Privacy Policy
Last updated 2026-04-26 · Placeholder — not legal advice
What Hermes collects, where it lives, who processes it, and how to remove it.
What we collect.
An account record (email, name, hashed credentials), billing identifiers from Stripe (customer ID, subscription ID, invoice history), and operational metadata about your deployed agents (provider region, status, uptime). We do not store the content of your agent's conversations on our infrastructure — that resides on the dedicated VPS we provision for you.
Third-party processors.
We rely on a small set of vendors to deliver the platform. Stripe handles billing and stores payment instruments. Hetzner provides the compute your agent runs on. Cloudflare provides the tunnel that exposes the agent to its gateways. The model provider you select (Anthropic, OpenAI, Google, or a self-hosted weight) processes prompts your agent sends. Each vendor receives only the data necessary to perform its function.
Where data lives.
Account and billing records sit in our application database. Agent runtime data — memory, skills, conversation logs — lives on the VPS we provision, not in our central systems. When a subscription ends, the VPS is destroyed and its data with it.
Retention.
Account records persist for as long as the account is open. Stripe retains billing records under its own retention policy. Agent runtime data persists for the life of the subscription. Cancellation triggers VPS teardown at the end of the current billing period; teardown is irreversible and removes the agent's memory and skills with it.
Your rights.
You can export your account data, request deletion of your account, or revoke third-party integrations at any time. Deletion removes the account record and triggers cancellation of all active agents. Some records (Stripe invoices, audit logs) may be retained where required by law.
Cookies & analytics.
We use first-party session cookies to keep you signed in. We do not run third-party advertising trackers. Operational telemetry (request logs, error reporting) is retained for a limited window and used only for debugging and abuse prevention.
Contact.
Questions about this policy or a request regarding your data should go to the contact address listed on the contact page.