Legal
Privacy Policy
Effective date: 5 August 2026
This Privacy Policy explains how White Cat Advertising SRL (“White Cat”, “Humm”, “we”, “us” or “our”) processes personal data through the Humm web application, related websites, integrations and support services (together, the “Service”).
1. Who we are
The data controller for Humm account, billing, security, support and website data is White Cat Advertising SRL, a Romanian limited liability company registered under number J2012008336403, VAT number RO30451274, with its registered office at Strada Căpitan Mircea Vasilescu 16-18, București, Romania.
Privacy contact: privacy@whitecat.ro.
When a customer uses Humm to collect, classify, route and respond to reviews, comments or messages concerning its brands, that customer normally determines why and how that personal data is processed. In that context, the customer is the controller and Humm acts as its processor, subject to the customer agreement and data-processing terms.
2. Scope and people covered
This policy covers Humm account holders and authorized users; people who contact us; individuals whose public reviews, comments, profile information or messages are processed at a customer’s direction; recipients of workflow notifications; and visitors to Humm websites.
3. Personal data we process
Account and identity
Name, work email, user ID, organization, role, language and account state.
Authentication
OTP challenge data, hashed OTP values, expiry and attempt counters, session identifiers and security logs.
Brand and workflow
Brands, topics, rules, reply templates, assignments, human-review decisions, audit history and internal notes.
Connected channels
Platform account and channel identifiers, access scopes, token-expiry information, connection metadata and restricted provider credentials.
Customer conversations
Review or comment text, rating, display name, profile or comment identifier, timestamps, source URL, language and Humm’s generated or published reply.
AI-derived data
Topic classification, rule match, sentiment, urgency, confidence, suggested reply and reasons for human review.
Notification data
Member phone, opt-in, message identifiers, template name, delivery events and responses such as approve, edit or reply later.
Technical and support
IP address, browser information, timestamps, API and diagnostic logs, support messages and security events.
4. Google and YouTube API data
When an authorized Humm user connects a YouTube channel, Humm accesses Google user data only after the user grants permission through Google OAuth. Depending on the permissions granted, this may include the authorized YouTube channel’s identifier and public channel information, video-related identifiers, comments and comment metadata, and the ability to publish replies on behalf of that channel.
Humm uses Google and YouTube data to provide these user-facing features:
- identify and display the connected YouTube channel;
- retrieve comments associated with that channel for monitoring and classification;
- match comments to customer-defined topics and response rules;
- draft suggested replies and publish replies according to the customer’s configuration; and
- maintain operational logs needed for security, deduplication and troubleshooting.
Humm does not sell Google user data, use it for targeted advertising, provide it to data brokers, or use it to train general-purpose AI models. Google user data is transferred to service providers only where necessary to operate or improve the visible Humm features requested by the user, subject to appropriate contractual and security safeguards.
OAuth access and refresh tokens are handled server-side, restricted to authorized services and encrypted at rest. Users can disconnect a YouTube channel in Humm. They can also revoke Humm’s Google access from their Google Account’s third-party connections settings. After disconnection or a valid deletion request, Humm deletes or renders unusable the stored provider credentials and removes associated data according to the applicable retention obligations.
Humm’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the applicable YouTube API Services Terms of Service.
5. Where the data comes from
Data comes directly from users and customers; customer administrators; connected platforms such as YouTube, Google Business Profile, Facebook, Instagram, Threads and WhatsApp; public reviews and comments made available through those platforms; service providers; and technical use of the Service.
6. Purposes and legal bases
We process personal data to provide and administer the Service; carry out customer instructions; authenticate users; secure the Service; send operational communications; support AI-assisted classification and reply generation; improve reliability; comply with law; and establish or defend legal claims.
Depending on the context, the legal basis is performance of a contract, legitimate interests, legal obligation, consent, or processing on behalf of a customer controller.
7. AI-assisted processing and human review
Humm uses artificial intelligence to classify incoming content, match customer-defined topics and rules, assess confidence and draft replies. Clear rules may permit automatic replies. Unclear, conflicting, low-confidence or sensitive situations can create a human-review task for the assigned person.
Humm is not intended to make decisions producing legal or similarly significant effects about the person who posted a review or comment. Customers remain responsible for their instructions, response policies and final communications.
8. Who receives personal data
Personal data may be available to the relevant customer and authorized users; the originating platform when a response is published; hosting, security, email, communications and AI providers required to operate Humm; professional advisers and authorities where required; and participants in a lawful corporate transaction.
Current intended service categories include SendGrid for transactional email, Meta platforms for social and WhatsApp functionality, Google and YouTube for connected channel functionality, and OpenAI for API-based classification and reply generation.
9. International transfers
Some providers may process data outside Romania or the European Economic Area. Where required, we rely on an adequacy decision, Standard Contractual Clauses, supplementary safeguards or another lawful transfer mechanism.
10. Retention
We retain personal data only as long as reasonably necessary for the relevant purpose, customer contract and legal obligations. Account and contract records may be retained for the account term and up to six years afterward; OTP challenges normally no more than 30 days; operational logs normally 90 days to 12 months; imported conversations and reply history for the customer-selected period or account term; and human-review and communications audit records normally up to 24 months.
11. Security
We use measures appropriate to the risk, including access controls, least-privilege permissions, encrypted communications, restricted and encrypted provider credentials, token rotation, logging, backups, environment separation, dependency management and incident-response procedures.
12. Your data protection rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, objection, withdrawal of consent and human intervention where Article 22 GDPR applies. Contact privacy@whitecat.ro. We may need to verify your identity and may refer customer-controlled requests to the relevant customer.
13. Complaints
You may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 General Gheorghe Magheru Boulevard, District 1, 010336 Bucharest, Romania, or with the supervisory authority in your habitual residence, place of work or place of the alleged infringement.
14. Cookies, children and third-party platforms
Humm may use strictly necessary cookies for authentication, security and session continuity. Humm is a business service and is not directed to children. Connected platforms operate under their own terms and privacy notices, and Humm does not control how they process data independently for their own purposes.
15. Changes and contact
We may update this policy as the Service, providers or legal requirements change. The revised version will show a new effective date.
Privacy enquiries and rights requests: privacy@whitecat.ro
Postal address: Strada Căpitan Mircea Vasilescu 16-18, București, Romania.