Privacy policy

Hosqi is a business messaging and workflow service operated by Fast Cybers. This policy explains how information is used when you visit hosqi.io or use app.hosqi.io.

Information we process

We process account details such as your name and email, workspace membership, authentication records, and information you provide to support. When you connect a business channel, we process the connection identifiers and credentials needed to operate it, and the messages, attachments, contact details and event records made available through that connection.

Why we use it

We use information to authenticate users, deliver verification and recovery emails, operate shared inboxes and workflows, handle connected-channel events, provide support and protect the service. Workspace members can access information according to their assigned role.

Google, Facebook and Apple sign-in

Where a sign-in option is available, we request basic identity information to create or authenticate your Hosqi account. Signing in is separate from connecting a business messaging channel. Channel access requires a separate authorization and depends on the provider’s permissions and approval requirements.

Google Calendar, Gmail and Google Drive connections

Connecting a Google service is optional and separate from signing in. You choose the Google account and permissions for each connection. Hosqi uses the account email and connection identifiers to identify the authorized account, and stores OAuth credentials encrypted on its server so your configured workflows can run without asking you to sign in each time.

• Google Calendar: we read your calendar list, calendar identifiers, access roles, time zones, availability and event details. Workflows can find and read events and, when you configure these actions, create, reschedule or cancel events on the selected calendar. Event data may include titles, times, descriptions, locations and attendee addresses. We do not request permission to change calendar sharing settings.
• Gmail: configured workflows can search messages and read a selected message. Data may include message and thread identifiers, subject, sender, recipients, dates, labels, plain-text body and attachment metadata. The Gmail integration does not send, label, modify or delete email, or download attachments.
• Google Drive: configured workflows can search existing files and read supported text files or export supported Google documents as text. Data may include file identifiers, names, types, size, modification time, file links and text content. The Drive integration does not create, edit, share or delete files.

We process this information to perform the operations you configure, show results and help you troubleshoot those operations. Workflow results and execution history are stored in the workspace and are available to authorized workspace members according to their access. Service providers supporting hosting and security process data as necessary to operate Hosqi. Information is transferred to a connected tool only as part of a user-configured feature or workflow; enabling a Google connection does not itself enable an AI feature.

Limited use of Google user data

Hosqi's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used to provide or improve the user-facing features described in this policy. We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalized AI or machine-learning models. Human access is limited to your affirmative permission for specific data, security investigations, legal obligations, or aggregated and anonymized internal operations permitted by that policy.

You can remove a connection in Hosqi to stop its future use and clear its stored OAuth credentials. You can also revoke Hosqi's access in your Google Account connections. Disconnecting or revoking access does not automatically delete earlier workflow results. To request deletion of retained Google data and workspace records, use the contact and deletion process below; backup and legal-retention limitations also apply.

iCloud Mail and Calendar connections

Connecting iCloud is optional and separate from signing in to Hosqi. The current connection uses an Apple app-specific password, stored encrypted on our server and restricted to the workspace that connected it. We do not ask for your main Apple Account password or verification codes. An app-specific password can allow access to both reading and sending email; Hosqi performs these operations only through the workflow steps you configure.

iCloud Mail: workflows can list recent Inbox messages, read selected message content as plain text and send a plain text email to one recipient from the connected primary mailbox. Data can include message identifiers, subject, sender, recipient, date, content and the result of an outgoing request. This integration does not automatically copy or synchronize your mailbox into Hosqi Inbox, download attachments or change or delete messages.

iCloud Calendar: workflows can read your iCloud calendar list, availability and selected event details and create, update or remove simple events you configure without attendees. Data can include calendar and event identifiers, names, time zones, titles, times, descriptions and locations. Recurring-event changes, invitations and automatic two-way synchronization are not included.

Selected results may remain in workflow fields and execution records according to workspace retention. Disconnecting in Hosqi removes the active stored credential and stops future access through that connection, while retained workflow and conversation records are preserved. You can also revoke the app-specific password in your Apple Account. For deletion of retained records, follow our data deletion instructions.

Facebook Pages, Messenger, Instagram and WhatsApp

Connecting a Meta business channel is optional and separate from signing in. A business administrator chooses the Facebook Page, the Instagram professional account linked to it, or the WhatsApp Business account, and approves the requested permissions in Meta’s own dialog. Hosqi asks Meta only for the access needed for the features the administrator selects.

For a connected channel we receive and store the account identifiers and names; access tokens, which are stored encrypted on our server; the messages customers send to the business and the replies the business sends, including attachments, reactions and delivery or read status; and the customer’s platform-scoped identifier and the name Meta provides. Only when the business turns on the related feature do we also process comments on its own posts, lead form answers, product catalog selections or account reports.

We use this information only to operate the business’s Inbox, contacts and the workflows it enables: showing conversations to authorized workspace members, sending the replies they or their published workflows create, applying Meta’s messaging windows and showing connection status. We do not sell Meta Platform Data, use it for advertising, share it with data brokers or use it to build profiles outside the business’s own workspace. If the business enables an AI feature, the relevant conversation content is processed by the selected AI provider to produce the requested result.

When a customer unsends or deletes a message on Instagram or WhatsApp, Hosqi removes the message text and stops showing its attachments, keeping only a marker that a message was withdrawn. When someone removes Hosqi’s access in their Facebook settings, Meta notifies us and we disable the affected connections and stop using that access. Administrators can disconnect a channel in Hosqi at any time; to delete records already stored in the workspace, follow the data deletion instructions.

Service providers and connected tools

Hosting, email and the tools you connect process information as needed to deliver their services. Workflows may send selected information to the integrations you configure. If you enable an AI or transcription feature, its selected provider processes the relevant content. You are responsible for choosing appropriate tools and permissions for your workspace and informing the people you communicate with.

Retention and deletion

We retain account and workspace information while it is needed to provide the service, preserve conversation history and meet applicable obligations. Disconnecting a channel stops future access but does not automatically erase existing workspace records. Deletion requests are reviewed for identity, workspace ownership, shared records and applicable retention requirements. Backups may retain copies until their retention cycle completes.

To request access, correction, export or deletion, email [email protected]. See our data deletion instructions. Do not send passwords, access tokens or verification codes.

Optional analytics and marketing measurement

With your separate permission, we use Google Analytics to understand visits to hosqi.io and the use of app.hosqi.io. We measure public page categories, selected public campaign parameters, and completed product actions such as signing in, creating a workspace or publishing a workflow. Inside the web application, page addresses and titles are replaced with fixed categories. We do not send conversation contents, customer names, email addresses, authentication tokens, workspace identifiers or workflow contents as analytics event data.

With your separate marketing permission, we use Meta Pixel and server-side Meta Conversions API measurement for the public Hosqi website to measure page visits and clicks on signup, demo and contact links. A link click does not mean that a registration, email or purchase was completed. Meta Pixel is not loaded inside the private web application. Automatic advanced matching and automatic collection of detailed page information are disabled. Connected-channel data from Google or Meta integrations is not used for this marketing measurement. The server receives only the selected public event name, a random event identifier and a restricted public source-page address. It adds the event receipt time, browser User-Agent, public IP address when available, and valid existing Meta browser/click cookie identifiers. It does not look up or share account details, emails, phone numbers, customer/workspace identifiers, conversation contents, workflow data or other connected-channel Platform Data. Browser and server copies use the same event name and random identifier so Meta can deduplicate them.

Server-side marketing measurement also requires your current marketing permission and stays off when you reject marketing or send a Global Privacy Control or Do Not Track signal. A permitted, restricted server event may still be sent when the browser Pixel is blocked or cannot safely load. We do not replay events from before permission, maintain a retrospective marketing-event queue, or offer this public endpoint as a way to submit arbitrary customer information. Withdrawing permission aborts pending browser measurement requests and stops future sends; an event already received by Meta cannot be unsent.

When an optional service is enabled, its provider may process browser and device information, IP addresses, cookie identifiers and the limited events described above. See Google's privacy policy and Meta's privacy policy. These optional scripts do not load before the relevant permission is given. We honor Global Privacy Control and Do Not Track signals by keeping optional measurement off.

You can reject optional cookies or change your choice through Cookie settings in the website footer or your web application account. The choice is shared between hosqi.io and app.hosqi.io in this browser and is stored for up to 180 days. Withdrawing permission stops future optional measurement and removes accessible tracking cookies; it does not automatically delete events already received by the providers. For access or deletion requests, contact us using the details below.

Optional measurement in a native mobile app

Native Firebase Analytics and Meta App Events SDK integrations are being prepared separately from the website and private web application. This policy does not indicate that a mobile build containing those integrations has been published. When included in a mobile release, Firebase Analytics on Android and iOS and Meta App Events each have a separate device-level choice and remain off by default. Browser cookie choices do not grant device permission, and a device choice does not grant browser-cookie permission.

With the relevant device permission, Hosqi explicitly supplies only fixed screen categories and a completed sign-in event. After valid product-analytics permission, Firebase also processes its automatic app-session and app-lifecycle events. The SDKs process their own app-instance information, app version, operating-system/device details and network information. We do not supply account identifiers, email addresses, phone numbers, customer or workspace identifiers, contact lists, message contents, workflow contents or information from connected Google or Meta business channels. Advertising identifiers (IDFA and Android advertising ID) are not requested or supplied for these events. On iOS, Meta events additionally require App Tracking Transparency permission. Rejecting or withdrawing either optional choice keeps or turns that SDK's event collection off and stops new Hosqi event calls; provider work already started under an earlier valid choice may finish afterward.

Cookies and security

We use essential session and authentication cookies to keep you signed in, bind authorization requests to your browser and protect sign-in flows. We use access controls, encrypted connections and restricted credential storage. No method of transmission or storage is completely secure.

Contact and changes

Contact Fast Cybers through [email protected] with privacy questions. We may update this policy as the service changes; the revision date appears below.

Updated 22 October 2026