2 Inside your company

Members of your workspace see your workspace's content as their roles allow. Your workspace admins can see its connections, recent requests to connected tools and settings.

8.3 When you ask us to

• Suppliers you contact through Holmes receive your name, email address, company and message.
• An AI assistant you use Holmes from (for example Microsoft 365 Copilot, ChatGPT or Claude) receives what you ask Holmes for there. Its provider handles it under your company's terms with that provider.
• Tools you connect receive Holmes's requests, and payment tools receive the payment requests you allow.

8.4 Legal reasons

We may disclose information if the law requires it, to respond to valid legal process, or to protect the rights, property or safety of Holmes, our customers or others. Where the law allows, we tell the customer first.

8.5 Business transfers

If Holmes is part of a merger, acquisition or sale of assets, information may pass to the new owner, who must handle it under this policy. Google user data passes only after your explicit consent.

8.6 With your consent

We share information in other ways only if you agree.

8.7 Aggregated information

We may use aggregated information about how Holmes is used, such as which features are used most, to run and improve Holmes. It does not identify you, your company or any person. We do not build it from data from connected tools. We do not use your company's documents or data in benchmarks or figures shown to other customers.

8.8 People at Holmes

Only Holmes staff who need access to run Holmes can reach production data. Staff may look at workspace content and chats to give support you ask for, fix problems, keep Holmes secure and check the quality of answers. Staff read data from connected tools only if you ask us to and agree (for example, for support), if it is needed for security, if the law requires it, or in aggregated and anonymized form for internal operations.

9. How long we keep information

We keep information only as long as we need it for the reasons in this policy, or as the law requires. The periods below are the longest we keep each kind of information. Where a deletion is not yet automatic, we carry it out by hand within the period.

Deleting your information. You can delete contracts, projects and suppliers yourself in Holmes, and disconnect tools. To delete your account, your workspace, your chat history or anything Holmes read from a connected tool, write to legal@holmesops.ai from your account's email address. We confirm in writing when it is done. We may keep what the law requires us to keep, such as billing records.

10. Security

We protect information with technical and organizational measures, including these:

• Holmes's app accepts only encrypted connections (HTTPS, with TLS 1.2 or 1.3).
• Logins, tokens and keys for connected tools are sealed with AES-256-GCM before they are stored. The key is held only in our hosting environment.
• Requests to connected tools go through one gateway that allows only listed operations and records each request.
• Database rules keep each workspace's data to that workspace. The tables that hold connection data can be read only by Holmes's servers.
• Our database provider encrypts stored data.
• Holmes holds a SOC 2 Type II report, a SOC 3 report and ISO/IEC 27001 certification. Customers can ask for the SOC 2 report under a confidentiality agreement.

No system is completely secure. If we learn of a security incident that affects your information, we will tell you without undue delay and as the law requires.

11. Cookies and similar technologies

In the Holmes app. We use cookies that keep you signed in, a cookie that tells our website you are signed in, and settings stored in your browser, such as light or dark mode. Holmes does not use advertising cookies.

On our website. Our website uses HubSpot to run its forms and to measure visits. HubSpot sets cookies to recognize returning visitors. Our website host, Lovable, also counts visits. Our website's network provider, Cloudflare, sets one cookie that helps block automated traffic.

You can block or delete cookies in your browser settings. If you do, parts of Holmes may not work.

We never use Google user data, or any other data from connected tools, for advertising.

12. Your choices and rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you, and get a copy;
• correct it;
• delete it;
• get a copy in a portable form;
• object to, or restrict, some uses;
• withdraw consent where we rely on it;
• opt out of marketing emails, using the link in each email.

To use these rights, write to legal@holmesops.ai. We check your identity first, usually by writing to your account's email address. If your company is our customer and the request is about its workspace, we pass the request to your company and help it answer. We will not treat you differently for using your rights. Section 15 has more for some regions.

13. Where we process information

Holmes AI Inc. is based in the United States. We store Holmes's data in the United States. Our service providers may process information in the United States and in other countries. DeepSeek processes information in China.

When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to other countries, we use safeguards the law approves, such as the European Commission's standard contractual clauses and the United Kingdom's addendum to them.

14. Children

Holmes is for businesses and for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you think we have, write to us and we will delete it.

15. More information for some regions

15.1 California

This section applies to California residents, under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

What we collected in the last 12 months:

• Identifiers, such as name, email address, postal address, IP address and account ids.
• Customer records, such as name, phone number and billing details. Stripe collects payment card details.
• Commercial information, such as what you bought from Holmes, and the purchasing, contract, bill and spend records you put into Holmes or connect to it.
• Internet or other electronic network activity, such as how you use Holmes and our website.
• Approximate location, worked out from your IP address.
• Professional or employment information, such as your job title and company, and information about workers in HR tools a customer connects.
• Inferences, such as preferences Holmes learns from your questions.
• Sensitive personal information: account login details; the contents of email in a mailbox you connect; financial account information from bank and card accounts you connect; and, in documents you file, suppliers' bank account numbers and taxpayer identification numbers, which for a sole proprietor can be a Social Security number.

Sources: you; your company; your devices; tools you connect; public sources and data providers; our service providers.

Why we collect it: for the purposes in section 4. We use sensitive personal information only to provide the service you ask for, and for other purposes the law allows. We do not use it to infer characteristics about you.

Who we disclose it to: we disclose each category to service providers, for business purposes (section 8).

Sale and sharing: we do not sell personal information. We do not share it for cross-context behavioral advertising. We do not sell or share the personal information of anyone under 16.

How long we keep it: see section 9.

Your rights: you can ask to know what we collected and get a copy, to delete it and to correct it. You can opt out of the sale or sharing of personal information and limit the use of sensitive personal information, although we do neither of the things those rights stop. We will not treat you differently for using your rights.

How to ask: write to legal@holmesops.ai. We verify your identity by matching details we already hold and, where we can, by a reply from your account's email address. An authorized agent can ask for you with your signed permission. We may still ask you to confirm your identity directly. We answer within 45 days, or tell you if we need up to 45 more.

Shine the Light: we do not share personal information with third parties for their own direct marketing. You can ask us about this by email.

15.2 Virginia and other US states

If you live in Virginia or another US state with a consumer privacy law, you may have the right to: confirm whether we process your personal data, and access it; correct it; delete it; get a portable copy of data you gave us; and opt out of targeted advertising, sale, and profiling that has legal or similarly significant effects. We do not sell personal data, and we do not do targeted advertising or such profiling.

To make a request, write to legal@holmesops.ai. If we decline your request, you can appeal by replying to our answer with "Appeal" in the subject line. We answer appeals within 60 days. If you disagree with the outcome, you can contact your state's attorney general.

15.3 Nevada

We do not sell covered information, as Nevada law defines it. To make a request, write to legal@holmesops.ai.

15.4 European Economic Area, United Kingdom and Switzerland

Who controls your information. Holmes AI Inc. controls account, billing, website and marketing information, and the usage information we use to run Holmes. For workspace content and data from connected tools, the customer is the controller and Holmes is its processor.

Legal bases. We process personal information:

• to perform our contract with you or your company, which means providing Holmes;
• for our legitimate interests, such as keeping Holmes secure, improving it, researching suppliers from public information, and marketing Holmes to businesses, where your rights do not override those interests;
• with your consent, for example for some cookies and marketing emails, where the law requires consent;
• to comply with legal obligations.

Transfers: see section 13.

Your rights. You can ask to access, correct or delete your personal information, to restrict its use, and to receive it in a portable form. You can object to our use of it, including for direct marketing at any time. Where we rely on consent, you can withdraw it at any time. You can also complain to your data protection authority.

Representative. Holmes does not offer its service to customers in the European Economic Area, the United Kingdom or Switzerland for now, and has not appointed a representative there.

How long we keep it: see section 9.

15.5 Canada

Subject to limited exceptions under Canadian law, you can access and correct your personal information, and withdraw your consent to its collection, use and disclosure. If you withdraw consent, Holmes may not be able to provide some features.

We are adopting written policies on protecting, keeping and disposing of personal information, on staff roles, on handling requests and complaints, and on staff training. Our privacy contact is reached at legal@holmesops.ai. We may process your information outside Canada (section 13).

15.6 India

This section applies when we process personal data of people in India, under the Digital Personal Data Protection Act, 2023, and its rules.

Who decides. For account, billing, website and marketing information, Holmes AI Inc. is the data fiduciary. For workspace content and data from connected tools, your company is the data fiduciary and Holmes is its data processor. For that information, send your request to your company. We will help your company answer it.

Consent. When we rely on your consent, we ask for it with a notice. The notice tells you what personal data we collect and why. You can withdraw your consent at any time, as easily as you gave it. To do this, write to legal@holmesops.ai. When you withdraw consent, we stop the processing that relies on it. The withdrawal does not change processing that we did before. We also process personal data for the legitimate uses that the Act permits, for example when you give it to us for a specified purpose.

Your rights. You can ask us for:

• a summary of the personal data that we process about you, and of what we do with it;
• the names of the other data fiduciaries and data processors that we shared it with, and a description of what we shared;
• correction, completion or update of your personal data;
• erasure of your personal data, when we do not need it for the purpose or by law.

You can also nominate a person to use your rights if you die or cannot act.

Grievances. Send a grievance to our grievance contact at legal@holmesops.ai. We reply within 90 days. If you do not agree with our reply, you can complain to the Data Protection Board of India.

Transfers. We process personal data in the United States and in the other countries in section 13. We do not transfer personal data to a country that the Government of India restricts.

Children. Holmes is not for people under 18 (section 14).

Breaches. If a personal data breach affects you, we tell you and the Data Protection Board of India, as the rules require.

15.7 United Arab Emirates

This section applies to people in the United Arab Emirates, under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. It does not apply to a company in the Dubai International Financial Centre or the Abu Dhabi Global Market. Their own data protection laws apply there.

Who controls your information. For account, billing, website and marketing information, Holmes AI Inc. is the controller. For workspace content and data from connected tools, your company is the controller and Holmes is its processor. For that information, send your request to your company. We will help your company answer it.

Your rights. You can ask us:

• what personal data we process about you, why, who receives it, how long we keep it and where we got it;
• for a copy of your personal data in a structured, machine-readable form;
• to correct your personal data, or to erase it when we do not need it;
• to restrict or stop processing, in the cases that the law sets;
• to review a decision that we made only by automated processing, if it has legal or similarly serious effects for you. Holmes does not make such decisions about people.

To use these rights, write to legal@holmesops.ai.

Transfers. We transfer personal data to the United States and to the other countries in section 13. When a country does not give adequate protection, we use contract terms that the law accepts.

Breaches. If a breach affects your personal data, we tell you and the UAE Data Office, as the law requires.

Complaints. You can complain to the UAE Data Office.

16. Changes to this policy

We may update this policy. We will post the new version on this page with a new "Last updated" date. If a change is material, we will tell customers in advance, by email or in Holmes. Before we use data from a connected tool in a new way, we will tell you and ask for your consent.

17. Contact us

Holmes AI Inc.
4101 Dublin Blvd Ste F #1066
Dublin, CA 94568
United States

Email: support@holmesops.ai
Privacy questions and requests: legal@holmesops.ai