Privacy
Last updated 10 October 2026
Henbal is an assistant you reach on WhatsApp. To do that job it has to hold on to what you tell it. This page says exactly what that means: what is kept, how long it stays, who else can see it, and how to get rid of it.
What Henbal stores
- Your phone number. It is how Henbal knows an account is yours. There is no password and no separate signup.
- Your messages, and Henbal’s replies. Kept in full, because an assistant that forgets last week is not much of an assistant.
- What you have committed to. Things you asked to be reminded of, and things Henbal worked out from what you said, along with the sentence it worked them out from, so you can always check whether it got it right.
- Mail you forward. If you forward email to your Henbal address, the whole message is stored: sender, subject and body.
- Mail in your Gmail account, if you connect it. This is separate from forwarding, and you can use either, both, or neither. Connecting Gmail lets Henbal see mail as it arrives — read only, never sent, never modified — so it can notice something worth telling you about without you forwarding it yourself. Each message Henbal reads this way is stored the same way a forwarded one is: sender, subject and body.
- Which accounts you have connected, and what Henbal spent on your behalf running the model.
What Henbal does not store: your Google password, and no refresh token for any account you connect. When you link Google, the authorisation is held by Composio (named below), not by Henbal.
How long it is kept
| Your messages and Henbal’s replies | Kept for as long as your account exists, because Henbal needs them to remember context. |
|---|---|
| Commitments and reminders | Kept until you dismiss them, and then kept as a record until you delete your account. |
| Mail forwarded to your Henbal address, or read from a connected Gmail account | Kept for as long as your account exists. |
| Records of what Henbal spent on your behalf (model usage) | Kept for as long as your account exists, so billing and usage limits can be explained to you. |
| Copies held by Google, whose model reads your messages | Google holds what it receives in memory for up to 24 hours. If its automated safety checks flag a request as possible abuse, it may keep that prompt for up to 90 days. These follow Google’s own rules, and deleting your Henbal account does not reach them. |
| Connections to third-party accounts | Removed the moment you disconnect. The authorisation itself is revoked at the provider at the same time. |
| Your phone number, after you delete your account | Kept for 90 days after deletion, and for nothing else — not your messages, not your commitments, not your mail, none of which survive deletion at all. This one exception exists solely so the same number cannot repeatedly delete its account and sign up again for a fresh free trial. After 90 days it too is permanently removed. |
Who else can see it
Henbal is built on other companies’ services, and some of them necessarily see your data to do their part. Every one of them is named here.
Meta Platforms (WhatsApp Business Cloud API)
Delivers the conversation itself — every message in and out.
What it receives: Your phone number and the full text of every message you send Henbal and Henbal sends you.
Processed in: Global, per Meta’s own infrastructure
Google Cloud (Vertex AI, Gemini models)
The model that reads your messages and decides what to do. Google now also calls this service the Gemini Enterprise Agent Platform.
What it receives: The text of your recent conversation, anything you have forwarded, what Henbal looks up for you (such as calendar events or mail), and the list of commitments Henbal is tracking for you. Under Google’s terms it does not use this to train or fine-tune its models without your permission. Google holds what it receives in memory for up to 24 hours to speed up repeat requests. If Google’s automated safety checks flag a request as possible abuse, Google may keep that prompt for up to 90 days so authorised Google staff can review it.
Processed in: Worldwide. Google’s global endpoint, which Henbal uses, may process a request in any Google Cloud location and offers no data residency guarantee
Anthropic
A model that can read your messages and decide what to do. Henbal uses it for some background tasks, such as noticing new mail, and keeps it available as an alternative to the Google model. Which model handles a task is a setting, so both are named here.
What it receives: The text of your recent conversation, anything you have forwarded, what Henbal looks up for you (such as calendar events or mail), and the list of commitments Henbal is tracking for you. Which of these it sees depends on the task it is handling.
Processed in: United States
Supabase
The database everything is stored in, and its hosting.
What it receives: Everything Henbal stores about you: your phone number, your messages, your commitments, forwarded mail, and which accounts you have connected.
Processed in: As configured for this deployment
Composio
Holds the connection to any third-party account you link, and makes calls to it on Henbal’s behalf.
What it receives: The authorisation you granted to your Google account, the content of each calendar request Henbal makes, and — if you connect Gmail — the mail in that account, read only, so Henbal can notice what has arrived without you having to forward it yourself. Henbal never stores your Google password or refresh token — Composio holds the grant.
Processed in: United States
Mailgun (Sinch)
Receives mail forwarded to your Henbal email address.
What it receives: Any email you forward to your Henbal address, including its sender, subject and full body.
Processed in: United States or European Union, per the configured routing region
How to delete it
Message Henbal on WhatsApp and ask it to delete your account. Everything Henbal itself holds goes: your messages, your commitments, your forwarded mail, your connections. Any account you had connected is disconnected at the provider at the same time. Copies held by the services named above, such as the short-lived ones Google keeps, follow those services’ own rules and are not reached by deleting your account.
One exception, stated plainly rather than left for the table above to carry alone: your phone number itself is kept for 90 days after deletion, and for nothing else. This is solely to stop the same number deleting its account and signing up again for a fresh free trial, over and over, at no cost. After 90 days the number is permanently removed from Henbal’s records too.
You can also do less than that. Ask Henbal to disconnect a single account and it disconnects only that one. Ask it to stop sending you the morning brief and it stops, without deleting anything.
Your rights
Under India’s Digital Personal Data Protection Act you can ask what is held about you, ask for it to be corrected, and ask for it to be erased. Ask Henbal in the chat, or write to the address below. There is no form.
Getting in touch
Message Henbal on WhatsApp, or email privacy@bilaval.one.