Skip to content
Hathi
Get Hathi

Privacy policy

Last updated 16 July 2026 · Version 2.0

Hathi (“we”, “us”), trading in the United Kingdom, is the controller of the personal data described in this policy. Privacy is the whole point of Hathi, so we’ve written this in plain English, but it is a complete notice under the UK General Data Protection Regulation (UK GDPR), and the EU GDPR where it applies to users in the EU. It explains what we collect, why, the legal bases we rely on, how long we keep it, who we share it with, and the rights you can exercise.

1. Who we are & how to contact us

  • Controller: Hathi, operating from the United Kingdom.
  • Privacy contact / Data Protection Officer: privacy@hathi.chat.

2. The promise

We never use your messages, memories or any content you send to train AI, ours or anyone else’s. Your content is used only to answer you and to build the memory that makes Hathi useful, which you can view, export or delete at any time from your dashboard.

3. The personal data we collect

  • Account data: your email address and authentication details, and your subscription status.
  • Channel data: the messaging channels you connect (for example WhatsApp), a masked phone number, and the identifiers needed to route messages to you.
  • Message content & memory: the messages you send to Hathi and the memories Hathi derives from them (your preferences, people, dates and tasks). This content may, depending on what you choose to share, include special category data (see section 6).
  • Usage & technical data: message counts and timestamps for fair-use accounting (we count messages, not their content), plus limited technical logs (e.g. IP address, device/browser type) needed to operate and secure the service.
  • Payment data: your billing is handled by Stripe, which collects your card details directly. We receive only your subscription status and limited transaction metadata; we never see or store full card numbers.
  • Support data: anything you send us when you contact us.

4. How we use your data & our legal bases

  • Provide the assistant and build your memory: legal basis: performance of our contract with you (Art. 6(1)(b)).
  • Process messages through AI to generate responses: see section 5. Legal basis: contract (Art. 6(1)(b)).
  • Take payment and manage your subscription: legal basis: contract, and legal obligation for tax/accounting records (Art. 6(1)(b) and (c)).
  • Keep the service secure, prevent abuse, and enforce fair-use: legal basis: our legitimate interests in running a safe, sustainable service (Art. 6(1)(f)).
  • Diagnose problems and improve reliability using aggregated or de-identified data: legitimate interests (Art. 6(1)(f)). This never includes training AI on your content.
  • Comply with legal obligations and respond to lawful requests: legal obligation (Art. 6(1)(c)).
  • Send you optional product updates, if you opt in: legal basis: consent (Art. 6(1)(a)), withdrawable at any time.

5. AI processing & automated decisions

To answer you, your messages are processed by AI. Hathi's memory, and the way Hathi finds what Hathi knows, run on our own systems. For some tasks we ask third-party AI providers to help, chosen because their terms keep your content private and stop them seeing what you send. DeepInfra is one example. Before anything leaves our systems, we strip or blur identifying detail, so the provider cannot rebuild your data. Your memory stays with us. Your content is not used to train AI, ours or anyone else’s.

We do not make decisions that produce legal or similarly significant effects about you without human involvement, so Article 22 GDPR (automated decision-making, including profiling) does not apply. Hathi is a tool that assists you; you remain in control and should confirm anything important before relying on it.

6. Special category data

We do not ask for special category data (such as health, religious or political information). However, because you can send Hathi anything, your messages may contain it. Where you voluntarily include such data, we process it to provide the service at your request and on the basis that you have manifestly made it available to us (Art. 9(2) GDPR). Please avoid sharing sensitive information you don’t want processed.

7. Retention

  • Memories and channel data: kept until you delete them or close your account.
  • Account closure: deleting your account triggers erasure of memories, channels and usage records, as required by Art. 17 GDPR. Your subscription is cancelled immediately.
  • Paused subscriptions: if billing fails and cannot be recovered, your memory is retained for 90 days so you can resume, then deleted.
  • Billing records: retained for up to 7 years to meet UK tax and accounting obligations.
  • Security logs: retained for a short period as needed for security and then deleted or aggregated.

8. Who we share your data with

We do not sell your data. We share it only with sub-processors that help us run the service, each under a data-processing agreement:

  • Stripe: payments.
  • Supabase: authentication and database storage.
  • Cloudflare: hosting, content delivery and security.
  • Meta Platforms (WhatsApp) and Apple (iMessage): message delivery on the channels you connect.
  • Third-party AI providers (for example DeepInfra): help with specific tasks that we do not run on our own systems. These providers are chosen because their terms keep your content private and stop them seeing what you send.

Hathi's memory, and the way Hathi finds what Hathi knows, run on our own systems. Where we ask a third-party AI provider to help with a task, we strip or blur identifying detail first, so the provider cannot rebuild your data. We may also disclose data where required by law, to establish or defend legal claims, or in connection with a merger or acquisition (with notice to you).

9. International transfers

Most processing of your messages happens on our own systems within the EU. Where a task is passed to a third-party AI provider, or to another sub-processor (for example payment and message-delivery providers), limited data may be processed outside the EEA. Where it is, we rely on an adequacy decision, or on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum for UK users), together with additional measures where needed. You can request a copy of the relevant safeguards from privacy@hathi.chat.

10. Your rights

Under the EU GDPR (and the UK GDPR, if it applies to you) you have the right to:

  • access a copy of your personal data;
  • rectify inaccurate data;
  • erase your data (“right to be forgotten”);
  • restrict or object to certain processing;
  • data portability: export a machine-readable JSON copy of everything Hathi remembers from the Memory & data page;
  • withdraw consent at any time, where we rely on consent;
  • lodge a complaint with a supervisory authority (see section 11).

You can delete any single memory instantly, or delete everything, from your dashboard. To exercise any other right, email privacy@hathi.chat. We respond within one month, as required by law.

11. Complaints

Our lead supervisory authority is the UK Information Commissioner’s Office (ico.org.uk). If you’re in the EU you can complain to your local data protection authority. We’d appreciate the chance to resolve it first. Please contact us.

12. Cookies & tracking

We use only the strictly necessary cookies required to sign you in and keep the service secure. We self-host our fonts, so no data is sent to Google Fonts, and we do not use advertising or cross-site tracking cookies.

13. Children

Hathi is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll notify you (for example, in-app or by email) and update the “last updated” date above.

15. Contact

Questions or a data request? Email privacy@hathi.chat or use our contact form, and we’ll respond promptly.