Privacy policy
Last updated: 30 October 2026
This policy describes the private, owner-operated Hermes Personal Assistant installation associated with bazulic.com, its Gmail connection and this informational website. It is not the privacy policy of Google or the developers of Hermes Agent.
1. Purpose and operator
The installation is operated for its account owner's personal email organisation and assistance. Its features include understanding email threads, identifying requests and deadlines, preparing responses, managing email under the owner's instructions and preparing private briefings. It is not offered as a public multi-user service.
For questions or local-data deletion requests, the account owner can use the existing private conversation with the assistant. The application's support email is also shown on Google's OAuth consent screen. This website deliberately does not publish the private mailbox address.
2. Google data accessed and permissions
When explicitly authorised through Google OAuth, the assistant can access Gmail message text, message headers, sender and recipient addresses, timestamps, labels, thread context and draft information. Attachment metadata may be included in a mail review; attachment contents are retrieved only as needed for an owner-authorised task.
The requested scope is https://www.googleapis.com/auth/gmail.modify. This permits reading, composing, sending and managing messages, drafts and labels, including archiving, marking spam and moving messages to the trash. The current daily briefing collector performs read-only mailbox operations. Sending and other mailbox changes depend on the owner's instructions and the configured action permissions.
This Gmail authorisation does not request access to the personal account's Calendar, Drive or Contacts. Any other account connections are authorised separately.
3. How data is used
Gmail data is used to provide the personal assistant functions described here: thread-aware review, summaries, response preparation, owner-requested mail management and follow-up assistance. Relevant email content can be combined with information from other separately authorised connections when preparing the owner's briefings.
The installation does not sell mailbox data, rent it, publish it on this website or use it for advertising, advertising profiles, data brokerage or creditworthiness decisions.
4. AI processing and other service providers
This is an AI-assisted service, not exclusively local processing. Relevant message content, instructions and derived summaries may be sent to the AI provider configured for the assistant to perform the requested functions. The owner's private messaging service receives the content included in conversations and delivered briefings. The selected providers' applicable terms, retention settings and privacy controls also apply; this notice does not promise zero provider retention.
The account owner selects and configures these services. Google API data is authorised only for the user-facing assistant functions described in this policy, not for unrelated uses or general-purpose model training. Provider settings must be consistent with that limitation.
Cloudflare hosts this static informational website. Its hosting and security infrastructure may process visitors' IP addresses, request URLs and ordinary connection metadata. Gmail tokens, mailbox contents and private briefing data are not part of this site's published files.
5. Storage, retention and security
OAuth credentials and retrieved mail data are stored on the private assistant server with account-specific files and restricted filesystem permissions. Cached email threads, summaries and conversation history may be retained to provide continuity and follow-up context; no fixed automatic deletion period is currently configured for these private records.
Google API traffic and public web connections use HTTPS. OAuth credentials are not intentionally included in public website files, downloads or public logs. This policy does not claim that local file restrictions constitute end-to-end encryption or that all external providers have identical retention policies.
The account owner can request deletion of locally held data or remove it administratively. Deleting local data does not automatically delete copies in the owner's Gmail mailbox, private messaging history or external providers' systems. Provider-side deletion and backup retention are governed by the relevant service and account controls.
6. Withdrawal and deletion
The owner can disconnect the application in the Google Account's third-party connections settings and ask the assistant operator to remove local credentials and retained copies. Revoking access prevents subsequent authorised API access, but does not itself erase previously stored private caches or chat history.
7. Website tracking
The published website includes no advertising, analytics scripts, sign-up forms or third-party embedded content. Links to external sites are opened only when a visitor chooses to follow them. Operational processing by the hosting provider is described above.
8. Google API data commitments
The use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements. The installation's authorised purposes are restricted to the private assistant functionality disclosed above.
9. Changes
This notice must be updated if data access, processing purposes or sharing practices materially change. Additional consent is required before Google data is used for a new purpose not described here.