Privacy Policy

Last updated: 31 July 2026

Spinning Plates is a personal assistant that works over WhatsApp, operated by Hesta AI Ltd, a company registered in England and Wales ("we", "us"). This policy explains what information we collect, how we use it, and the choices you have. We keep it in plain English on purpose.

What we collect

• WhatsApp messages and phone number. When you message Spinning Plates, we receive your phone number, profile name, and the content of your messages (delivered via the WhatsApp Business API through Twilio). We store your conversation history so Spinning Plates has context and can help you over time.
• Google account data (only if you connect it). You can optionally connect your Gmail and Google Calendar so Spinning Plates can help with your email and schedule. See the Google section below for exactly what this means.
• Contact form details. If you use the contact form on this site, we receive the name, email address, and message you provide.
• Service logs. Like most services, our servers keep technical logs (such as timestamps and IP addresses) used for security, rate-limiting, and debugging.

Your Google data

If you choose to connect your Google account, Spinning Plates requests access to Gmail (to read, draft, and send email on your behalf) and Google Calendar (to read and manage events). We use this access solely to provide the assistant features you ask for — for example summarising your inbox, drafting a reply for your approval, or adding an appointment to your calendar. Spinning Plates never sends an email without your explicit approval of that specific message.

• We only use Google user data to provide user-facing features you have requested.
• We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models.
• Humans do not read your Google data, except with your explicit permission (for example a support request), where required for security or abuse investigation, or where required by law.
• You can disconnect Google at any time, either by asking Spinning Plates or from your Google account permissions page. Disconnecting revokes our access.

How we use your information

To run Spinning Plates: understanding your messages, carrying out the tasks you ask for, remembering context you've shared, and improving reliability. We do not sell your data, and we do not use it for advertising.

Who we share it with

We share data only with the service providers needed to run Spinning Plates, under their own contractual data protections:

• AI providers (such as Anthropic and OpenAI) — message content is processed by their models via API to generate Spinning Plates's responses. Our API agreements with these providers do not permit them to train their models on your data.
• Twilio — carries WhatsApp messages to and from Spinning Plates.
• Google — when you use Google features, requests go to Google's APIs.
• Fly.io — hosts our servers and database (primary region: London).
• Resend — delivers contact-form emails to us.

We may also disclose information if required by law. If Hesta AI Ltd is ever involved in a merger or acquisition, your data would remain protected by this policy or one at least as protective.

How long we keep it

We keep your data while your account is active so Spinning Plates can keep helping you. If you stop using Spinning Plates or ask us to delete your data, we delete it from our systems within 30 days, except minimal records we are legally required to keep. Google access tokens are deleted immediately when you disconnect.

Security

Data is encrypted in transit (TLS) and at rest. Google access tokens are stored encrypted, access to production systems is restricted, and we follow the principle of least privilege.

Your rights

Under UK GDPR you have the right to access, correct, delete, or export your personal data, and to object to or restrict our processing of it. To exercise any of these, message Spinning Plates directly or email us — we'll act on it promptly. You also have the right to complain to the Information Commissioner's Office.

Children

Spinning Plates is not intended for children under 16, and we do not knowingly collect their data.

Changes to this policy

If we make material changes, we'll update this page and note the new date at the top. For significant changes affecting connected accounts, we'll tell you on WhatsApp first.

Contact

Questions or requests: rosie@tryspinningplates.com, or use the contact form.