Skip to content
Hathi
Get Hathi

Privacy policy

Last updated 16 July 2026 · Version 2.0

We All Share B.V. (trading as “Arazon”), the company behind Hathi (“we”, “us”), is the controller of the personal data described in this policy. Privacy is the whole point of Hathi, so we’ve written this in plain English — but it is a complete notice under the EU General Data Protection Regulation (GDPR), and the UK GDPR where it applies to users in the UK. It explains what we collect, why, the legal bases we rely on, how long we keep it, who we share it with, and the rights you can exercise.

1. Who we are & how to contact us

  • Controller: We All Share B.V., a company registered in the Netherlands (KVK no. 97630306), trading as Arazon and operating Hathi.
  • Registered office: Schipperslaan 9, 1906 BG Limmen, the Netherlands.
  • Privacy contact / Data Protection Officer: privacy@hathi.chat.

2. The promise

We never use your messages, memories or any content you send to train AI models — ours or anyone else’s. Your content is used only to answer you and to build the memory that makes Hathi useful, which you can view, export or delete at any time from your dashboard.

3. The personal data we collect

  • Account data — your email address and authentication details, and your subscription status.
  • Channel data — the messaging channels you connect (WhatsApp, iMessage), a masked phone number, and the identifiers needed to route messages to you.
  • Message content & memory — the messages you send to Hathi and the memories Hathi derives from them (your preferences, people, dates and tasks). This content may, depending on what you choose to share, include special category data (see section 6).
  • Usage & technical data — message counts and timestamps for fair-use accounting (we count messages, not their content), plus limited technical logs (e.g. IP address, device/browser type) needed to operate and secure the service.
  • Payment data — your billing is handled by Stripe, which collects your card details directly. We receive only your subscription status and limited transaction metadata; we never see or store full card numbers.
  • Support data — anything you send us when you contact us.

4. How we use your data & our legal bases

  • Provide the assistant and build your memory — legal basis: performance of our contract with you (Art. 6(1)(b)).
  • Process messages through AI to generate responses — see section 5. Legal basis: contract (Art. 6(1)(b)).
  • Take payment and manage your subscription — legal basis: contract, and legal obligation for tax/accounting records (Art. 6(1)(b) and (c)).
  • Keep the service secure, prevent abuse, and enforce fair-use — legal basis: our legitimate interests in running a safe, sustainable service (Art. 6(1)(f)).
  • Diagnose problems and improve reliability using aggregated or de-identified data — legitimate interests (Art. 6(1)(f)). This never includes training models on your content.
  • Comply with legal obligations and respond to lawful requests — legal obligation (Art. 6(1)(c)).
  • Send you optional product updates, if you opt in — legal basis: consent (Art. 6(1)(a)), withdrawable at any time.

5. AI processing & automated decisions

To answer you, your messages are processed by AI models that we develop and operate ourselves, running on our own infrastructure. Your content is not sent to any third-party AI provider, and it is never used to train models — ours or anyone else’s.

Hathi does not make decisions that produce legal or similarly significant effects about you without human involvement, so Article 22 GDPR (automated decision-making, including profiling) does not apply. Hathi is a tool that assists you; you remain in control and should confirm anything important before relying on it.

6. Special category data

We do not ask for special category data (such as health, religious or political information). However, because you can send Hathi anything, your messages may contain it. Where you voluntarily include such data, we process it to provide the service at your request and on the basis that you have manifestly made it available to us (Art. 9(2) GDPR). Please avoid sharing sensitive information you don’t want processed.

7. Retention

  • Memories and channel data — kept until you delete them or close your account.
  • Account closure — deleting your account triggers a cascading erasure of memories, channels and usage records, completed within 30 days (Art. 17 GDPR). Your subscription is cancelled immediately.
  • Paused subscriptions — if billing fails and cannot be recovered, your memory is retained for 90 days so you can resume, then deleted.
  • Billing records — retained for up to 7 years to meet Dutch tax and accounting obligations.
  • Security logs — retained for a short period as needed for security and then deleted or aggregated.

8. Who we share your data with

We do not sell your data. We share it only with sub-processors that help us run the service, each under a data-processing agreement:

  • Stripe — payments.
  • Supabase — authentication and database storage.
  • Cloudflare — hosting, content delivery and security.
  • Meta Platforms (WhatsApp) and Apple (iMessage) — message delivery on the channels you connect.

The AI that powers Hathi is built and hosted by us, so — unlike most AI services — no third-party AI provider is involved in processing your messages. We may also disclose data where required by law, to establish or defend legal claims, or in connection with a merger or acquisition (with notice to you).

9. International transfers

The AI processing of your messages happens on our own infrastructure within the EU. Some other sub-processors (for example payment and message-delivery providers) may process limited data outside the EEA. Where they do, we rely on an adequacy decision, or on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum for UK users), together with additional measures where needed. You can request a copy of the relevant safeguards from privacy@hathi.chat.

10. Your rights

Under the EU GDPR (and the UK GDPR, if it applies to you) you have the right to:

  • access a copy of your personal data;
  • rectify inaccurate data;
  • erase your data (“right to be forgotten”);
  • restrict or object to certain processing;
  • data portability — export a machine-readable JSON copy of everything Hathi remembers from the Memory & data page;
  • withdraw consent at any time, where we rely on consent;
  • lodge a complaint with a supervisory authority (see section 11).

You can delete any single memory instantly, or purge everything, from your dashboard. To exercise any other right, email privacy@hathi.chat. We respond within one month, as required by law.

11. Complaints

Our lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) — autoriteitpersoonsgegevens.nl. If you’re elsewhere in the EU you can complain to your local data protection authority, and if you’re in the UK to the Information Commissioner’s Office (ico.org.uk). We’d appreciate the chance to resolve it first — please contact us.

12. Cookies & tracking

We use only the strictly necessary cookies required to sign you in and keep the service secure. We self-host our fonts, so no data is sent to Google Fonts, and we do not use advertising or cross-site tracking cookies.

13. Children

Hathi is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll notify you (for example, in-app or by email) and update the “last updated” date above.

15. Contact

Questions or a data request? Email privacy@hathi.chat or use our contact form, and we’ll respond promptly.