Privacy

Last updated 9 August 2026

This describes how Howll actually works today, written plainly. It has not yet been reviewed by a lawyer — if you need a signed agreement or a DPA before you can proceed, get in touch and we will do that properly rather than point you at a web page.

Who we are

Howll is operated by Howll AI, based in Australia. Questions about anything here go to hello@howll.ai.

What we hold

Your content. The skills, documents and files you put into Howll, their version history, who approved each version and when, and the record of what was produced from them.

Who is in your organisation. Email address, role and department for each member. We take your email address from your identity provider when you sign in; we never ask you for a password and never hold one.

What was done. An append-only audit log of actions taken through Howll — who, what, which version, when.

We do not use your content to train any model, and we do not sell or share it.

Where it lives

Your data is stored in Sydney, Australia. Files are held in private storage — never a public bucket — and every download is a link that expires within minutes. Files are limited to 25.0 MB each.

Who can reach it

Every table is isolated by organisation using database row-level security, deny-by-default, and that isolation is asserted by automated tests that check one organisation cannot reach another's rows in either direction.

The application holds no master database key. There is no credential in our code that can read across organisations, which means a full compromise of our servers still cannot read your content.

Within your organisation, what a person can reach is decided by their role, server-side, on every request.

Who else is involved

We use a small number of providers to run the service: Supabase (database, authentication and file storage, Sydney), Vercel (application hosting), Resend (transactional email — invitations, welcome and trial notices) and Stripe (payments; we never see or store a card).

Your AI tool connects to Howll through a connector you install. What that tool then does with the content it receives is governed by that vendor's terms, not ours.

Getting it back, and getting rid of it

You can export everything at any time, on every plan including the trial and unchanged if you cancel — all content as Markdown, a manifest of versions, approvals and clients, and every attached file. The archive is assembled in your browser, so the files travel from storage straight to you.

Ask us to delete your organisation and we will delete it and its content. Ask for a copy of what we hold about you personally, or ask us to correct it, and we will.

Cookies

Howll sets the cookies needed to keep you signed in. There is no advertising, no third-party tracking and no analytics profile built about you.

Changes

If this changes materially we will tell the owners of active organisations by email rather than quietly editing the page.