Legal

Privacy Policy

Effective and last updated November 2, 2026

This policy explains what information HSA AI collects when you use our web app, our Slack app and our website, what we do with it, who can see it, how long we keep it and the choices you have.

The short version

We collect what you give us (your account details, the questions you ask, messages you send to our Slack bot, sign-up and billing details, emails, and messages from our website's contact form) plus a limited amount of technical and usage information.
To write an answer, we send your question, the recent turns of the same chat or Slack thread and excerpts from our guides to our AI provider, Anthropic. When a business owner asks a question in the web app, a short summary of the business profile they set up goes with it. When a business owner on the Pro or Diamond plan asks a question in the web app, in a chat nobody else has written in, the business's name and what HSA AI remembers about the business (its Memory) go with it too. Otherwise, from the web app we don't send your business name, and we never send your name or email address, unless they appear in what you type or, on the Diamond plan, in what HSA AI reads from software you connect.
On the Pro and Diamond plans, HSA AI keeps a Memory of what a business owner tells it about their business (such as where it works, roughly what it makes each month, the software it uses and things to follow up on), and anything owners add themselves. Only owners can see, change or delete it, in Settings, and it is used only for owners' own questions. HSA AI is told never to save people's names, and our software refuses street addresses, phone numbers, email addresses, links, passwords or logins, and card, bank or ID numbers wherever it can detect them (see section 4.11).
We don't use your content to train AI models, and our AI provider, Anthropic, isn't allowed to train its models on it.
If you speak a question instead of typing it, the recording goes to Cloudflare to be turned into text. We don't keep the recording, and no question is asked and no answer written until you send the words (see section 4.4).
Chats are shared: everyone in your business account can see every chat, except private chats. On the Diamond plan, a chat where HSA AI reads software an owner connected, and every chat an automation makes, is visible only to that owner (see section 4.7). Authorized HSA AI staff can also access content to support you, keep the service safe and improve our answers, but they can't open a private chat through the app, or a channel unless they're on your business account.
On the Diamond plan, an owner can connect software the business uses, such as Google Calendar, Gmail or Slack, through our provider Composio. We read a connected calendar about once a day to work out a few numbers, and keep only those numbers. When the owner who connected an app asks about it, or one of their automations runs, HSA AI reads what it needs at that moment and sends it to Anthropic to write the answer. We don't store what it reads: we keep the answer, in a chat only that owner can see, and, for a limited time, what an automation sends. If that owner has an automation post its reports in a team channel, each report is also copied there (see section 4.10). We use what it reads only for your business and to keep the Services secure, never to improve them. HSA AI never changes anything in your software, except to post to Slack channels an owner switched on, or to do an action of an automation that the owner approved (see sections 4.5 to 4.9).
On the Diamond plan, your team can write to each other in channels. Everyone in your business can read a public channel. A private channel can be read by the people in it and by every owner of the business, so private hides a channel from other team members, not from the owners. An owner can have an automation post its reports in a channel: each report is copied exactly as it is in their private chat, including any customers' names, email addresses and phone numbers in it, for everyone who can see that channel to read (see section 4.10).
When you pay online, you pay on the checkout page of our payment provider, Whop, which handles your card details. We receive only limited details of your subscription and of any credit packs you buy, never your card number.
We don't sell personal information for money. The web app and the Slack app have no ads, analytics or cross-site trackers of our own, and the web app sets no cookies. When you play a video in the app, Loom's or Bunny's player may use its own analytics and cookies under that company's privacy policy (see section 1.4).
Our website uses Google Analytics, Google Ads and the Meta Pixel only if you say yes in its cookie banner. Nothing optional runs until you choose, and you can change your mind anytime with the "Cookie settings" or "Your privacy choices" button at the bottom of the site. If you allow advertising cookies, Google and Meta may also use that information for their own purposes, which some US state laws call "sharing" or "targeted advertising." We honor Global Privacy Control as an opt-out of advertising (see section 8).
While hsacleanai.com still shows a placeholder page hosted by Squarespace, Squarespace may set cookies and collect visitor information under its own privacy policy (see section 7).
Some things are short-lived: feedback is kept about 30 days and question records (without the question text) about 180 days. Chats and channel messages stay until they're deleted or the account is closed.
Email info@hsacleanai.com to see, correct, delete or get a copy of your information. We usually answer within 30 days; section 11 explains when we may need longer.
People in the EEA, UK and Switzerland, in Canada and in California and other US states have extra information in section 12, section 13 and section 14.

This summary is here to help you read the document. It is not a substitute for the full text, which controls.

1.About this policy

1.1 Who we are

This Privacy Policy explains how Robinsky Group LLC, a limited liability company that owns and operates HSA AI ("HSA AI," "we," "us," or "our"), collects, uses, shares and protects personal information. HSA AI is an AI business coach for owners of cleaning businesses. We are based in the United States, and our address is 269 W Pebble Creek Lane, Orange, CA 92865.

HSA AI is the controller of the personal information described in this policy. That means we decide how and why it is used. You can reach us about anything in this policy at info@hsacleanai.com. The same address reaches the person responsible for privacy at HSA AI.

1.2 What this policy covers

This policy covers our "Services," which means:

The web app at app.hsacleanai.com.
The Slack app: the HSA AI bot, used in Slack channels, direct messages and the Slack assistant panel that we provide, including through Slack Connect and guest access.
The website at hsacleanai.com and any HSA AI marketing pages, including the pages that describe our plan and link to sign-up, and our checkout pages at buystarter.hsacleanai.com (Starter) and buypro.hsacleanai.com (Pro).
Emails and support: messages you send us by email or through the contact form on our website, emails we send you, and consultation calls you book through our scheduling link.

Our Terms of Service explain the rules for using the Services. Words defined in the Terms mean the same thing here. This policy is a notice of our practices, not a contract, and it isn't part of the Terms. When you sign up, create an account or accept an invitation to join a business account, we ask you to agree to the Terms and acknowledge this policy. Each time you sign up for, upgrade to or restart a paid plan (Starter or Pro) in the web app, or buy Starter or Pro on our checkout page for it, we ask again, and we ask you to agree to the plan's automatic renewal.

1.3 Business accounts

HSA AI is built for businesses. When a business account owner invites team members, the business decides who has access to its account and what its team asks. HSA AI is still the controller of the personal information we process to run the Services, and this policy applies to everyone who uses them, whether you are an owner, a team member or a Slack user.

If your business needs a data processing agreement with us, email info@hsacleanai.com and we'll discuss it.

1.4 What this policy doesn't cover

Slack, Anthropic, Whop, Google, Meta, Calendly and other companies run their own services under their own privacy policies. For example, the messages you post in Slack are also held by Slack under Slack's terms and your workspace's settings. We describe how we use their services, but we don't control how they handle information for their own purposes.
Answers and guides may link to third-party websites, videos and products, and some of those links are affiliate links (see section 7 of our Terms). When you click those links, the other site's privacy policy applies, and an affiliate partner may learn that you came from us.
Videos in Playbooks and in answers play inside the app, through the player of Loom or Bunny (bunny.net), whichever hosts the video. Those companies, and the services their players use, see your IP address and your browser and device details, just as they do when a video opens in a new tab, and each player may use its own cookies or similar storage. Their own privacy policies cover what their players collect.
Live Trainings are held on Zoom or Google Meet. When you press Join, the call opens on their site or app in a new tab, and we don't send them anything about you. What you share on the call, such as your name, your camera and microphone, and the call's chat, is handled by Zoom or Google under their own terms and privacy policies.
Add to calendar, on a Live Training, either opens Google Calendar in a new tab with the call's details filled in, which Google then handles under its own terms and privacy policy, or saves a calendar file on your device; we don't send your calendar anything ourselves, and we store nothing about it.
Software your business connects on the Diamond plan, such as Google Calendar, Gmail or Slack, is run by its own provider under its own terms and privacy policy, and so is the sign-in, consent or key page an owner is sent to when connecting it (Composio's own page, or the provider's). What HSA AI reads from it, keeps and does in it is described in sections 4.5 to 4.9; what that software's provider does with your information is up to that provider.
Information your own business collects about its customers and cleaners outside HSA AI is your business's responsibility.

2.Information we collect

We collect information in three ways: you give it to us, it is collected automatically when you use the Services, or someone else gives it to us.

2.1 Information you give us

Information you provide
Information	What it includes
Account details (web app)	When you sign up and create your account, including when you accept an invitation: your full name, your email address (if you were invited, the one the invitation was sent to) and your business name. We no longer keep a monthly revenue range: the ranges owners had set in Settings were deleted on October 17, 2026. Your password goes straight from your browser to our authentication provider, Supabase Auth, which stores it in hashed form. Your password never reaches HSA AI's servers. Your name is shown to the other members of your business account, and your business name is visible to all of them.
Business profile (web app)	When an account owner sets up their business in the web app, or changes it later in Settings: whether the business is new or already running; for a business that is running, how long it has been running, who does the cleaning and whether its cleaners are contractors or employees, what most of its work is, what it books jobs in, what's hardest right now (up to three things) and anything else the owner adds in their own words (up to 300 characters); and, for a new business, its city and state, its budget for starting out, whether it has a business name yet and its monthly profit goal, and which steps of its Launch Plan are ticked off, by an owner or by HSA AI when an owner says in a chat that a step is done. We also keep when the profile was first finished, when it last changed and which owner changed it. Only owners of the business can see or change it; other members can't. It is kept apart from Memory (below). See section 4.1 for what goes to Anthropic.
Memory (web app, Pro and Diamond plans)	What a business's owners have had HSA AI remember about the business (see section 4.11): up to 60 short lines, each at most 200 characters (a software name at most 60). Each is either a fact about the business (where it works, roughly what it makes a month, its services, prices, customers by kind, team, goals, the software it uses, by name, or anything else) or something to follow up on, with a day to check back on if one was given and whether it is done. A line is saved by HSA AI from an owner's own words in a chat only they have written in, never from a private chat, from text that looks pasted or forwarded, from what HSA AI reads in connected software, from automations or from Slack; or an owner types it in Settings. For each line we also keep whether it first came from a chat or from an owner, the chat answer that last saved or changed it, the wording before HSA AI last changed it (kept only so an owner can undo the change, and shown to them), when it was saved and last changed, and which owner saved it and which last changed it. Memory refuses people's names wherever it can tell, and street addresses, phone numbers, email addresses, links, passwords, logins and codes, and card, bank and ID numbers. Only owners can see it.
Invitations	When an account owner or HSA AI invites someone: the invitee's email address, their role (owner or member), the business they're invited to, who created the invitation and when it was created, expires, was accepted or was revoked. The invitation link's secret is stored only in hashed form. We don't send invitation emails; the person who creates the invitation shares the link.
Questions and chats (web app)	The questions you ask (up to 5,000 characters each), the answers we give, the chat title (automatically the first 50 characters of the first question, which any member can rename), who asked each question and when, and whether a chat is pinned or archived. Anything you type into a question is stored, including any details about your customers, cleaners or other people. On the Diamond plan, we also store which chats are private and whose they are (see section 4.7).
Spoken questions (web app)	If you press the microphone button and speak, your browser records what you say and sends that recording to us. We pass it straight to Cloudflare to turn into text and keep no copy of it: it is never written to a file, a log or our error monitoring. The words appear in the question box, and you can change or delete them; what we store is the question you send, exactly as if you had typed it. A recording stops after 60 seconds. See section 4.4.
Software you connect (web app, Diamond)	When an owner connects software on the Apps page: which software it is, which owner connected it, its status, Composio's ID for the connection, and when it was connected and last read. The access that software grants is held by our provider Composio, not by us (see section 4.5). If you connect software that asks for an API key or a username and password, you type them on Composio's own page, and they never pass through our servers. What we read from the software, and what we keep, is in sections 4.5 and 4.6.
Automations (web app, Diamond)	When an owner sets up an automation: its name, its instructions (up to 5,000 characters), its schedule, the time zone it runs in and, if the owner picked one, the team channel its reports go to. For each run: when it ran, who or what started it, how it ended and the chat it made. For each action a run wanted to do in a connected app: which app and action, where it would go and exactly what it would send, whether it waits for approval, was approved, denied or done, and who decided. And what the owner has allowed an automation to do again without asking. See section 4.9.
Posting to Slack (web app, Diamond)	If the owner who connected Slack switches posting on: whether it is on, and the channels they picked (each channel's ID and name). For each post HSA AI makes: which channel, when, its length, a fingerprint of its text (a code worked out from the text that doesn't contain it), how it went, Slack's own ID for the post and which question and answer it came from, but never the text itself. See section 4.8.
Channels (web app, Diamond)	When someone in your business creates a channel: its name, its topic (up to 250 characters), whether it is private, who created it and when, and whether and when it was archived. For a private channel: who is in it, who added each person and when. For each message: its text (up to 4,000 characters), who wrote it and when, the channel and thread it is in, who it mentions, and when it was last edited or deleted. Each emoji reaction, and who added it. For each person and channel, how far they have read it, so the app can count what is new for them. For each report an automation posts in a channel: the automation's name, and which automation, run and private chat it came from. See section 4.10.
Slack messages	Messages you send to the HSA AI bot: when you mention it, use `/ask`, message it directly or use the assistant panel. To answer in a thread, the bot also reads the other messages in that thread. See section 6 for exactly what the bot reads, stores and sends.
Feedback	In the web app, when you mark an answer "Not helpful" (thumbs-down), we store a copy of that answer with your account, the business and the time. In a private chat (see section 4.7), we store the rating but never a copy of the answer. In Slack, when you add a thumbs-up or thumbs-down emoji to one of the bot's answers, we store the rating, the channel, your Slack user ID and the time; for a thumbs-down we also store the text of the rated answer and, where available, the question before it.
Emails and support	When you email us or send a message through the contact form on our website, including to ask to sign up or to cancel: your name, your email address, the topic you choose on the form, and anything you include in the message or attachments.
Checkout pages	If you buy Starter on our Starter checkout page at buystarter.hsacleanai.com, or Pro on our Pro checkout page at buypro.hsacleanai.com, you type your email address there (twice, to catch typos). It goes to our web app's server, and to Whop, which fills it in on its payment form. We keep it with a record of your purchase so we can link your payment to the login you create, email you the link to finish setting up (and up to two reminders), and answer cancellation and refund questions. That record also holds the plan and its price, the version of our Terms and this policy you agreed to and when, the Whop checkout and membership IDs, your Whop user ID, the payment's status and dates, and a scrambled (hashed) copy of a secret code your browser keeps for finishing setup; we never keep the code itself. When you create your login, we delete the email address from the purchase record, since your login holds it. If the browser you paid in moves the purchase to another email address, we first send one note to the address you paid with. We don't ask for your name or phone number on that page.
Billing information	When you pay online, you pay on the checkout page of our payment provider, Whop (on Whop's own site, or in Whop's payment form shown inside our checkout pages), which collects your card or other payment details and processes the payment. Whop may ask you to create or sign in to a Whop account to pay and to manage your payment. We don't receive or store card numbers. From Whop we receive and keep limited details of your subscription: its Whop membership ID and your Whop user ID, the plan, its status, when the current billing period ends, whether it is set to cancel, when it started or was cancelled, and, if an upgrade replaced it, when. If an owner buys a credit pack, we keep a record of the purchase: the business, which member bought it, the pack and its credits and price, the Whop checkout and payment IDs, the payment's status, amount, tax and currency, whether a promo code was used, and any refund or dispute of that payment. When we add credits to a business ourselves, for example credits paid for by invoice, we keep a record of how many, when, whether they were paid for and a short note of why. If we invoice you or arrange payment with you directly, we may hold a billing contact name and email address. Either way, we keep records of what was billed and paid.
Consultation bookings	If you book a consultation call through our Calendly link, Calendly collects the details its booking page asks for (such as your name, email address and phone number) and shares them with us so we can hold the call.

2.2 Information collected automatically

Information collected when you use the Services
Where	What it includes
Web app: browser storage	Your browser keeps your sign-in session (access and refresh tokens, plus your email address and profile details) and a few preferences in its own storage: questions you've typed or spoken but not sent, messages you've typed in a channel but not sent, the channel you last opened, whether the sidebar is collapsed, and whether you've dismissed the tip about adding the app to your home screen (and how many times it was shown), and, for an owner on the Pro or Diamond plan, whether they've seen the short explanation that comes with the first "Saved to memory" note. While you sign in or sign up, the tab also holds your progress, including the invitation link and the details you've entered (never your password). See section 8.
Web app: request logs	Our hosting provider, Railway, records request logs that include your IP address, the time and the address requested. Our app's own logs record the request method, route, status, timing and internal IDs (such as account, user, chat and message IDs), plus which of our knowledge-base guides were looked up and technical error details. On the Diamond plan, they also record which connected apps and which of their actions were used, how many and how they went, and for a post to Slack the channel and the post's length, but never what was read, asked for or sent. For channels, they record IDs, counts and how each request went, never what was written in a channel or its name. For Memory, they record the kind and topic of a line and what happened to it, never what it says. Our app logs don't record query strings, email addresses, tokens or the text of questions. When error monitoring is on, technical details of errors, and timing for web app requests, are also sent to our error monitoring provider, Sentry, as described in section 5.4.
Web app: sign-in data	Your browser connects directly to Supabase to sign in and load your data, so Supabase receives your IP address and browser details. Supabase Auth records sign-in events, which can include your IP address and browser (user agent).
Web app: bot check	When you sign in with a password or ask for a code by email (to sign in, sign up, reset your password or change it in Settings), your browser first runs Cloudflare Turnstile, a check that tells people from automated scripts. Our app loads it only at that moment. Cloudflare receives your IP address, browser and device details (such as your browser's user agent and technical characteristics of its connection), the address of the page and signals about how your browser and the page behave during the check. It doesn't read what you type into our forms. If the check passes, your browser gets a one-time token, which our authentication provider, Supabase, confirms with Cloudflare before it accepts the sign-in or sends the code. Our checkout pages run the same check for every visitor before a purchase starts, and our server confirms the token with Cloudflare. Those pages also load Whop's checkout script, which runs Whop's payment form. See section 5.4.
Web app: rate limiting	When you preview an invitation, sign up or send a message through our website's contact form, we use your IP address in memory only, to limit repeated attempts. We don't write it to our database. There was one exception, while we offered free business accounts: when one was created, we stored a one-way keyed code standing for the IP address, together with the business account it created, so that we could limit how many free accounts were created and spot automated abuse. We no longer create free business accounts, so we no longer collect these codes, and those already stored are deleted about 30 days after each was made. We don't store the IP address itself, and the key needed to link a code back to an address is held outside the database. See section 9 for how long we keep these.
Web app: usage information	For each counted question: the business account, the member who asked, the chat, the surface (web) and the time, without the question text. Monthly question totals for each business, and how many spoken questions (recordings we turned into text) each business has had in the month. When each person starts a new chat (for the hourly limit on new chats). On the Diamond plan, when each person posts, edits, deletes or reacts to a message in a channel, without the message or the channel (for the hourly limits on those). For each answer: the AI model and settings used, the number of tokens processed and how long it took. On a plan that uses credits, for each answer: the credits it used, and a credit record of the AI model, the numbers of tokens (units of text) of each kind it used, and whether the answer finished or failed, without the question or answer text. For each business on such a plan, or holding bought credits: its monthly credit totals and its bought and owed credit balances. On the Diamond plan, whether each question's credits were used by a chat or by an automation.
Web app: your time zone	Each question you send from the web app carries the time zone your device is set to (for example "America/Los_Angeles"). We use it on the Diamond plan, and with an owner's own questions on the Pro plan when their business's Memory goes with them, so that "today" and "tomorrow" mean your own days: it goes to Anthropic with that one answer (see section 4.1) and isn't stored. When an owner saves an automation, the app saves their device's time zone with it, so its schedule runs in their own time (see section 4.9).
Web app: Playbooks	When you open a resource on the Playbooks page, or open one of those resources from a link in an answer, we record which Playbooks resources you've opened and when you first opened each one. We use this only to put a green check mark on the ones you've opened, and to stop marking them as new, on any device you sign in on. It's tied to your login, not your business, and isn't shown to anyone else in your business. Videos play inside the app through Loom's or Bunny's player, which loads only when you play one (see section 1.4).
Web app: audit and consent records	An append-only record of certain privileged or significant actions, created as they happen: creating a business account (including the business name and the owner's user ID), adding members and changing their roles, removing a member from a business (including who removed them and why), suspending a business because its last owner was removed, changing a business's plan or usage limits, a business upgrading from Starter to Pro (the two plans, the Whop membership IDs, the checkout and how many questions it had used), an owner canceling a Starter or Pro subscription in the web app or taking the 50% offer to stay on Pro (who, the Whop membership ID and how it went), an owner choosing to switch from Pro to Starter or taking that choice back (who, the Whop membership ID, the two plans and the date Pro ends), adding or removing a business's credits by hand, a credit pack being paid for, refunded or disputed (IDs and numbers only), changes to how credits are priced, deleting a chat (who deleted it, which chat and how many messages it had), an owner saving the business profile (who, and whether the business is new or already running, never the answers), an owner saving, changing, undoing or deleting something in Memory, or clearing it, and HSA AI saving something to it from an owner's chat (who, which kind and topic, whether it came from a chat or from Settings, which answer it came from and, for clearing, how many lines, never what any line said), and the deletion of a business's last owner's login (including that login's former user ID). On the Diamond plan, also: an owner starting to connect software (which app, and who), a connection being completed, failing or found to have expired (the outcome and when), an owner disconnecting software (which app, and who), something about the business being saved or removed (which item and where it came from, never what it said), a chat becoming private (which chat, and whose), an owner switching Slack posting on or off or changing its channels (whether it is on, and how many channels), each post to Slack (which channel, its length, Slack's ID for it and how it went, never its text), an owner creating an automation (who, and the kind of schedule, never its name or instructions), an automation pausing itself after five runs in a row didn't finish, someone creating a channel (who, which channel and whether it is private, never its name or topic), and a channel being deleted (who deleted it and which channel, never its name), including when the last person in a private channel leaves it or is removed from it. When you accept an invitation to join a business account after ticking the box on our sign-up form or in the join dialog, a record that you agreed to our Terms and acknowledged this policy: your user ID (the identifier of your login), the version, which of the two boxes you ticked and the date and time. We keep one record for each login and version, so joining another business later doesn't add another. Ticking the box before buying a credit pack is recorded the same way, except that there is one record for each purchase, which also names the purchase and the pack it was for. Each time you sign up for, upgrade to or restart the Starter or Pro plan in the web app and tick the two boxes on our sign-up form or in the dialog the web app shows before you pay, a record that you agreed to our Terms, acknowledged this policy and agreed to the plan's automatic renewal: your user ID, the version, the Starter or Pro plan and its price, where you ticked the boxes, whether it was a new subscription, a restart or an upgrade, the date and time, the checkout it was for and, for an upgrade, the subscription it replaces. There is one record for each checkout, so each checkout you agree to has its own. If you buy Starter or Pro on our checkout page for it, the boxes you tick there are saved with your purchase before you pay, and copied into this record when your payment reaches us: the version, the plan and its price, which checkout page it was, that you agreed to the automatic renewal, the money-back guarantee shown, the date and time you ticked the boxes, and the purchase it was for. It has no user ID, because you have no login yet. When you create your login and use the purchase, a second record names your user ID, the version you agreed to then and the purchase. A purchase started and never paid for is deleted, with its ticks, after 30 days. Consent records don't include your email address, IP address or browser details. We keep them for at least 3 years (see section 9).
Slack app	Your Slack user ID, the channel or direct-message ID, message timestamps, thumbs-up and thumbs-down reactions on the bot's answers, and monthly question counts for each channel. To check that a channel is authorized, the bot reads the channel's name and the ID of the person who created it. Slack's events also include IDs such as your workspace ID; we don't store those in our usage records. See section 6.
Website: your cookie choice	Our website code sets no cookies of its own. It remembers the choice you make in its cookie banner in your browser's local storage, under `hsa.consent`: which categories you allowed, when you chose, the version of our cookie settings, whether your browser sent a Global Privacy Control signal and which button you used. It stays in your browser; we don't receive it. See section 8.
Website: analytics and advertising (only if you allow them)	If you allow Analytics, Google Analytics (loaded directly or through Google Tag Manager) collects, through cookies and similar technologies, a cookie ID for your browser, the pages you visit and how you got to them, how you interact with pages (such as scrolling and clicking links), your browser and device details, and your approximate location worked out from your IP address. If you allow Advertising, Google Ads and the Meta Pixel collect cookie IDs, the pages you visit, details of any Google or Facebook ad you clicked to reach us, your IP address and browser details. When you click a sign-up link on our website, the tools you allowed are also told that a sign-up link was clicked, with no personal details about you: Google Tag Manager as an event named `sign_up_start`, Google Analytics as `generate_lead`, Google Ads as a conversion, and the Meta Pixel as `Lead`. See section 7 and section 8.
Website: hosting logs	The company that hosts the website may keep request logs. Our website serves its typeface itself, so loading a page doesn't contact a font service. See section 7. Our checkout pages are hosted by Netlify, which may keep standard request logs (your IP address, browser details and the page asked for). They use your device's own fonts, so loading them doesn't contact a font service either.

2.3 Information from others

Account owners, teammates and HSA AI. If someone invites you, they give us your email address, your role and the business you're joining. Teammates may mention you in shared chats and, on the Diamond plan, in channels.
Slack. Slack sends us message content, user IDs, channel IDs and reactions, as permitted by the Slack app's permissions and your workspace's settings. In a thread, this includes other people's messages.
Software your business connects (Diamond). Through our provider Composio, the software an owner connects gives us what HSA AI reads from it: calendar events, emails, records and other data, as described in sections 4.5 to 4.9. Much of it is written by other people, such as your customers, and can include their names, email addresses, phone numbers and what they wrote.
Our service providers. For example, our authentication provider tells us when you have verified your email address, Calendly sends us the details of a booked call, and, when you pay online, Whop tells us the limited subscription and credit pack payment details described in section 2.1.

2.4 Sensitive information

Please don't put sensitive information into the Services. That includes Social Security or other government ID numbers, bank account or card numbers, passwords, health information, or sensitive details about your customers, cleaners, employees or job applicants. Our Terms of Service ask you not to. We don't ask for this kind of information and don't intentionally collect it. If it is included in a question or message, it is handled like the rest of that content. On the Diamond plan, software you connect may hold sensitive information that other people wrote, for example in an email. If HSA AI reads it to answer a question or run an automation, it is handled like everything else it reads there: sent to Anthropic for that one answer and not stored by us, except as far as the answer, or something an automation sends, repeats it (see sections 4.6 and 4.9), including a report an automation posts in a channel (see section 4.10). If you need something removed, contact us.

3.How we use information

We use personal information to:

Provide and operate the Services, including showing your chats and your team's channels, marking the Playbooks resources you've opened, keeping track of your business account and its members, and delivering the web app and the Slack app.
Generate answers. We process your question and recent conversation with our AI provider to write each answer. See section 4.
Tailor an owner's answers to their business. When an owner asks a question in the web app, we use the business profile they set up so the answer fits their business (see section 4.1), and we use the Launch Plan steps that are ticked off to show them where they are and what comes next. When an owner tells HSA AI in a chat that a Launch Plan step is done, HSA AI can tick it off for them and say so under its answer; they can untick it on the Launch Plan page at any time. We don't use the profile for anyone else's questions.
Remember an owner's business, on the Pro and Diamond plans. We keep the business's Memory, what its owners tell HSA AI about it and the follow-ups they mention, and use it in the answers to owners' own questions, including asking about a follow-up that is due in the first answer of a new chat (see section 4.11). We don't use it for anyone else's questions.
Process sign-ups, and create and secure accounts, check that an invitation is valid and matches your email address, and send one-time sign-in and password codes.
Run shared business workspaces, so every member of a business can see the business's chats and members, apart from private chats (see section 4.7), and, on the Diamond plan, write to each other in channels (see section 4.10).
Tailor answers to your business, on the Diamond plan. The numbers worked out from your connected software, and anything else saved about your business (all listed on the Apps page), can be looked up by the AI model when it answers a question from someone in your business. Disconnecting an app removes everything worked out from it. See section 4.5.
Connect and read the software you choose, and act in it only as an owner chooses, on the Diamond plan: reading a connected calendar to work out those numbers; reading an owner's connected email and other apps when they ask, or when one of their automations runs; posting to Slack channels an owner switched on; and running an owner's automations, doing the actions they approved and posting their reports in the team channel the owner picked. See sections 4.5 to 4.10.
Apply usage limits, and handle billing, payments and invoicing, including counting questions or credits toward a plan's allowance, charging for your plan for each billing period (every 30 days for Starter and Pro), and for any credit pack you buy, through our payment provider, Whop, when you pay online, and keeping billing records.
Provide support and communicate with you, including answering your emails, including requests to sign up, and sending service messages about your account, security or changes to the Services.
Keep the Services safe, including rate limiting, preventing abuse and fraud, investigating problems, keeping logs and audit records, and protecting HSA AI, our users and others.
Improve our answers, guides and prompts. Authorized HSA AI staff may read conversations (other than private chats and channels) and feedback, especially answers marked as unhelpful, to fix gaps in our knowledge base, improve how the assistant is instructed and fix problems. We don't copy one business's content, names or details into our guides or instructions. This is human review. We never use your content to train AI models.
Understand how the Services are used, using aggregated or de-identified information such as question counts.
Measure our website and our ads, only with your consent. If you allow it in our website's cookie banner, we use Google Analytics to see how people find and use the website, and Google Ads and the Meta Pixel to measure whether our Google and Facebook ads lead to visits and clicks on our sign-up links. See section 7 and section 8.
Manage our client relationships, including reviewing how much each business, Slack channel and member uses the Services, to invoice, prepare for renewals and offer help.
Comply with the law and enforce our terms, including responding to lawful requests, keeping records the law requires, keeping a record of your agreement to our Terms and to a paid plan's automatic renewal and of your acknowledgment of this policy, and establishing or defending legal claims.
Do other things with your consent or at your direction.

What HSA AI reads from software an owner connects is used more narrowly than this list. We use it only to answer questions for your business, to run an owner's automations (including posting their reports in the channel the owner picked) and carry out the posts and actions an owner chose, as sections 4.5 to 4.10 describe, and to keep the Services safe and secure or meet a legal obligation. We don't use it to improve our answers, guides, prompts or coaching content, even in aggregated or de-identified form, or for anything else. An answer in a shared chat is part of that chat like any other answer, even when it uses a number worked out from connected software, so what section 5.3 says about staff access applies to it. A report in a channel is not: we don't use anything written in channels to improve the Services (see section 4.10).

We don't use information from the web app, the Slack app or the software you connect for advertising, we don't sell it, and we don't build advertising profiles. On our website, if you allow advertising cookies, Google and Meta may use what they collect to build their own profiles and show you ads, under their own policies (see section 5.5). We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

3.1 Legal bases (for people in the EEA, UK and Switzerland)

Where data protection laws such as the GDPR require a legal basis, we rely on the following.

Purposes and legal bases
Purpose	Legal basis
Creating and running your account, signing you in, answering your questions, running shared business workspaces, marking the Playbooks resources you've opened, providing the Slack app, support	Performance of a contract with you. Where your business holds the contract and you use the Services as its team member, our legitimate interest in providing the Services your business signed up for.
Using an owner's business profile in the answers to their own questions, and showing their Launch Plan	Performance of a contract with you, as part of answering your questions. The owner chooses what to tell us, and can change it at any time in Settings.
Keeping Memory and using it in an owner's own answers	Performance of a contract with you, as part of the plan your business pays for. Owners choose what is kept, and can change or delete it at any time.
Turning a question you speak into text, when you press the microphone button	Performance of a contract with you, as part of answering your questions. You choose whether to speak or type, and no recording is made unless you press the button.
On the Diamond plan: connecting the software an owner chooses, reading it to work out numbers about the business and to answer the owner who connected it, private chats, posting to Slack channels an owner switched on, running an owner's automations and the actions they approved, channels, and posting an automation's reports in the channel its owner picked	Performance of a contract with your business, which chose these features. For information about other people that the connected software holds, such as your customers' emails, our legitimate interest, and your business's, in providing the features your business asked for, limited to what each answer, post or action needs.
Processing sign-ups, responding to requests to sign up and to messages you send us, and setting up access	Taking steps at your request before entering into a contract, and performance of a contract. Our legitimate interest in responding to people who contact us.
Usage limits (questions or credits), billing, payments and invoicing, including credit packs	Performance of a contract. Legal obligation, for tax and accounting records.
Security, rate limiting, bot checks, abuse prevention, logs, error monitoring and audit records	Legitimate interests in keeping the Services, our users and our systems secure and working.
Human review of conversations and feedback to improve answers, guides and prompts	Legitimate interests in making our answers accurate and useful. We don't use content to train AI models.
Aggregated and de-identified usage analysis	Legitimate interests in understanding and improving the Services.
Reviewing usage by business account, channel and member to manage client relationships and renewals	Legitimate interests in running and renewing our client relationships.
Keeping a record of your agreement to our Terms and to a paid plan's automatic renewal, and of your acknowledgment of this policy	Legitimate interests in being able to show what you agreed to, and legal obligation where a law requires us to keep evidence.
Loading our website, hosting logs, and remembering your cookie choice in your browser	Legitimate interests in delivering and securing the website and respecting your choice. Remembering your cookie choice is strictly necessary for the service you asked for, so it doesn't need consent.
Website analytics with Google Analytics (and Google Tag Manager)	Your consent (GDPR Article 6(1)(a)). Storing and reading cookies on your device for this also needs your consent under Article 5(3) of the EU ePrivacy Directive and the national laws based on it, including the UK's PECR. You can withdraw consent at any time in Cookie settings (see section 8).
Measuring our ads with Google Ads and the Meta Pixel on our website	Your consent (GDPR Article 6(1)(a), and Article 5(3) of the ePrivacy Directive and the national laws based on it). You can withdraw consent at any time in Cookie settings.
Complying with the law, responding to lawful requests, enforcing our terms, legal claims	Legal obligation, and legitimate interests in protecting our rights and those of others.
Marketing emails, if we ever send them	Your consent where the law requires it; otherwise legitimate interests, always with an easy way to opt out.
Anything else we ask your permission for	Consent, which you can withdraw at any time.

Where we rely on legitimate interests, we have weighed those interests with your rights. Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawing doesn't affect what happened before you withdrew.

Your right to object. You can object at any time to our use of your personal information based on legitimate interests, including human review of conversations to improve our answers, by emailing info@hsacleanai.com (see section 11). We'll stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the information to establish, exercise or defend legal claims. If we ever send direct marketing, you can object to it at any time and we'll stop.

4.How AI answers work and what the AI provider receives

HSA AI is an AI assistant, not a person. Its answers are written by AI models from Anthropic, PBC ("Anthropic"), which we access through Anthropic's Claude API under Anthropic's commercial terms. The model we use may change over time.

4.1 What we send to Anthropic

To write an answer, we send Anthropic:

Your question.
Recent turns of the same chat or thread, up to about the last 20 messages (questions and answers), so the answer fits the conversation. In the web app, chats are shared within a business, so this can include questions your teammates asked in the same chat. In Slack, it can include messages from other people in the same thread. In a Slack direct message, it includes your recent messages with the bot, back to the last long pause.
Our instructions and excerpts from our knowledge base, which the model looks up to answer.
For a business owner, a short summary of their business profile (see section 2.1), with each question they ask in the web app: how long the business has been running, who does the cleaning, its main work, what it books jobs in, what's hardest right now and anything the owner added in their own words, or, for a new business, its city and state, its budget for starting out, whether it has a business name yet, its monthly profit goal, and how many of its Launch Plan steps are done and which comes next. It is never sent with a teammate's questions, with automations or with questions in Slack, and it doesn't include the business name, which goes with Memory on Pro and Diamond.
For a business owner on the Pro or Diamond plan, the business's name and its Memory (see section 4.11), with each question they ask in a chat only they have written in: the facts, the open follow-ups and when they were noted, and today's date and time where they are, with the name of their time zone. It is never sent with a teammate's questions, with automations or with questions in Slack.
On the Diamond plan, what your business has saved, when an answer would be better for knowing about your business and the model looks it up: the numbers worked out from connected software, and anything else saved about your business, all of which is listed on the Apps page (see section 4.5). It is never sent for another business's questions.
On the Diamond plan, what HSA AI reads from software you connect, such as emails and calendar events, when the owner who connected it asks about it, or when one of their automations runs (see section 4.6), and an automation's name and instructions, which are sent as its question, with the name of the channel its reports go to, if the owner picked one (see section 4.9).
On the Diamond plan, and with Memory on the Pro plan, today's date and time where you are, and the name of your time zone, worked out from the time zone your device is set to, or an automation's saved time zone (see section 2.2).

From the web app, we don't send your name, email address or account ID, or the messages your team writes in channels (section 4.10), and we send your business name only with Memory. From Slack, we don't send Slack user IDs, channel IDs, profiles or files, and we remove @-mentions from message text. But whatever is written in a question or message, including any names, addresses or phone numbers, is sent, and so is what HSA AI reads from connected software, which can include names and email addresses, yours included. Producing one answer can involve more than one request to Anthropic, for example when the model looks something up or when we retry an unfinished reply.

4.2 What Anthropic does with it

No training. Anthropic's commercial terms don't allow it to train its models on the content we send. We don't use your content to train AI models either.
Retention. Anthropic's published policy says it deletes API inputs and outputs within 30 days by default. It says it may keep content flagged for violating its usage policy for up to 2 years, and may keep data longer where the law requires. Read Anthropic's retention policy for the current details.
Location. Anthropic may process requests in data centres in the United States or other countries, which may be outside your country.
Deletion. Deleting a chat in HSA AI doesn't change what Anthropic already received. Its own retention schedule applies.

4.3 No automated decisions about you

HSA AI gives general business guidance that you decide whether to use. We don't use AI, or any other automated processing, to make decisions about you that have legal or similarly significant effects. Answers can be wrong, incomplete or out of date, so check anything important before relying on it. Our Terms of Service say more about this.

4.4 Speaking a question

The web app's question box has a microphone button. If you press it and speak, your browser records what you say and sends that recording to us, and we send it straight on to Cloudflare, Inc. ("Cloudflare"), whose Workers AI service turns it into text with Whisper, an open speech-recognition model that Cloudflare runs on its own servers (nothing goes to OpenAI, which made the model). The words come back into your question box: no question is asked, no answer is written and nothing goes to Anthropic until you send them, and you can change or delete them first. Your microphone is used only while you are recording, and your browser shows you while it is on. A recording stops on its own after 60 seconds.

We keep nothing. The recording passes through our server on its way to Cloudflare and is never written to a file, a log or our error monitoring. What we store is the question you choose to send.
No training. Cloudflare says it doesn't use what we send to train any of the AI models it makes available on Workers AI, or to improve its own or anyone else's services, without our explicit consent, which we haven't given.
Retention. Cloudflare says Workers AI content may be stored if it's used with one of Cloudflare's storage services, and we don't use any of them with it. Read Cloudflare's page on Workers AI data for the current details.
Location. Cloudflare runs a global network, so a recording may be processed in the United States or other countries, which may be outside your country.
Your address and your allowance. The recording goes to Cloudflare from our server, not from your browser, so Cloudflare doesn't receive your IP address with it. Speaking doesn't use up any of your business's question allowance or credits; only sending a question does. Each recording we turn into text counts toward your business's monthly limit on spoken questions (see section 9.2 of our Terms). Our logs record that a recording was turned into words, and how many bytes it was, never what was said.
You don't have to use it. Type your question instead and no recording is made at all.

4.5 Software you connect (Diamond)

If your business is on the Diamond plan, an owner can connect software the business uses, such as Google Calendar, Gmail or Slack, on the Apps page. You choose what to connect, and you approve the access on that software's own sign-in or consent screen, or by entering a key or login on Composio's page. Only owners can connect software or see the list of what is connected, though everyone in the business sees the numbers worked out from it, marked as coming from connected software (see "Who sees it" below).

Composio holds the access. Our service provider Composio, Inc. ("Composio") keeps the access each connection grants, such as the tokens Google issues or the key you entered, and carries our server's requests to the software and its replies back to us (see section 5.4). We never store those tokens, keys or passwords ourselves. Composio knows each business only by our internal ID for it, not by its name.
The access you grant can be wider than what we use. For example, the permission Google shows when you connect a calendar can include changing events. HSA AI uses the access only as sections 4.5 to 4.9 describe.
What we read on a schedule. Today, only Google Calendar is read this way: the events on your primary calendar from four weeks ago to eight weeks ahead. Our server receives each event as the calendar provides it, including details such as its title, but it uses only when each event starts and ends, whether it was cancelled or marked free, and what kind of event it is. It doesn't read your other calendars this way.
How often. Our server checks every hour and reads each connected calendar about once a day, and once straight after it is connected, while your business is on a plan that includes connected software.
What we keep from it. Only numbers worked out from those times: roughly how many jobs and hours are booked each week, how long a booking usually is, the busiest day of the week and how far ahead the calendar is booked. We don't store event titles, descriptions, locations, attendees or any other text from the calendar. A number that a later read no longer produces is removed then.
Who sees it. What HSA AI has saved about your business, including these numbers, is listed on the Apps page for everyone in the business, and the AI model can look it up to answer their questions (see section 4.1). An owner can remove anything there except a number from connected software, which goes when the app it came from is disconnected.
If your plan stops including it. When your business is no longer on a plan that includes connected software, for example because it moved from Diamond to another plan or its Diamond access ended, we stop reading its software and stop using what was saved in answers. What was saved stays, listed on the Apps page, until an owner removes it or disconnects the app, or the business account is closed (see section 9). So does the connection itself, with the access Composio holds, until an owner disconnects it.
Disconnecting. Any owner can disconnect an app on the Apps page at any time, on any plan. That deletes everything worked out from it at once, along with anything tied to that connection: for Slack, the posting settings and the record of each post, and what automations were allowed to do in that app. We also instruct Composio to delete that connection and the access it holds. It doesn't remove the permission from your own account at the software's provider (for Google, the list of apps with access to your Google Account); you can remove it there at any time.
What we never do. Reading your software never changes, adds or deletes anything in it. Only two things can add or change something, and only when an owner chooses: a post to Slack channels they switched on (section 4.8), and an action of an automation they set up and approved (section 4.9). Neither is ever given a way to delete anything or move money. We don't use what we read for advertising or to improve the Services (see section 3), and we don't sell it.

4.6 Reading your email and other apps when you ask (Diamond)

When the owner who connected an app, such as Gmail, a calendar, a CRM, a phone system or an ad account, asks HSA AI about something in it, HSA AI reads what it needs to answer, at that moment, through Composio, and sends it to Anthropic as part of that one answer. An automation reads the same way when it runs (section 4.9).

Only the owner who connected it. Only the owner who connected an app can have HSA AI read it, and only in a chat they started that nobody else has written in. Other owners, and everyone else in the business, can't.
The chat becomes private first. Before HSA AI shows anything from your apps, even the list of which apps are connected, the chat becomes private to you (section 4.7).
In a chat, it only reads. It can't send, create, change or delete anything in your apps, except a post to Slack channels you switched on, when you ask for one (section 4.8). An automation can do more, but only as section 4.9 describes.
We don't store what it reads. Not in our database, our logs or our error reports. What is kept is the answer, in your private chat, and, for an automation whose reports you have posted in a team channel, a copy of each report there (section 4.10). Our logs record which apps and actions were used, how many and whether they worked, never what was read.
Links. In these chats, an answer keeps a link only if you wrote it yourself, it is one of HSA AI's own, or it was in an earlier answer in the chat. Links from your emails and other apps are never passed on, so nothing someone sends you can choose a link that HSA AI shows you.
Other people's information. Emails and app data are often written by, or are about, other people, such as your customers and contacts. What HSA AI reads reaches Anthropic as part of the answer, under the terms in section 4.2.

4.7 Private chats (Diamond)

On the Diamond plan, some chats are private: visible to one owner only. Not to other owners, not to anyone else in the business, and not to HSA AI staff through the app.

Which chats. A chat becomes private to the owner who started it the moment HSA AI first reads their email or other connected apps in it. Every chat an automation makes is private to the owner who set it up from the start. A private chat never becomes shared again.
What stays private. Its questions and answers, its title, when questions were asked, and feedback on it, with one exception: the report of an automation whose owner has it posted in a team channel (below). If you mark one of its answers "Not helpful", we keep the rating but never a copy of the answer.
An automation's reports. When an owner has an automation post its reports in a team channel, each run's chat is still private to that owner, but the run's answer, its report, is copied from that chat into the channel exactly as written, where everyone who can see the channel can read it (section 4.10). Nothing else in the chat is copied, and only that owner can open the chat a report came from.
Who else can reach it. HSA AI staff can't open a private chat through the app. People with direct access to our database and hosting, outside the app, can still reach it, and may do so only when needed to keep the Services safe, investigate a problem or meet a legal obligation.
Deleting. Only the owner it belongs to can delete a private chat. Deleting that owner's login deletes their private chats. If that login leaves the business without being deleted, its private chats there stay, visible to nobody, until the business account is closed or we delete them on request. Deleting a private chat, or the login it belongs to, doesn't delete a report already copied from it into a channel (section 4.10).

4.8 Posting to your Slack (Diamond)

If the owner who connected Slack switches posting on (the Posting setting on the Slack card on the Apps page), HSA AI can post a message to Slack channels they choose, when they ask it to in a chat.

It posts for that owner, through their Slack connection and Composio, and every post ends with "— sent with HSA AI".
It posts only to channels the owner ticked, never to a channel shared with another company, a direct message or an archived channel, and at most 20 posts go out through a Slack connection in any 24 hours, an automation's posts included.
It never posts from a chat where it has read the owner's email or other apps, or where anyone else has written, so nobody else's words can make it post in the owner's name.
We keep a record of each post: which channel, when, its length, a fingerprint of the text and how it went, but never the text itself (see section 2.1). The answer in the chat says what was posted and where.
What is posted becomes part of the owner's Slack workspace, under Slack's own terms and that workspace's settings, and is visible to the people in that channel. We can't delete it from Slack.

An automation can post to the same channels too, once the owner has approved posting there (section 4.9).

4.9 Automations (Diamond)

An owner of a Diamond business can set up an automation: instructions for HSA AI and a schedule (for example, "every weekday at 7:00, list today's jobs and any customer emails I haven't answered"), or no schedule, to run it only when they press Run now.

Runs happen with nobody watching. At each scheduled time, HSA AI does the job the way it answers a question in a chat: it reads what it needs from the apps that owner connected, at that moment, through Composio, and sends the automation's name and instructions and what it read to Anthropic as part of that one answer, with the date and time in the automation's time zone and, for an automation that reports to a channel, that channel's name. We don't store what it reads; the result is kept as a new chat, private to that owner (section 4.7), and, if the owner picked a team channel for the automation's reports, it is also posted in that channel (below). Each run uses the business's credits like a question.
Only the owner who set it up. Only that owner can see an automation, its runs and what it wants to do; other owners and people in the business can't, except that everyone who can see the channel an automation reports to sees its name and its reports there (section 4.10). Other owners see only how many of the month's credits all automations used, in total (section 5.1). It reads and acts only in apps that owner connected.
Actions, only after approval. An automation can also do some things in the owner's connected apps: send an email or save a draft, add a calendar event, post a message to a Slack channel and similar. The first time it wants to do a particular thing to a particular place (a recipient, a channel, a calendar), it doesn't do it: it saves it, with exactly what it would send, for the owner to approve or deny in the app. If the owner approves and chooses to let it do that again, later runs may do the same kind of thing to the same place by themselves, with new words (or, for an event, a new time) each time. Anything going to a different place, or with any other detail changed, asks again, and so does everything after the owner reconnects that app. The owner can take that permission back at any time.
What it never does. An automation is never given an action that deletes anything, moves or spends money, changes who has access, or sets up a standing rule such as mail forwarding. And it never tries again an action that may already have been done: if an app doesn't say clearly whether something was done, the owner is told to check, so nothing is done twice.
Links and addresses. In the words an automation writes, a link survives only if it was in the owner's own instructions or is one of HSA AI's own, and an email address that wasn't in the instructions stops the action. The one exception is an email that goes only to email addresses written in the automation's instructions, such as the owner's own: its words may list the email addresses and phone numbers it found (for example, a morning list of new leads sent to the owner's inbox). Everything else an action would send, where it goes and its other details, including any link in them, is shown to the owner in full for approval first, and is sent only if the owner approved exactly that.
In Slack, it posts only to channels the owner ticked for posting (section 4.8), each post ends with "— sent with HSA AI", and its posts count toward the same limit of 20 a day as the owner's own.
Reports in a team channel. The owner chooses where an automation's results go: a new private chat for each run, or one of the business's channels on the Channels page (section 4.10). With a channel, each run that finishes, including one the owner starts with Run now, has its report posted there under the automation's name, exactly as it is in the run's private chat, including whatever it repeats from the owner's email, calendar and other apps, such as customers' names, email addresses and phone numbers. As in that chat, a link stays only if it was in the automation's instructions or is one of HSA AI's own (section 4.6); email addresses and phone numbers aren't taken out. If a report can't be posted, for example because the channel was deleted or archived, it stays in the private chat only and the automation is marked as needing attention. A run that doesn't finish posts nothing.
What we keep. The automation's name, instructions, schedule, time zone and, if the owner picked one, the channel its reports go to, until the owner deletes it. A record of each run (when it ran, what started it, how it ended and which chat it made) for 180 days after it finished. Each action it wanted, with exactly what it would send and where, while it waits for approval (at most 7 days) and for 30 days after it is done, so the owner can check it; if the owner denies it, or it is never decided, what it would have sent and where are dropped at once. After that, until 400 days after it ended, only which app and action it was, how it ended, when, and who approved or denied it. For a post to Slack, that includes its words for those 30 days, as well as the record of the post in section 4.8. What the owner allows an automation to do again (the action, and the exact details it may repeat, such as where it goes) stays until they remove it, delete the automation or disconnect that app.
Deleting and leaving. Deleting an automation deletes its run records, its actions and what it was allowed to do, all at once. The same happens if its owner's login leaves the business, stops being an owner or is deleted, or the business account is closed. The chats its runs made are kept like any other private chat, until the owner deletes them or their login is deleted. Reports it already posted in a channel stay there, under the automation's name, until someone deletes them or the channel, or the business account is closed (section 4.10).
If your plan stops including it. Automations stop running, and nothing waiting can be approved. What they hold is kept as described above until it is deleted: the owner can delete an automation on the Automations page, or ask us to.
Audit records. We keep an audit entry when an owner creates an automation (who, and the kind of schedule, never its name or instructions), and when one pauses itself after five runs in a row didn't finish.

4.10 Channels (Diamond)

On the Diamond plan, the Channels page is where your team writes to each other, in channels that each have a name and a topic, with threads, emoji reactions and @mentions. These channels are HSA AI's own, not Slack's. The AI doesn't take part in them: what your team writes in a channel isn't sent to Anthropic, and HSA AI doesn't read it to answer questions or run automations. A channel can also hold an automation's reports (below).

Who can see a channel. Anyone in the business can create a channel, public or private. Everyone in the business can see a public channel and everything in it. A private channel can be seen by the people in it and by every owner of the business, including owners who aren't in it: owners see every channel in their business, and can open a private one and add themselves to it. So private hides a channel from the other members of your team, not from the owners. Whoever can see a channel can read all of it, including messages written before they joined the business or were added to the channel, and can see who is in it.
Who can add and remove people. Anyone in a private channel can add other people from the business to it, and so can any owner. Anyone can leave a private channel. Only an owner, or the person who created the channel while they are still in it, can remove someone else.
What we store. What section 2.1 lists: each channel's name, topic and settings, who created it and who is in each private channel; each message, with who wrote it and when, its thread and who it mentions; emoji reactions and who added them; and how far each person has read each channel, which is used only to count what is new for that person and isn't shown to anyone else. Editing a message replaces its text: we keep when it was last edited, not what it said before.
An automation's reports. An owner can have an automation post its reports in a channel instead of only in a private chat (section 4.9). Each run's chat stays private to that owner, but its report, the run's answer, is copied from that chat into the channel exactly as written, under the automation's name. That includes whatever it repeats from the owner's email, calendar and other apps, such as customers' names, email addresses and phone numbers, and everyone who can see the channel can read it, including people added to the channel or the business later. Only the owner who set up the automation can open the private chat a report came from. Nobody can edit a report, and an owner can delete one.
Changing and deleting. Anyone can edit or delete their own messages in a channel they're in. If someone who isn't an owner leaves a private channel or is removed from it, the messages they wrote and the reactions they added stay in it, and they can't edit or delete them any more unless someone adds them again; an owner can still delete those messages. An owner can delete any message, a report included, and can archive, unarchive or delete any channel. The person who created a channel, and any owner, can rename it and change its topic. Deleting a message removes its text, reactions and mentions at once, for everyone. A short record that a message was there (who or which automation wrote it and when, never what it said) is deleted about 30 days later, or, while replies to it remain, stays as a "This message was deleted." placeholder until they are gone too. Deleting a channel deletes it and everything in it at once. A private channel is deleted, with everything in it, when the last person in it leaves or is removed, and within about a day once nobody in it is still in the business. An archived channel is kept until an owner unarchives or deletes it, and nobody can post, edit or react in it meanwhile.
When someone leaves. If someone leaves the business or is removed from it, the messages they wrote stay in its channels, shown as from a former teammate, until someone deletes them; their reactions, their places in private channels and how far they had read are deleted. If their login is deleted, their messages stay too, with the link to their login removed. Messages that mention them aren't changed. An automation's reports stay when the automation is deleted, and when its owner leaves the business, stops being an owner or has their login deleted; they still show the automation's name, and the private chat a report came from is deleted only with its owner's login (section 4.7).
If your plan stops including channels. Nobody can create a channel, post, edit, react or add people any more, but everyone can still read what is there, delete their own messages and leave private channels, and owners can still archive and delete channels. What is there is kept as this section describes until it is deleted or the business account is closed.
Who else can reach it. HSA AI staff can't open a channel through the app, unless one of them is on your business account, where they are listed among its people and see what any member sees. People with direct access to our database and hosting, outside the app, can still reach channels, and may do so only when needed to keep the Services safe, investigate a problem or meet a legal obligation. We don't use anything written in channels, reports included, to improve our answers, guides, prompts or coaching content.
Limits. To stop abuse, we count how many messages each person posts in an hour, and how many they edit, delete or react to. Those records say only who, when, and whether it was a post or another change, never what or where, and are deleted within about 2 hours.
Audit records. We keep an audit entry when someone creates a channel (who, which channel and whether it is private, never its name or topic) and when a channel is deleted (who deleted it and which channel, never its name), including when the last person in a private channel leaves it or is removed from it.

4.11 Memory (Pro and Diamond)

On the Pro and Diamond plans, HSA AI keeps a Memory for each business: short lines about the business that its owners have told it, such as where it works, roughly what it makes each month, its services, prices, customers (by kind, never by name), team, goals and the software it uses, and things an owner plans to do or wants to check back on ("follow-ups"). It uses them in the answers to owners' own questions, so they don't have to repeat themselves. Owners can see everything in it, and add, correct and delete it, in Settings, under Memory.

How HSA AI saves to it. When an owner tells HSA AI something lasting about their business in a chat, it can save it as a short line, which has to come from the owner's own words: HSA AI must quote what the owner wrote in that chat, and every number in the line must be in that quote. It saves only from an owner's own questions, in a chat no one else has written in. It never saves from a private chat (section 4.7), from a chat holding text that looks pasted or forwarded, from email or anything else it reads in connected software (sections 4.5 and 4.6), from a teammate's questions, from automations or from Slack. Under the answer, a "Saved to memory" note shows what was saved, with Undo. Owners can also add lines themselves in Settings, which doesn't use a question.
What it doesn't keep. HSA AI is told never to save people's names, such as a customer's, a cleaner's or the owner's own, and our software refuses street addresses, phone numbers, email addresses, links, passwords, logins and other codes or keys, card, bank, tax and ID numbers, and the names of the people on your business account, wherever it can detect them, whether HSA AI or an owner is saving. A city, an area or a ZIP code is fine. Software is kept by its name alone, never with a login.
Follow-ups. A follow-up can have a day to check back on. In the first answer of a new chat, HSA AI may ask about one that is due. When an owner says one is finished, HSA AI can mark it done, and owners can mark it done or not done in Settings. Done follow-ups aren't sent to Anthropic, and are kept until an owner clears or deletes them.
What goes to Anthropic. With each question an owner asks in a chat only they have written in: the business's name, the facts, the open follow-ups and when each was noted, and today's date and time where the owner is (section 4.1). Never with a teammate's questions, with automations or with questions in Slack. A line's earlier wording, kept so an owner can undo HSA AI's change, is never sent.
Who can see it. Only owners can see or change Memory, and nothing in it goes with anyone else's questions. Chats are shared, though, so teammates can read the answers to an owner's questions, which can draw on it; HSA AI is told to bring up revenue and other money figures from it only when the question is about them. Answers that use Memory are ordinary chats: your team, and authorized HSA AI staff, can read them, though staff can't open Memory itself in the app. People with direct access to our database, outside the app, can still reach it, and may do so only when needed to keep the Services safe, investigate a problem, meet a legal obligation or answer a request you make (section 11).
If your plan stops including Memory. If your plan stops including Memory, we stop using it; it stays until an owner removes it or the account is closed. Nothing from it goes with questions and nothing new is saved, but owners can still see and delete it, mark follow-ups done and undo HSA AI's changes in Settings. It is used again if the business moves back to a plan that includes it.
Deleting. An owner can delete any line, clear done follow-ups or delete all of Memory in Settings at any time, and what is deleted can't be brought back. Deleting a chat doesn't delete what was saved from it (section 9.1), and closing the business account deletes its Memory (section 11.4).
Audit records. We keep an audit entry when a line is saved or changed, from a chat or in Settings, and when an owner undoes a change, deletes a line or clears Memory: who, which kind and topic, where it came from, which answer and, for clearing, how many lines, never what any line said.

We don't sell personal information for money. We never share information from the web app, the Slack app or the software you connect for advertising. On our website, only if you allow it in the cookie banner, Google and Meta receive information about your visit through their cookies and tags, and they may use it for their own purposes, including advertising, under their own policies. Some US state laws treat that as "sharing" for cross-context behavioral advertising, "targeted advertising" or a "sale" (see section 5.5 and section 14). Our service providers handle personal information to provide their services to us. A few also use limited information under their own privacy policies: Squarespace, which hosts our current placeholder website; Slack, for messages and other data in Slack; Anthropic, which may keep content its safety systems flag (see section 4.2); and our payment provider, Whop, which uses payment data for purposes such as running your Whop account, fraud prevention and meeting its legal obligations. Our AI provider isn't allowed to train its models on your content.

5.1 Within your business account

Chats in the web app are shared with the whole business on purpose, so the team works from the same answers. The exception is private chats on the Diamond plan, which only one owner can see (see section 4.7).

Every member of a business account can see every chat in it except private chats, including who started it and the questions and answers in it, and can rename, pin or archive any chat they can see. Members can see the member list (names and roles), the plan, the account's usage, and records of which member asked questions and when. On a plan that uses credits, every member sees how many credits the business has left and when its monthly credits refill, and owners also see how many credits each question used.
Owners can also see billing details, renewal dates and the business's invitations, including invited email addresses until they are removed (see section 9). Only owners can see and change the business profile (see section 2.1). Only owners can see and change Memory (see section 4.11). Because chats are shared, teammates can read the answers to an owner's questions, which can draw on it. On a plan that uses credits, only owners are shown how many of the month's credits have been used, the business's bought credits and any credits it owes, and owners still see bought credits the business keeps while it is on a plan without credits. Owners are also shown how much of the month's credits went on chats and how much on automations, as totals for the whole business, including other owners' automations. Because every member sees the credits left, a member who knows the plan's monthly credits can often work out how many have been used. Owners can delete any chat in the business except one that is private to someone else. Other members can delete only chats they started.
On the Diamond plan, every member can see what HSA AI has saved about the business on the Apps page. Only owners can see which software is connected. Only the owner who connected Slack can see its posting settings, and only the owner who set up an automation can see it, its runs and what it wants to do, though its reports, in the channel it posts them to, are seen by everyone who can see that channel.
Channels, on the Diamond plan (section 4.10). Everyone in the business can read every public channel. A private channel can be read by the people in it and by every owner, including owners who aren't in it. Everyone can delete their own messages in the channels they can see, and owners can delete any message and archive or delete any channel.

Don't put anything in a chat that you wouldn't want the rest of your business account to see. A chat becomes private only in the cases in section 4.7, not because you ask for it. The same goes for channels: a private channel is hidden from other team members, never from the owners.

5.2 In Slack

The bot posts answers in the channel or thread where it was asked, so everyone in that channel can see the question and the answer. With /ask, the bot posts your name and question in the channel. Usage warnings and limit messages in a channel are visible too.
Slack workspace owners and admins, and Slack itself, can access Slack messages under Slack's terms, Slack's privacy policy and the workspace's settings.
In a Slack Connect channel, members of the other organization in the channel can see what is posted, and each organization's own Slack settings apply to its members' messages.
On the Diamond plan, a message HSA AI posts to your own Slack workspace for an owner is visible to everyone in that channel, and is held by Slack under Slack's terms and your workspace's settings (see section 4.8).

5.3 HSA AI staff

Authorized HSA AI staff can access account content, including the chats of every business, and the Slack channels we provide. They do so to provide support, keep the Services safe, investigate problems, handle billing, meet legal obligations and improve answers, guides and prompts. Only people we authorize as HSA AI staff, and the people who run our database and hosting, can access this content, and they may use it only for these purposes. The exceptions are private chats and channels on the Diamond plan: staff can't open a private chat through the app, or a channel unless they are on your business account, and the people who run our database and hosting may reach them only as sections 4.7 and 4.10 describe.

On plans where you save details about your business, answers quote those details back to you — your prices, your team, your service area, how your month is going. Those answers are part of your chats, so the access described above covers them too. Answers that use Memory are ordinary chats: your team, and authorized HSA AI staff, can read them, though staff can't open Memory itself in the app. If you would rather we did not hold a particular detail, remove it in Settings, under Memory (Pro and Diamond), or on the Apps page (Diamond), and we stop using it. A number worked out from connected software goes when you disconnect the app it came from (see section 4.5).

5.4 Service providers

We use these companies to run the Services. They handle personal information on our behalf under their agreements with us, except for the limited uses under their own policies described above and in this table.

Our service providers
Provider	What they do for us	Information they handle
Anthropic	AI model provider that writes answers, for the web app and the Slack app. Processing may happen in the US or other countries.	Questions, recent chat or thread turns, knowledge-base excerpts and, with an owner's own questions in the web app, a summary of their business profile and, on the Pro and Diamond plans, the business's name and Memory, with the date and time in their time zone (see section 4.11). On the Diamond plan, also what the model looks up about your business, what HSA AI reads from software you connect, automations' names and instructions (and the name of the channel an automation reports to), and the date and time in your time zone (see section 4).
Composio (Composio, Inc.)	On the Diamond plan: connects the software an owner chooses to connect on the Apps page, keeps the access that software grants, and carries our requests to read from it, and, where an owner has chosen it, to post a Slack message or do an action an owner approved (see sections 4.5 to 4.9). Processing may happen in the United States or other countries.	The connected account's access tokens, or, for software that connects with a key or a login, the API key, or the username and password, that the owner enters on Composio's own page (it never passes through our servers); which business each connection belongs to (our internal ID for the business, not its name); what our server reads through it, such as calendar events and emails, which pass through Composio on their way to us; and what it sends through it, such as a Slack post or an email an automation sends. Composio may keep records of these requests under its own settings and retention.
Supabase	Database and authentication for the web app. Data is stored on Amazon Web Services in Northern California, United States (us-west-1).	Account details, business profiles, Memory, hashed passwords, invitations, chats, feedback, usage, credit and audit records, subscription and credit pack payment details we receive from Whop (see section 2.1), sign-in events including IP address and browser details. On the Diamond plan, also which software is connected, what is saved about the business, Slack posting settings and post records, automations with their runs, actions and permissions, and channels with their messages, reactions and read markers.
Cloudflare (Cloudflare, Inc.)	Bot protection for signing in to the web app and for buying on our checkout pages: Cloudflare Turnstile checks that a person, not an automated script, is signing in, asking for a code by email, or starting a purchase, so scripts can't guess passwords or use up the sign-in emails our customers need. Cloudflare Workers AI also turns a spoken question into text, when you press the web app's microphone button. Cloudflare runs a global network, so both may be processed in the United States or other countries.	Your IP address, browser and device details, the page address and signals from the check (see section 2.2), when the bot check runs. Cloudflare handles this on our behalf to run the check, and also uses it for its own purpose of detecting bots and improving Turnstile. Cloudflare says it doesn't use this information to identify, profile or target individuals, or for advertising. See Cloudflare's Turnstile Privacy Addendum and Cloudflare's privacy policy. For Workers AI: the recording you make with the microphone button, and the text it becomes (see section 4.4). It goes from our server, so Cloudflare doesn't receive your IP address, name, email address, business or account with it, and Cloudflare says it doesn't use it to train any of the AI models it makes available on Workers AI, or to improve its own or anyone else's services (see Cloudflare's page on Workers AI data).
Railway	Hosting for the web app and the Slack bot, including the Slack bot's usage database and our logs. Railway operates mainly in the United States.	All web traffic, including IP addresses in request logs; application logs; the Slack bot's usage and feedback records; messages sent through our website's contact form, which pass through our web app's server on their way to our inbox and aren't stored there; on the Diamond plan, what HSA AI reads from connected software, which passes through our web app's server (on its way to Anthropic, when it is read for an answer or an automation) and isn't stored there.
Resend	Email delivery: our authentication provider sends sign-in and password codes through Resend, from a no-reply address; our web app's server sends messages from our website's contact form to our own inbox through Resend; our web app's server sends the welcome email to the owner who starts a Starter or Pro subscription through Resend; our web app's server sends a buyer on our checkout pages the email with the link to finish setting up, up to two reminders, a note if the purchase is moved to another email address, and, if we stop an unused purchase from renewing, that notice; and when someone deletes their login with Delete my login, our web app's server emails that login's address through Resend to confirm it. Stores data in the United States. Open and click tracking is off.	Your email address and the content of sign-in emails (the code and sign-in link); for contact form messages, your name, email address, the topic you chose and your message; for the welcome email, the owner's email address and first name, the business name, the plan's price and question allowance, the date of the next payment or that the plan is set to end, and the Whop membership ID, which Resend uses to make sure the email is sent only once. For those emails: the email address given on the checkout page, the plan, its price, the dates of the payment, the next payment and the end of the money-back guarantee, and the purchase's ID, which Resend uses to make sure each email is sent only once. For the email confirming a deleted login: the login's email address, the name of the business it closed or left, whether that business's subscription was canceled and its connected software disconnected, and the login's ID, which Resend uses to make sure the email is sent only once.
Google Workspace	Email for info@hsacleanai.com.	Emails you send us, including requests to sign up and support messages, and messages sent through our website's contact form.
Slack	The platform the Slack app runs on.	Messages, reactions and IDs in Slack, including the bot's answers and our internal alert messages.
Squarespace	Domain name and DNS for hsacleanai.com, and the placeholder website currently shown there.	Visitor data collected by the Squarespace-hosted page, such as IP address and browser details. Squarespace uses some of it for its own purposes, such as security, under its own privacy policy.
Calendly	Scheduling for consultation calls.	The details you enter when you book, such as name, email address and phone number.
Whop (Whop, Inc.)	Payment processing. When you pay online, you pay on Whop's checkout page, and Whop processes your payments, the recurring charges for your plan (every 30 days for Starter and Pro) and the one-time charge for any credit pack you buy. In your Whop account you can update your card, see receipts and cancel.	Your card or other payment details, your name, email address and billing address, and details of your plan and payments. Whop also uses this information for its own purposes, such as running your Whop account, fraud prevention and meeting its legal obligations, under Whop's privacy policy.
Sentry (Functional Software, Inc.)	Error and performance monitoring, when we turn it on: error reports from the web app and the Slack bot, and timing of web app requests, so we can find and fix problems.	Technical error details: the type of error, stack traces (without the values the code was working with), the request method and route, browser type (user agent), request timing, internal IDs (such as account, user, chat and message IDs, and Slack channel IDs and names) and our app's own log lines about the problem. Before anything is sent, our code removes request bodies, cookies, query strings, IP addresses, the signed-in user's email and other account details, error message text, email addresses, tokens, keys and Slack user IDs, so the text of questions, answers and Slack messages isn't sent. See Sentry's privacy policy.

We may add or change providers. We'll update this list when we do.

5.5 Analytics and advertising partners on our website (only with your consent)

Our website can use the tools below, but only for visitors who allow the matching category in its cookie banner. Until you choose, and if you reject them, none of these tools is loaded, so your browser doesn't contact Google or Meta for them. Your browser sends the information straight to Google or Meta. Section 8 lists their cookies.

Analytics and advertising partners
Partner	What it does for us	Information it receives, and its own use
Google Analytics (Google LLC)	Shows us how people find and use our website. Category: Analytics.	A cookie ID for your browser, pages visited and how you got to them, how you interact with pages, browser and device details, and approximate location worked out from your IP address. Google says Google Analytics 4 doesn't log or store IP addresses. Google may use this information as described in How Google uses information from sites or apps that use our services.
Google Tag Manager (Google LLC)	If we use it, loads the Google tags you allowed. It sets no cookies of its own. Category: Analytics or Advertising, depending on the tags.	Your IP address and browser details when it loads. Google says Tag Manager doesn't collect or keep information about visitors, apart from standard request logs that it deletes within 14 days.
Google Ads (Google LLC)	Measures whether our Google ads lead to visits and clicks on our sign-up links. Category: Advertising.	Cookie IDs, details of a Google ad you clicked to reach us, pages visited, your IP address and browser details, and whether you clicked a sign-up link. Google may use this information for its own purposes, including advertising, and may link it to your Google account if you're signed in, as described in How Google uses information from sites or apps that use our services and Google's privacy policy.
Meta Pixel (Meta Platforms, Inc., including for people in the UK; Meta Platforms Ireland Limited for people in the EEA)	Measures whether our Facebook and Instagram ads lead to visits and clicks on our sign-up links. Category: Advertising.	Cookie IDs, details of a Facebook or Instagram ad you clicked to reach us, the page address, your IP address and browser details, a page view event and, when you click a sign-up link, an event saying a sign-up link was clicked. Meta may link this to your Facebook or Instagram account and use it to deliver, measure and improve ads, under Meta's Privacy Policy.

We set these tools up so they never receive your name, email address, business name or anything in your business's Memory. You sign up in the web app, which doesn't load any of these tools, and the sign-up click event carries no details about you. We don't use Meta's advanced matching, which would send contact details, and we turn off the Pixel's automatic collection of button text and page details.

Meta as joint controller. Where the GDPR applies, HSA AI and Meta Platforms Ireland Limited are joint controllers for collecting information through the Meta Pixel on our website and sending it to Meta, in line with the Court of Justice of the European Union's decision about a Facebook plugin on a website in Fashion ID (C-40/17). We have agreed with Meta, under Meta's controller addendum, who handles which obligations: we ask for your consent and tell you about it here, and Meta Ireland handles requests to access, correct, delete or port the information Meta stores. Meta Ireland is solely responsible for what it does with the information after it receives it, as explained in Meta's Privacy Policy. Where the UK GDPR applies, the joint controller with us for the same collection and sending is Meta Platforms, Inc., under Meta's UK Controller Addendum, with the same split: we ask for your consent and tell you about it here, and Meta handles requests about the information it stores. You can contact us or Meta about your rights.

5.6 Legal, safety and business transfers

Legal and safety. We may disclose information if we believe in good faith it's needed to comply with the law, a court order or a lawful request from authorities; to enforce our Terms; or to protect the rights, property or safety of HSA AI, our users or others.
Business transfers. If HSA AI is involved in a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of that deal. It will stay subject to this policy's promises or to a notice we give you.
With your consent or at your direction. For example, when you ask us to share something with someone else.

6.The HSA AI Slack app

This section describes how the HSA AI Slack app collects, uses, stores and shares information. We give Slack access by inviting you into a channel we provide, either as a guest in our Slack workspace or through Slack Connect. The app's greeting in the Slack assistant panel and its app description in Slack link to this policy and our Terms. Posting to your own Slack workspace from the web app, on the Diamond plan, is a different feature, described in section 4.8, and the channels on the web app's Channels page are HSA AI's own, not Slack's (section 4.10).

6.1 What the bot can access

The Slack app asks Slack for these permissions:

Messages that mention it, so it can answer when you @-mention HSA AI.
Message history in public and private channels it has been added to. The bot uses this only to read the thread it was asked in and the message someone reacted to. It doesn't watch or store ordinary channel conversation.
Basic channel information (such as the channel name and who created it), to check that the channel is one we've authorized.
Direct messages with the bot, to read and reply to them. We turn on direct messages and the assistant panel only for people and situations we choose; otherwise the bot declines to answer there.
Posting messages, to post answers.
Slash commands: /ask and /usage (which privately shows the channel's usage for the month).
Reactions. Slack tells the bot about reactions in conversations it belongs to. The bot ignores everything except a thumbs-up or thumbs-down on its own answers.
The Slack assistant panel, to greet you, show a "thinking" status, suggest prompts and name the thread after the first 50 characters of your first question (that title is stored in Slack).

The bot doesn't have permission to read Slack profiles, email addresses or files, and it ignores file shares and message edits in direct messages.

6.2 How the bot uses Slack data

When you ask a question, the bot checks that you and the channel are allowed, counts the question toward the channel's monthly allowance, reads the recent conversation from Slack, and sends it to Anthropic to write the answer (see section 4). It reads thread history live from Slack each time; it doesn't keep its own copy. Questions from people or places that aren't authorized are refused and never sent to Anthropic.

When you use the assistant panel, Slack tells the app which channel you are viewing. The Slack framework we use records that in Slack, on the app's own reply. We don't store or use it.

6.3 What we store

The Slack bot keeps a small database on our hosting provider, Railway. It holds:

Usage counts: the channel or direct-message ID, the month and the number of questions.
A question log: for each counted question, the time, the channel ID and the asker's Slack user ID. It doesn't contain the question or the answer.
Feedback: for a thumbs-up, the time, channel ID, the reacting person's Slack user ID and the rating. For a thumbs-down, the same plus the text of the rated answer and, where available, the question before it.

Apart from thumbs-down feedback, we don't store the text of Slack messages. Our logs record Slack user IDs, channel IDs and names, and technical error details, but not message text. When error monitoring is on, error reports go to Sentry with Slack user IDs removed and no message text (see section 5.4).

6.4 Staff alerts

A thumbs-down sends an alert to an internal channel or direct message in HSA AI's own Slack workspace. It includes the reacting person's Slack name, a link to the channel, the question (up to 600 characters) and the answer (up to 900 characters). A thumbs-up alert says only who reacted and in which channel. Staff use these alerts to fix our guides and instructions. HSA AI staff are also usually members of the channels we provide, so they can read messages there to support and coach you.

6.5 What we never do with Slack data

We never use Slack data to train large language models or other AI models, and our AI provider may not train on it.
We never sell or rent Slack data, or use it for advertising.
We never share one client's Slack messages with another client. When feedback shows a gap or mistake in our guides or instructions, we may improve the guides and instructions that every client's answers draw on, without copying one client's messages, names or business details into them.
We share Slack data only with Slack and the service providers that help us run the Slack app (Anthropic to write answers, Railway to host the bot and, when error monitoring is on, Sentry, which receives technical error details but no message text), with HSA AI staff as described above, and as described in section 5.6 (legal and safety reasons, business transfers, or with your consent).

6.6 Retention and deletion

Feedback records, including thumbs-down question and answer text, are kept for about 30 days, then deleted automatically.
The question log is kept for about 180 days, then deleted automatically. Monthly usage counts are kept for as long as needed for billing, usage limits and security, and as the law requires. They aren't deleted automatically today, so they stay until we delete them, for example when you ask us to.
Staff alert copies stay in our Slack workspace under its retention settings until we delete them. We delete a client's alert messages when we delete that client's Slack data, as described below.
You can ask us to delete the Slack data we hold about you (by Slack user ID) or about a channel. Email info@hsacleanai.com. We'll also delete related alert messages in our workspace where we can, unless we need to keep something for billing, security or legal reasons.
If we discontinue the Slack app, or a client's access to it ends (for example, we remove the client from the channel we provide or the Slack Connect connection ends), we delete the Slack data we hold for that client's channels within 14 business days, without the client needing to ask. That includes usage counts, the question log, thumbs-down text and staff alert messages. We keep only what the law requires, such as billing records. Our hosting provider's logs, which include Slack IDs and channel names but no message text, expire on their own schedule (see section 9), and content already sent to Anthropic follows Anthropic's retention.

Messages you post in Slack, including the bot's answers, also stay in Slack under Slack's terms and your workspace's retention settings (or your own organization's, for Slack Connect). We can't delete your messages from Slack. Slack's own privacy policy applies to data in Slack.

7.Our website, sign-up links and contact form

7.1 The cookie banner

Our website uses analytics and advertising cookies only if you say yes. The first time you visit, wherever you are, a banner asks you to choose. It has a Reject all button and an Accept all button of the same size and style, and a Customize button that lets you pick categories one by one:

Necessary: runs the site and remembers your cookie choice. Always on.
Analytics: Google Analytics, loaded directly or through Google Tag Manager. Off until you switch it on.
Advertising: Google Ads conversion measurement, the Meta Pixel, and Google Tag Manager tags that need advertising consent. Off until you switch it on.

Until you choose, and whenever you reject a category, the tools in it aren't loaded. Scrolling or clicking elsewhere on the page isn't a yes, and you can use the site without accepting anything. If JavaScript is turned off, no optional tools load at all. You can change your choice anytime (see section 8).

The banner and these tools are part of our own website code. While hsacleanai.com is still served by Squarespace as a placeholder page, that page doesn't use them, and Squarespace may set its own essential cookies and collect visitor information under Squarespace's privacy policy.

7.2 Fonts

Our website serves its typeface from its own server, and our checkout pages use your device's own fonts. Loading a page doesn't contact any outside font service. The web app doesn't load fonts from other companies either.

7.3 What Google and Meta receive if you allow them

Google Analytics (if you allow Analytics) receives a cookie ID for your browser, the address and title of the pages you visit, the page you came from, how you interact with pages (such as scrolling and clicking links), your browser and device details, and your IP address, which Google uses to work out your approximate location. Google says Google Analytics 4 doesn't log or store IP addresses.
Google Ads and the Meta Pixel (if you allow Advertising) receive cookie IDs, the address of the pages you visit, details of a Google, Facebook or Instagram ad you clicked to reach us, your IP address and browser details, and a page view. If you're signed in to Google, or logged in to Facebook or Instagram, Google or Meta may connect this to your account under their own policies.
When you click a sign-up link, each tool you allowed is also told that a sign-up link was clicked, with no details about you: Google Tag Manager as an event named sign_up_start, Google Analytics as generate_lead, Google Ads as a conversion, and the Meta Pixel as Lead.

Your account details are never sent to Google or Meta: not your name, email address, business name or anything in your business's Memory. You sign up in the web app, which doesn't load these tools, and our checkout pages don't load them either. We don't use Meta's advanced matching, and we don't use Google Analytics User-ID or send email addresses to Google Ads. Section 5.5 explains how Google and Meta may use the information, and section 8 lists their cookies.

7.4 Sign-up links

Our website describes our plans and links to the sign-up page in the web app at app.hsacleanai.com. Our checkout pages at buystarter.hsacleanai.com (Starter) and buypro.hsacleanai.com (Pro) are the only pages outside the web app where you give us details: your email address, before you pay in Whop's payment form, which is shown inside the page and whose contents we never see (see section 2.1, Checkout pages). What you enter when you create your login in the web app is described in section 2.1. If you email us to sign up, your email arrives in our email system (Google Workspace), and we use it to respond to you, to set up your access and to keep a record of our conversation. Signing up, buying or emailing us doesn't add you to a marketing list unless you agree.

7.5 Contact form

Our website has a contact form. When you send a message, your browser sends your name, email address, the topic you chose and your message to our web app's server at app.hsacleanai.com. The server emails it to our inbox (info@hsacleanai.com, on Google Workspace) through Resend, with your email address as the reply address. The server doesn't keep a copy: the email in our inbox is our record of it (see section 9). To stop automated spam, the server uses your IP address in memory only, to limit how many messages can be sent. We use your message to reply to you and to handle what you ask, such as signing you up or canceling a plan. Sending a message doesn't add you to a marketing list, and the analytics and advertising tools on our website, even if you allow them, are never sent what you type into the form.

7.6 Hosting logs

The company that hosts our website may keep standard request logs, such as IP addresses, the pages requested, the time and browser details, to deliver and secure the site.

7.7 If this changes

If we add other analytics, cookies or advertising tools, use these tools for new purposes, or send them events other than those described in this section, we'll update this policy before we do. When we change the tools or their purposes, the banner asks you again. If you had turned Advertising off in the 12 months before (by rejecting it, switching it off, or through Global Privacy Control), it stays off, even if you choose Accept all on that banner, until you switch it on yourself in Cookie settings.

8.Cookies and similar technologies; Do Not Track and Global Privacy Control

8.1 The web app

The web app sets no cookies. It uses your browser's local storage and session storage only for things it needs to work:

Local storage (kept on your device until you sign out or clear it): your sign-in session, including access and refresh tokens and your email address and profile details; questions you've typed or spoken but not sent; messages you've typed in a channel but not sent, and the channel you last opened; whether the sidebar is collapsed; and whether you've dismissed the tip about adding the app to your home screen. Those last two aren't personal, so they stay after you sign out. For an owner on the Pro or Diamond plan, it also keeps, until they sign out, whether they've seen the short explanation that comes with the first "Saved to memory" note.
Session storage (kept only in that browser tab, and cleared when it closes): your sign-in or sign-up progress, the email address waiting for a code, the invitation link, the sign-up details you've entered, the version of our Terms you agreed to and, after you buy on one of our checkout pages, the code that links your purchase to your login (for at most 24 hours). Never your password.

Signing out ends your session on this device and clears the app's saved items there, including drafts. Sign out everywhere in Settings ends your sessions on every phone and computer, including this one; a device that's already open can take up to an hour to notice. If your session simply expires, drafts stay on the device, so sign out on shared devices. If you add the app to your home screen on an iPhone or iPad, it keeps its own copy of these items, separate from your browser.

When the bot check runs (see section 2.2), Cloudflare's check runs in a frame served from Cloudflare's own domain, challenges.cloudflare.com. Any cookies or similar storage Cloudflare uses there are its own, which Cloudflare describes as strictly necessary, and are governed by its policies. The web app itself still sets no cookies.

When you play a video, Loom's or Bunny's player runs in a frame served from that company's own domain. Any cookies or similar storage it uses there are its own and are governed by that company's policies (see section 1.4).

Cookies that Google or Meta set on our website are usually set for hsacleanai.com as a whole, so your browser may also send them when you visit app.hsacleanai.com. The web app doesn't set or use them.

8.2 Cookies and storage on our website

Our website's own code sets no cookies. The table lists what the website stores in your browser and the main cookies it lets Google and Meta use. Only the first two rows are used without your consent. Google and Meta can change their cookies; the durations below are the ones they publish.

Cookies and similar technologies on hsacleanai.com
Name	Provider	Category	Purpose	Duration
`hsa.consent` (local storage, not a cookie)	HSA AI	Necessary	Remembers your cookie choices, so we load only what you allowed and don't ask again on every page.	Your choice is used for 12 months, then we ask again. It stays in your browser until you choose again or clear your browser's storage.
`hsa.presale` and `hsa.presale.pro` (session storage, not a cookie)	HSA AI	Necessary	On our checkout pages (`hsa.presale` on the Starter page, `hsa.presale.pro` on the Pro page), keeps your purchase's ID and its setup code, so a reload or a return from Whop finds your purchase and doesn't charge you twice.	Until the tab closes, and never more than 24 hours.
`_ga`	Google Analytics	Analytics	Distinguishes visitors.	Up to 2 years, renewed when you visit again (browsers may shorten this).
`_ga_<container-id>`	Google Analytics	Analytics	Keeps session state.	Up to 2 years, renewed when you visit again (browsers may shorten this).
None (Google Tag Manager)	Google	Analytics or Advertising	Loads the Google tags you allowed. It sets no cookies of its own.	Not applicable.
`_gcl_au`	Google Ads	Advertising	Measures whether ads lead to visits and clicks on our sign-up links. Google lists its purposes as analytics, advertising and security.	90 days.
`_gcl_aw`, `_gcl_gs`, `_gcl_ag`, `_gcl_gb`	Google Ads	Advertising	Store details of a Google ad you clicked to reach our website, to measure conversions. Google lists their purposes as analytics, advertising and security.	90 days.
`_gcl_ls` (local storage, not a cookie)	Google Ads	Advertising	Keeps the same ad-click details in your browser's local storage.	Google doesn't publish a duration. We delete it when you reject or switch off Advertising; otherwise it stays until you clear your browser's storage for hsacleanai.com.
`_fbp`	Meta	Advertising	Identifies your browser for Meta's advertising and site analytics services.	90 days.
`_fbc`	Meta	Advertising	Stores the Facebook or Instagram ad click that brought you to our website.	90 days.
Google's cookies on its own domains, such as `IDE` (doubleclick.net) and `NID` (google.com)	Google	Advertising	Google's ad delivery, measurement and security, under Google's own policies. Your browser may send Google any of its cookies it already has.	`IDE`: 13 months in the EEA and UK, 24 months elsewhere. `NID`: 6 months.
Meta's cookies on its own domains, such as `fr` and `datr` (facebook.com)	Meta	Advertising	`fr`: delivers, measures and improves the relevance of ads. `datr`: identifies your browser for security and fraud prevention. Your browser may send Meta any of its cookies it already has, including ones that show you're logged in.	`fr`: 90 days. `datr`: 400 days.

If we link Google Analytics to Google Ads, Google's tags may set other advertising cookies with names starting _gcl_ or _gac_, and only when you allow Advertising. Browsers can shorten how long these cookies last. For example, Chrome keeps no cookie longer than 400 days, and Safari may delete cookies set by these scripts after 7 days if you don't come back.

8.3 Changing your choices

You can change or withdraw your consent at any time with the Cookie settings or Your privacy choices button at the bottom of every page on hsacleanai.com. Both open the same settings, where you can switch Analytics and Advertising on or off, or use Reject all or Accept all.

When you switch a category off, we tell Google's tags that consent is withdrawn, pause the Meta Pixel, and delete the cookies those tools set on our website: names starting _ga (other than _gac_) or _gid or _gat for Analytics (the last two come from older versions of Google Analytics and are cleared in case they're left over), and _gcl_, _gac_, _fbp or _fbc for Advertising. If a tool had already loaded on the page, the page reloads once so it stops running. We can't delete cookies that Google or Meta keep on their own domains, and switching a category off doesn't delete information those tools already sent (see section 9). Switching Advertising off, or rejecting it, also deletes the ad-click details Google keeps in your browser's local storage (_gcl_ls).

Your choice is saved only in the browser you made it in. If you use another browser or device, or clear your browser's storage, the banner asks you again. If your browser blocks storage, we can't remember a choice, so we load nothing optional and ask again on your next visit.

8.4 Third-party tracking

The web app and the Slack app don't use advertising, analytics or social-media tools, and the web app loads no scripts, fonts or images from other companies, apart from Loom's or Bunny's player when you play a video (see section 1.4). On our website, if you allow Advertising, third parties, including Google and Meta, use cookies, web beacons (pixels) and similar technologies to collect or receive information from our website and elsewhere on the internet. They may use it to provide measurement services, target ads and deliver ads, and they may collect information about your online activities over time and across different websites. If you allow Analytics, Google Analytics collects information about your use of our website. Apart from that, from Squarespace while it hosts the placeholder page at hsacleanai.com (see section 7.1), and from Loom's or Bunny's player when you play a video (see section 1.4), we don't allow third parties to collect personal information about your online activity over time or across other websites through the Services.

8.5 Global Privacy Control and Do Not Track

Global Privacy Control. We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of advertising for that browser, including any "sale," "sharing" or "targeted advertising" under US state laws. When our website detects the signal, Advertising stays off: Accept all turns on Analytics only, and if you had allowed Advertising before your browser started sending the signal, we switch it off, delete its cookies as described in section 8.3, and save that opt-out in your browser, so Advertising stays off even if the signal later stops until you switch it on again yourself. The banner and Cookie settings show that the signal was detected and your opt-out is honored. GPC doesn't change your Analytics choice. If you switch Advertising on yourself in Cookie settings while your browser sends the signal, we follow that choice.

Do Not Track. Our website doesn't respond to Do Not Track signals, because there's no agreed standard for what they should do. Use Cookie settings or Global Privacy Control instead. The web app doesn't track you, so neither signal changes anything there.

8.6 Browser controls and ad choices

Most browsers let you block or delete cookies and site data, and some block third-party cookies by default. If you block all site data, the web app may not be able to keep you signed in, because it uses your browser's storage. You can also control ads from Google and Meta directly:

Google's My Ad Center, to control personalized ads from Google.
Meta's ad preferences in Accounts Center (you need to log in).
The Google Analytics opt-out browser add-on, which stops Google Analytics on every website.
Industry opt-out pages for interest-based ads from participating companies: the Digital Advertising Alliance's WebChoices in the US, and Your Online Choices in Europe.

These tools are run by other companies, work per browser or account, and don't change your choices on our website. They may themselves use cookies to remember your opt-out.

9.How long we keep information

We keep personal information only as long as we need it for the purposes in this policy. Where there is no fixed period, we decide based on how long we need it to provide the Services, the needs of billing and security, whether you or your business are still using the Services, and what the law requires.

Retention periods
Information	How long we keep it
Account details and business account data	While the account is open. After an account or login is closed, we delete it within a reasonable period, subject to the exceptions below.
Web chats (questions and answers)	Until the chat is deleted (by the person who started it, an account owner or us; a private chat only by the owner it belongs to, or by us on request) or the business account is closed. A private chat is also deleted with the login it belongs to (see section 4.7). An automation's report copied from a private chat into a channel follows the channels row below instead.
Spoken recordings	Not kept by us. A recording is held only for as long as it takes to pass it to Cloudflare, and never written to a file, a log or our error monitoring. For what Cloudflare says about storing it, see section 4.4.
Web question records (no question text)	About 180 days.
Monthly question and spoken question totals	As long as needed for billing history, usage limits and legal requirements.
Credit records for each answer and question (plans that use credits; no question or answer text)	About 400 days, then deleted automatically, even if the chat they came from was deleted sooner (see section 9.1). After that we keep only each business's credit totals for each monthly period, for as long as its monthly question totals.
New-chat rate-limit records	About 2 hours.
Free sign-up records	About 30 days. While we offered free business accounts, we kept a one-way keyed code standing for the network address each one was created from, together with the business account it created, so that we could limit how many free accounts were created and spot automated abuse. We no longer create free business accounts, so no new records are made, and each one already kept is deleted about 30 days after it was made. We don't keep the address itself, and the key needed to link a code back to an address is held outside the database.
Web thumbs-down feedback	Deleted after 30 days, or sooner if the chat is deleted.
Business profile	While the business account is open. An owner can change the answers, or untick Launch Plan steps, at any time in the web app, and the profile is deleted with the business account.
Memory (Pro and Diamond)	Until an owner deletes it, or the business account is closed. If the plan stops including it, we stop using it and keep it so owners can still see and delete it. The earlier wording of a line HSA AI changed is kept until its next change, or until the change is undone. Done follow-ups are kept until an owner clears them. Deleting a chat doesn't delete what was saved from it; the link to that chat is removed. See section 4.11.
Playbooks resources you've opened	As long as your login exists. The record of which resources you've opened, and when, is deleted when your login is deleted.
What HSA AI reads from connected software (Diamond)	Not kept by us. It passes through Composio and our server (and, when it is read to answer a question or run an automation, on to Anthropic), and is never written to our database, our logs or our error monitoring. What is kept is the answer it goes into, like any chat, including an automation's report posted in a channel (see the channels row), and what an automation sends (see the automations row). What Anthropic receives follows its retention (see "Content sent to Anthropic").
Connected software and the numbers worked out from it (Diamond)	The connection (which app, who connected it, when it was connected and last read) and the numbers worked out from it, until an owner disconnects it or the business account is closed. A number that a later successful read no longer produces is removed then. If reading stops, because the access expires or the plan no longer includes it, the numbers stay until an owner disconnects the app or the business account is closed. Disconnecting deletes every number learned from that connection at once, and we instruct Composio to delete that connection and the access it holds; the same happens when deleting a login closes its business. When an owner reconnects an app whose access had expired, we instruct Composio to delete the old connection, and the numbers from it are replaced or removed at the new connection's first successful read. This doesn't remove the permission from your own account at the software's provider (for Google, the list of apps with access to your Google Account); you can remove it there at any time.
Other things saved about the business (Diamond)	Until an owner removes them on the Apps page, or the business account is closed.
Composio's records (Diamond)	The access a connection grants (its tokens, key or login): until the connection is disconnected or the business account is closed, when we instruct Composio to delete it. Records Composio keeps of our requests: under Composio's own settings and retention.
Slack posting settings and post records (Diamond)	The settings (on or off, and the channels picked) until the owner changes them. Both the settings and the record of each post (never its text) are deleted when that Slack connection is disconnected, the login that connected it is deleted or the business account is closed.
Automations (Diamond)	An automation (its name, instructions, schedule, time zone and the channel its reports go to, if any) until the owner deletes it, its owner's login leaves the business, stops being an owner or is deleted, or the business account is closed. Each run's record: 180 days after the run finished. What an action would send, and where: while it waits for approval (at most 7 days, and dropped at once if it is denied or never decided), and for 30 days after it is done; then, until 400 days after it ended, only which app and action it was, how it ended, when, and who approved or denied it. What the owner allows an automation to do again: until they remove it, delete the automation or disconnect that app. Deleting an automation deletes all of these with it. The chats its runs made are kept like other private chats (see "Web chats"), and the reports it posted in a channel like other channel messages (see the next row).
Channels and their messages (Diamond)	A channel (its name, topic, settings and who is in it) until an owner deletes it, the last person in a private channel leaves it or is removed (or, within about a day, once nobody in it is still in the business) or the business account is closed. Messages, thread replies and automations' reports until they are deleted (by whoever wrote a message, or by an owner) or their channel is deleted, or the business account is closed; they stay when the person who wrote them leaves the business or their login is deleted (with the link to that login removed), and a report stays when its automation, or that automation's owner, is deleted. Editing a message replaces its text; earlier versions aren't kept. A deleted message's text, reactions and mentions go at once; the record that it was there (never its text) is deleted about 30 days later, or, while replies to it remain, once they are gone too. Places in private channels: until the person leaves the channel or is removed from it, leaves the business, the channel is deleted or the business account is closed. Reactions: until they are taken back or their message is deleted, the person who added them leaves the business, the channel is deleted or the business account is closed. How far each person has read: until they leave the business, the channel is deleted or the business account is closed. Leaving a private channel, or being removed from it, doesn't delete the messages someone wrote there, their reactions or how far they had read. See section 4.10.
Channel rate-limit records (Diamond)	Deleted within about 2 hours. They say only who posted, edited, deleted or reacted to a channel message, and when.
Invitation email addresses	Removed about 30 days after the invitation is accepted, revoked or expires, whichever comes first. You can ask us to remove it sooner.
Email address on a checkout page purchase	Deleted when you create your login; if you never do, 180 days after you pay, or 90 days after the purchase is refunded or ends.
A purchase started on that page and never paid for	Deleted after 30 days.
The record that you agreed to our Terms and to the automatic renewal, made when your payment reaches us	Kept like other consent records (at least 3 years).
Consent records	At least 3 years after the record is made, or 1 year after the subscription it was for ends if that is later, and longer while we need it as evidence of what was agreed. They are kept with our audit records, which are append-only, so we don't edit or delete them. If your login is deleted, the record's link to it is removed.
Audit records	As long as needed for security and legal purposes. They are append-only, so we don't edit or delete them. If your login is deleted, the record's direct link to it is removed, but some records, such as those for adding a member or changing a role, still contain your user ID, and records of creating a business account contain the business name. When a business account is deleted, a record's link to it is removed; the record itself is not.
Slack usage counts and question log	Question log: about 180 days, then deleted automatically. Monthly usage counts: as long as needed for billing, usage limits and security, and as the law requires; not deleted automatically today, so they stay until we delete them, for example on request.
Slack feedback records, including thumbs-down text	About 30 days, then deleted automatically.
Slack staff alerts	Under our Slack workspace's retention settings, until we delete them on request or when we delete that client's Slack data (see the next row).
Slack data after a client's access ends or the Slack app is discontinued	Our Slack app's usage, question-log and feedback records, and related staff alerts, deleted within 14 business days, except what the law requires us to keep. Hosting logs and content sent to Anthropic follow their own schedules in this table.
Application and hosting logs	For a limited period under our hosting provider's log retention, currently no more than about 90 days.
Error reports (Sentry)	For a limited period under our error monitoring provider's data retention settings.
Bot check data (Cloudflare)	Under Cloudflare's own retention practices. We don't receive or keep it: our authentication provider only learns from Cloudflare whether the check passed.
Sign-in event logs	For a limited period under our authentication provider's settings.
Sign-in emails, welcome emails and emails confirming a deleted login	Our email delivery provider keeps email content and delivery logs for about 30 days. That includes the email confirming a deleted login, which is sent after the login is deleted.
Content sent to Anthropic	Under Anthropic's published policy: deleted within 30 days by default; flagged content up to 2 years; longer where the law requires.
Emails, contact form messages and support messages, including requests to sign up and to cancel	As long as needed to respond, to set up access, and to keep a record of our conversation. You can ask us to delete them.
Billing records, including subscription details we receive from Whop, credit pack purchases and payments, and credits we add by hand	While the business account has a plan with us, and afterwards as long as tax, accounting and other laws require, or as needed to resolve billing disputes. Records of credit pack purchases and payments, and of credits added by hand, stay after the business account is closed, with their link to the business and to the login that bought a pack removed when those are deleted. Whop keeps its own records under its own retention policies.
Consultation bookings	As long as needed to hold and follow up on the call, and under Calendly's own retention.
Web app browser storage	Until you sign out, close the tab (session storage) or clear your browser's storage.
Your website cookie choice (`hsa.consent`)	Used for 12 months, then the banner asks again. We also ask again sooner if we change the tools or their purposes, but if you turned Advertising off it stays off until you switch it on yourself (see section 7.7). It stays in your browser until you choose again or clear your browser's storage.
Website analytics and advertising cookies	The durations in the table in section 8.2, unless you delete them sooner or withdraw consent.
Google Analytics data	We set Google Analytics to keep user-level and event-level data (the data tied to a cookie ID) for no more than 14 months. Google's aggregated reports aren't affected by this setting and stay in our Google Analytics account. We don't turn on Google signals, which would let Google keep data about signed-in Google users for longer.
Google Ads and Meta Pixel data	Under Google's and Meta's own retention policies. Meta's Business Tools Terms let Meta keep data it receives through the Pixel for up to two years.

9.1 Deleting a chat

Deleting a chat in the web app permanently deletes its questions and answers, and any feedback copies of its answers, from our live database. It can't be undone. Some limited records without chat content stay: the question records (time, business account, who asked) for their normal period; on a plan that uses credits, the credit records of its answers (each answer's ID, the AI model, the token counts and the credits used, with no question or answer text) for their normal period; and an audit entry noting that the chat was deleted, by whom and how many messages it had. On the Diamond plan, also the record of any post HSA AI made to Slack from it (never its text), and, if an automation made the chat, the run's record, without its link to the chat, and the actions the run wanted, with what they would send; all for their normal periods (see section 4.9). A report the run posted in a channel isn't deleted with the chat: it stays in the channel until someone deletes it (see section 4.10). What HSA AI saved to Memory from a chat stays until an owner deletes it in Settings (see section 4.11). Content already sent to Anthropic follows Anthropic's retention.

9.2 Backups, legal holds and de-identified data

Deleted information may remain for a limited time in backups or provider systems until it is overwritten or deleted on their normal schedule. We may keep information longer if we need it to comply with the law, resolve disputes, enforce our agreements or prevent fraud or abuse, or if it is subject to a legal hold. We may keep information that has been de-identified or aggregated so it no longer identifies you.

10.How we protect information

We use reasonable technical and organizational measures to protect personal information, including:

Encryption in transit. The web app is served only over HTTPS (TLS) and tells browsers to always use HTTPS (HSTS).
Separation between businesses. Database row-level security rules limit each business's data to its own members and authorized HSA AI staff. The same rules keep a private chat to the one owner it belongs to (see section 4.7). Channels can be read and written only through database functions that check the business and whether that person may see the channel (see section 4.10). Memory can be read and written only through database functions that check the person is an owner of the business (see section 4.11).
Connected software (Diamond). Access to the software a business connects is held by Composio, never by us. Our server reads it only through fixed paths that check the business and what may be read, and, when it reads for a question or an automation, that it is for the owner who connected it. It can act in it only as sections 4.8 and 4.9 describe. Everything read from it is marked for the AI model as written by someone else, not as instructions to follow.
Passwords never reach our servers. Our authentication provider stores them in hashed form.
One-time sign-in codes sent to your email address, and invitation links that expire after 14 days, work only once and only for the invited email address. Invitation secrets are stored only in hashed form.
Payments. When you pay online, Whop handles your card details. We never receive or store card numbers.
Limited access. Access to customer content is restricted to people we authorize. Secret keys with full database access are kept on our servers only, never in your browser.
Append-only audit records of privileged actions, which our application and its service keys can't change or delete.
Careful logging. Our app's logs leave out email addresses, tokens and question text, and error reports are cleaned the same way before they're sent to our error monitoring provider.
Bot checks. Cloudflare Turnstile checks password sign-ins, requests for codes by email and purchases started on our checkout pages, so automated scripts can't guess passwords or use up the sign-in emails our customers need.
Browser protections, such as a strict content security policy. The only third-party script the web app loads is Cloudflare's bot check, and only when you sign in or ask for a code.

No method of transmission or storage is completely secure, and we can't guarantee absolute security. If we learn of a security breach affecting your personal information, we'll notify you and any regulators as required by law.

You are responsible for keeping your password, your email account and your devices secure, and for not forwarding invitation links. Anyone holding an invitation link can see the business name, the role and the invited email address. Tell us right away at info@hsacleanai.com if you think your account has been compromised.

11.Your choices and rights

Wherever you live, you can ask us to:

Access the personal information we hold about you, and learn how we use and share it.
Correct information that is wrong or incomplete. Settings in the web app lets you change your name, your business name, your sign-in email address and your password yourself, and lets owners change the business profile and, on the Pro and Diamond plans, Memory. For anything else, contact us.
Delete your personal information.
Get a copy of your information, including your chats, in a commonly used electronic format.
Object to or restrict certain uses, where the law gives you that right, such as uses based on our legitimate interests.
Withdraw consent where we rely on it. This doesn't affect what we did before you withdrew.
Opt out of advertising on our website, including any "sale," "sharing" or "targeted advertising." You can do this yourself, see below.

You don't need to email us to change your cookie choices on our website: use the Cookie settings or Your privacy choices button at the bottom of hsacleanai.com, or turn on Global Privacy Control in your browser (see section 8). Because those choices live in your browser, we can't change them for you, but we're happy to help by email.

Owners can see, correct and delete Memory themselves in Settings, under Memory (see section 4.11); if the plan stops including Memory, they can still see and delete it there.

On the Diamond plan, owners can also act for themselves in the web app: any owner can disconnect software and remove what's saved about the business on the Apps page, the owner who connected Slack can switch posting off, and an owner can pause or delete their automations and take back what they allowed them to do. In channels, everyone can edit or delete their own messages in the channels they're in and leave a private channel, and an owner can delete any message or channel.

The web app has no self-serve data export today, so we handle requests for a copy, including a copy of your business's Memory, by email. You can delete your own login in Settings, as section 11.1 describes; we handle other requests to delete information by email.

11.1 How to make a request

Email info@hsacleanai.com with "Privacy request" in the subject, ideally from the email address on your account. To ask us to delete your data, you can also use the Request data deletion link in Settings in the web app, which opens an email to us with the subject already filled in. Settings also has Delete my login, which you can use yourself without emailing us: it deletes your login and closes any business where you are the only owner. It shows you what will go before you confirm, and if it can't finish the job cleanly it says so and asks you to email us instead. Once it's done, we email you to confirm it. For Slack, tell us your Slack name and the channel. To protect you, we'll verify your identity before acting, for example by asking you to confirm from your account's email address. We may ask for more information if we need it, and we'll use it only to verify your request.

11.2 When we'll respond

We respond within 30 days. If you are covered by the GDPR or UK GDPR, we respond within one month, and we may extend that by up to two more months for complex or numerous requests. Under Canadian law we respond within 30 days and may extend as that law allows. If a law gives you a shorter deadline, we meet it. If we need more time, we'll tell you why.

11.3 What deletion means

Shared business chats belong to the business account. If you ask us to delete your information, we'll delete your account details, but questions you asked in shared chats may stay available to the business, unless an account owner deletes those chats or the law requires us to remove them. We'll tell you if this applies. An account owner can delete any chat in the business except one private to someone else.
Private chats belong to their owner. On the Diamond plan, deleting an owner's login deletes the chats private to them (see section 4.7), and the automations they set up with their records (see section 4.9), but not the reports those automations already posted in channels, which belong to the business account like other channel messages.
Channel messages belong to the business account. On the Diamond plan, if you leave a business or ask us to delete your information, the messages you wrote in its channels may stay available to the business, with their link to you removed when your login is deleted, unless you or an account owner delete them first or the law requires us to remove them. We'll tell you if this applies. Your reactions, your places in private channels and how far you had read are deleted when you leave the business (see section 4.10).
Memory belongs to the business account. On the Pro and Diamond plans, if an owner leaves the business or asks us to delete their information, what they saved to Memory stays with the business, with its link to their login removed when the login is deleted, unless an owner deletes it first (see section 4.11).
We may keep records we need for legal, security, billing or accounting reasons, and evidence that you agreed to our Terms and acknowledged this policy, with the link to your login removed.
Content already sent to Anthropic, and copies in backups, are deleted on those systems' own schedules.
Messages in Slack are controlled by Slack and your workspace. We can delete what our Slack app stores, but not your messages in Slack.

11.4 Closing an account

An account owner can ask us to close a business account by emailing us. A team member can ask to be removed from a business account, and an owner can ask us to remove a member. When a business account is closed, we delete its chats, its Memory, members, invitations and usage records within a reasonable period, except records we need to keep as described above. On the Diamond plan, that includes its connected software and everything saved about the business, its automations, its channels with everything in them, and its Slack posting records, and we instruct Composio to delete the business's connections and the access they hold.

11.5 Appeals

If we decline your request, we'll explain why. You can appeal by replying to our decision with "Appeal" in the subject. We'll respond within 45 days and explain the outcome. If you still disagree, you can contact your data protection authority or, in the US, your state attorney general.

11.6 Authorized agents

You can have someone else make a request for you. We'll ask for proof that they're authorized, such as a signed permission or a power of attorney, and we may still ask you to verify your identity directly with us.

11.7 No discrimination

We won't treat you differently, charge you more or give you a lower quality of service because you exercised a privacy right.

11.8 Emails from us

We send service emails, such as sign-in codes, account and security notices, billing messages and replies to your questions. When a Starter or Pro subscription starts, we email the owner who paid a welcome with the plan's price, its renewal terms and how to cancel. When someone deletes their login with Delete my login, we email that login's address to confirm it. These are part of the Services, and you can't opt out of them while you have an account. We don't send marketing emails today. If we ever do, we'll send them only as the law allows, never to people who only emailed us about signing up unless they agreed, and each one will include a working way to unsubscribe. You can also opt out at any time by emailing us.

12.Additional information for people in the EEA, UK and Switzerland

This section applies if the EU General Data Protection Regulation (GDPR), the UK GDPR or the Swiss Federal Act on Data Protection (FADP) applies to our processing of your personal information.

12.1 Controller

HSA AI is the controller. Contact us at info@hsacleanai.com.

12.2 Legal bases

Our purposes and the legal bases we rely on are in the table in section 3.1.

12.3 International transfers

We are based in the United States, and we store and process personal information in the United States. Some of our providers, including Anthropic, Cloudflare and Composio, may also process it in other countries. These countries may not have data protection laws equivalent to yours. When we disclose personal information about people in the EEA, UK or Switzerland to our providers in the United States or other countries, we rely, where applicable, on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and their Swiss equivalents, as included in our providers' data processing terms, or on other lawful transfer mechanisms that a provider offers. You can ask us for a copy of these safeguards at info@hsacleanai.com.

12.4 Website cookies, Google and Meta

On our website, we use analytics and advertising cookies and similar technologies only with your prior consent, which you give through the cookie banner (see section 7.1). Rejecting them is as easy as accepting them, and you can withdraw consent at any time in Cookie settings (see section 8.3). Withdrawing doesn't affect what happened before.

If you allow them, your browser sends information directly to Google and Meta, which process it in the United States and other countries:

Google LLC is listed as a participant in the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework.
Meta Platforms, Inc. is listed as a participant in the EU-U.S. and Swiss-U.S. Data Privacy Frameworks. It isn't listed for the UK Extension. The joint controller with us for collecting and sending Pixel data is Meta Platforms Ireland Limited for people in the EEA, and Meta Platforms, Inc. for people in the UK (see section 5.5). Meta is responsible for its own transfers after that. If you're in the UK and you allow Advertising, your browser sends Pixel data to Meta Platforms, Inc., which may process it in the United States without the protection the UK Extension gives to listed companies. You don't have to allow Advertising to use our website, and you can switch it off at any time in Cookie settings.

You can check a company's current participation at dataprivacyframework.gov.

12.5 Your rights

You have the right to:

access your personal information and receive a copy;
have inaccurate information corrected;
have your information erased;
restrict how we use it;
object to processing based on our legitimate interests, and to direct marketing at any time;
receive information you provided to us in a structured, commonly used and machine-readable format, and have it sent to another controller where technically feasible (portability);
withdraw consent at any time, where we rely on consent; and
lodge a complaint with a supervisory authority, in particular where you live, work or believe your rights were infringed. In the EU, you can find your authority through the European Data Protection Board. In the UK, it is the Information Commissioner's Office. In Switzerland, it is the Federal Data Protection and Information Commissioner.

To use these rights, follow section 11. We'd appreciate the chance to address your concern first.

12.6 Whether you have to give us information

You don't have to give us personal information. But we need your name, email address and business name to create a web account, payment for a paid plan (when you pay online, Whop needs your payment details to process it), and your questions to answer them. Without them, we can't provide the Services to you.

12.7 Automated decision-making

We don't make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.

13.Additional information for people in Canada (including Quebec)

13.1 Consent

We collect, use and disclose your personal information with your consent and as permitted or required by law. We rely on your implied consent for the uses described in this policy that you would reasonably expect when you use a business service, and we'll ask for your express consent before any use that is sensitive or that you wouldn't reasonably expect. On our website, we ask for your express consent before using analytics or advertising cookies (see section 8). You can withdraw consent at any time, subject to legal or contractual limits and reasonable notice. If you do, we may no longer be able to provide some or all of the Services.

13.2 Storage and processing outside Canada

We and our service providers store and process personal information in the United States, and some providers, including Anthropic and Composio, may process it in other countries. While it is outside Canada, it is subject to the laws of those countries and may be accessible to their courts, law enforcement and national security authorities. Our providers are listed in section 5.4, and the analytics and advertising partners on our website in section 5.5.

13.3 Access, correction and complaints

You can ask to access your personal information, to have it corrected, and to learn how it has been used and to whom it has been disclosed. In Quebec, you can also ask us to stop disseminating your information or to de-index it where the law allows, and to receive computerized information you provided in a structured, commonly used technological format. We respond within 30 days. Follow section 11 to make a request.

If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d'accès à l'information du Québec.

13.4 Person responsible for privacy

The person in charge of the protection of personal information at HSA AI is our Privacy Officer. You can reach the Privacy Officer at info@hsacleanai.com.

13.5 How we manage personal information

Our Privacy Officer is responsible for how HSA AI protects personal information. Only people we authorize as HSA AI staff, and the people who run our database and hosting, can access it, and they may use it only for the purposes in section 5.3. We keep and delete it as described in section 9. If you have a complaint about how we handle your personal information, email the Privacy Officer at info@hsacleanai.com. We'll look into it and reply with what we found and any steps we'll take. If you're not satisfied, you can contact the regulators named in section 13.3.

13.6 Profiling and location technology

The web app and the Slack app don't use technology that identifies, locates or profiles you. Memory holds what an owner tells HSA AI about their business, which they see and change; it isn't used to identify, locate or profile anyone. On our website, Google Analytics, Google Ads and the Meta Pixel use cookies that can identify your browser, work out your approximate location from your IP address and, for advertising, be used by Google and Meta to profile you. They are off by default and run only if you switch them on, and you can switch them off again in Cookie settings (see section 8). We don't make decisions about you based exclusively on automated processing.

14.Additional information for California and other US states

Several US states have privacy laws. Some of them may not apply to us or to business users like you. We provide the information and rights in this section regardless of whether a law requires us to.

14.1 California Online Privacy Protection Act

The categories of personal information we collect and the third parties we share it with are in section 2 and section 5.
How you can review and ask to change your information is in section 11.
How we tell you about changes to this policy is in section 17.
The effective date is at the top of this page.
How we respond to Do Not Track signals, and whether third parties can collect information about your online activity over time and across websites through the Services, is in section 8.

14.2 Categories of personal information

The table lists the categories of personal information we collect, including in the last 12 months. The Google and Meta entries apply only to website visitors who allow Analytics or Advertising cookies.

Categories, sources and disclosures
Category	Examples	Disclosed for business purposes to	Possibly "sold" or "shared" (website, only if you allow Advertising)
Identifiers	Name, email address, account and user IDs, Slack user ID, Whop membership and user IDs, IP address; on the website, cookie IDs and ad-click IDs.	Supabase, Railway, Resend, Google Workspace, Slack, Calendly, Whop; Cloudflare receives IP addresses when the bot check runs; Sentry receives internal account and user IDs, when error monitoring is on; Composio receives our internal ID for a Diamond business, for the software it connects; Squarespace and our website host receive IP addresses of website visitors; Google (Analytics), if you allow Analytics.	Google (Google Ads) and Meta (Meta Pixel): cookie IDs, ad-click IDs and IP address. Never your name or email address.
Customer records and commercial information	Business name, plan, usage and billing records, credit balances and credit pack purchases, and billing contact and billing email address; card or other payment details, which Whop collects when you pay online.	Supabase, Railway, Google Workspace; Whop, when you pay online; Resend, for the welcome email when a Starter or Pro subscription starts and for the email confirming a deleted login.	None.
Internet or other electronic network activity	Request logs, usage records, sign-in events, which Playbooks resources you've opened, reactions in Slack, and on the Diamond plan reactions in channels and how far you've read each one; on the website, pages visited, how you got there, interactions with pages, ad clicks, browser and device details, and whether you clicked a sign-up link.	Supabase, Railway, Slack; Cloudflare, when the bot check runs (browser and device details, the page address and signals from the check); Sentry, when error monitoring is on (request routes, timing and browser type from the web app); Squarespace and our website host receive website visitors' IP addresses and browser details; Google (Analytics), if you allow Analytics.	Google (Google Ads) and Meta (Meta Pixel): pages visited on our website, ad clicks, browser details and whether you clicked a sign-up link.
Geolocation data	Approximate location worked out from your IP address on the website. We don't collect precise location; Memory can hold the city or area a business works in, if an owner says so, and a new business's profile holds its city and state.	Google (Analytics), if you allow Analytics; for a business's city or area in Memory or its city and state in its business profile, Supabase, Railway and Anthropic.	Google and Meta may work out approximate location from your IP address.
Audio information	A recording of your voice, when you press the web app's microphone button to speak a question. We don't keep it (see section 4.4).	Cloudflare (Workers AI), to turn it into text; Railway, as it passes through our web app's server on its way there.	None.
Professional or employment-related information	Your business, your role in the business account, and, if an owner set one up, the business profile: how long the business has been running, its team and work, what it books jobs in, what's hardest right now, the owner's own words about it, for a new business its city and state, its budget for starting out, whether it has a business name yet and its monthly profit goal, and which Launch Plan steps are done. On the Pro and Diamond plans, the business's Memory (such as its approximate monthly revenue, team, prices, the software it uses, its goals and plans to follow up on).	Supabase, Railway, Google Workspace; Anthropic (a summary of the business profile, with an owner's own questions), which on the Pro and Diamond plans also receives the business's Memory with those questions; Resend (the business name, in the welcome email when a Starter or Pro subscription starts and in the email confirming a deleted login).	None.
Content you submit	Questions, chats, Slack messages to the bot and threads it answers in, feedback, emails and contact form messages, including requests to sign up. On the Pro and Diamond plans, a business's Memory. On the Diamond plan, what is saved about the business, automations' names and instructions and what their actions send, messages in channels, including automations' reports, and what HSA AI reads from software an owner connects, such as emails and calendar events, which can include other people's details.	Anthropic, Supabase, Railway, Resend (contact form messages), Slack, Google Workspace; Composio, for software a Diamond business connects.	None.
Sensitive personal information	Account log-in credentials: your email address and password (the password is stored in hashed form by our authentication provider).	Supabase.	None.
Inferences	None by us. We don't draw inferences to create a profile about you.	Not applicable.	Google and Meta may draw their own inferences for advertising from what they receive, under their own policies.

Sources: you, the people who invite you or share chats and Slack threads with you, Slack, software a Diamond business connects (through Composio), our service providers, and, for website visitors who allow them, Google Analytics, Google Ads and the Meta Pixel (see section 2). Purposes: the business and commercial purposes in section 3 (for what HSA AI reads from connected software, only the narrower ones it describes), and for Google and Meta, measuring our website and our ads. Retention: see section 9.

14.3 Sale, sharing and targeted advertising

We don't sell personal information for money, and we never sell, share or use information from the web app, the Slack app or the software you connect for advertising. On our website, if you allow Advertising cookies, Google (through Google Ads) and Meta (through the Meta Pixel) receive identifiers and internet activity from your visit and may use them for their own advertising purposes. Some state laws treat this as "sharing" for cross-context behavioral advertising, "targeted advertising" or a "sale." We don't use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects. We have no actual knowledge of selling or sharing the personal information of anyone under 16, and the Services aren't directed to children.

Your right to opt out. You have the right to opt out of the sale or sharing of your personal information and of targeted advertising. Advertising is already off unless you switched it on. To opt out, use either of these, on each browser and device you use to visit our website:

The Your privacy choices or Cookie settings button at the bottom of hsacleanai.com: switch Advertising off, or choose Reject all, then save. The settings show whether Advertising is on or off, so you can confirm your opt-out took effect.
Global Privacy Control: turn it on in your browser or with a browser extension, and we'll treat it as an opt-out for that browser (see section 8.5).

Because these choices are stored in your browser and we don't know who you are when you visit our website, we can't apply an opt-out for you from an email. If you have questions or need help, email info@hsacleanai.com.

14.4 Sensitive personal information

The only sensitive personal information we collect on purpose is your account log-in credentials (your email address together with your password). Our authentication provider handles them so you can sign in, and we use them only to sign you in and keep your account secure. On the Diamond plan, if an owner connects software that signs in with a username and password or an API key, they enter it on Composio's own page, and it never passes through our servers; Composio holds it for us, to keep that connection working for the business. What HSA AI reads from connected software may contain sensitive information someone else wrote; we don't collect it on purpose, don't store it except as far as an answer (including an automation's report posted in a channel) or an automation's action repeats it, and use it only for the answer or automation run it was read for, and to keep the Services secure or meet a legal obligation as section 4.5 describes (see section 2.4). We don't use or disclose sensitive personal information to infer characteristics about you, or for any purpose that would give you a right to limit its use. We ask you not to submit other sensitive information (see section 2.4).

14.5 California "Shine the Light"

Apart from what Google and Meta may do with website information if you allow Advertising cookies (see section 14.3), we don't disclose personal information to third parties for their own direct marketing purposes.

14.6 Your rights

You can ask to know, access, correct and delete your personal information, and to get a copy of it. You can opt out of any sale, sharing or targeted advertising, as described in section 14.3. You can appeal if we decline, and you won't be treated unfairly for using your rights. To make a request, use an authorized agent or appeal, see section 11.

15.Children

The Services are for businesses and are not for anyone under 18, as our Terms of Service say. They are not directed to children, and we don't knowingly collect personal information from anyone under 18. If we learn that we have, we'll delete it. If you believe a child has given us personal information, contact us at info@hsacleanai.com.

16.International use

We are based in the United States, and we process and store personal information there. If you use the Services from outside the United States, your information will be transferred to, stored in and processed in the United States, and in other countries where our service providers operate. Their data protection laws may differ from those where you live. We protect transferred information as described in this policy, including the safeguards in section 12.

17.Changes to this policy

We may update this policy from time to time, for example when we add features, change providers or when the law changes. When we do, we'll change the date at the top of this page.

If we make a material change, such as using personal information in a new way or sharing it with new kinds of recipients, we'll tell you at least 30 days before it takes effect, by email to account owners and, where practicable, by a notice in the web app or Slack. We may make a change sooner if the law requires it or if it is needed to address a security or legal risk, and we'll still tell you as soon as we reasonably can. We won't use your content to train AI models unless you opt in first, and any opt-in would cover only content created after you give it. We won't use personal information we already hold in a materially different way from what this policy describes without your consent.

You can always find the current version at app.hsacleanai.com/privacy. If you have questions about a change, contact us.

18.Contact us

For questions about this policy or how we handle personal information, email info@hsacleanai.com. For privacy requests, put "Privacy request" in the subject line. Our mailing address is Robinsky Group LLC, 269 W Pebble Creek Lane, Orange, CA 92865.

Sign-in emails come from login@mail.hsacleanai.com. That address can't receive replies, so please write to info@hsacleanai.com instead. The welcome email for a new Starter or Pro subscription comes from hello@mail.hsacleanai.com, and replies to it go to info@hsacleanai.com. So does the email confirming a deleted login, and replies to it go to info@hsacleanai.com as well.