Privacy Policy

• We collect what we need to run hu for you: your account, your conversations, what hu remembers, your files, and data from the services you choose to connect.
• To answer you, hu sends the parts of your data that a request needs to AI models, including models run by other companies. Those companies don’t train their models on your data.
• We may use your data to improve huSpace and to train our own AI models. If you don’t want that, write to us. Data from Gmail and Google Calendar is never used for this.
• We don’t sell your data, and we don’t show ads. There are no analytics or advertising trackers in the app or on the site.
• You can see, change and delete much of your data in the app. For everything else, write to [email protected].

huSpace is run by Alperen LTD, a company registered in Cyprus under number HE 454844, at Ayiou Ayapitikou 31, Paphos 8041, Cyprus. We decide how and why your personal data in huSpace is used. In data protection law, that makes us the “controller”. For anything about your data, write to [email protected].

Most of this comes from you. Some comes from services you use with huSpace: from Google when you sign in with it, from Stripe when you pay, and from the services you connect.

Your account. Your email address, your display name, your date of birth, how you sign in, when you created your account and when you last signed in. If you sign in with Google, Google gives us your Google account ID, your email address, whether Google has verified it, your name and a link to your profile photo. We keep all of these except the photo link, which we don’t store. We never get your Google password. If your account has a password, we store only a secure hash of it, never the password itself. We also keep your language, your settings, and which version of our Terms of Use and this policy you accepted, and when.

We ask for your date of birth only to check that you’re 18 or older. We don’t use it for anything else: it doesn’t go into hu’s memory, your profile or your conversations with hu.

Your content. The messages you type or dictate, and hu’s replies. Short summaries of long conversations. Files you upload. Your instructions to hu, your projects and the skills you add. Documents and decks hu writes for you, with their earlier versions. Tasks and research: the request, the steps, the sources and the results. In Studio: your prompts, settings, reference files and results. The shared links you create. Your ratings of hu’s replies, and any reason you add to a rating.

Memory and profile. The facts hu learns from your conversations. Your profile from your first interview with hu: your name, the name you gave hu, a short profile, the tone you like, and the interview itself, with earlier versions of the profile. Suggestions from night learning. Notes hu keeps on each of your projects, so it can follow the work over time. The hours of the day when you use the app, so hu can learn your rhythm. hu’s own suggestions to you, and what you did with them. Memory can contain sensitive details if you share them, for example about your health, family, money, relationships, beliefs or identity.

Voice. During a call, your voice is streamed for live processing. We keep a written transcript of both sides in the chat, a short summary of the call, and how long you talked each day. We don’t record or store the audio. Dictation turns short speech into text, and we don’t keep that audio either.

Connected services. If you connect a service, we keep the access key it gives us, plus the data hu reads or writes there for you. For example: emails, calendar events and their guests, and results from other connected apps.

Location. Only if you choose to share it. We use your coordinates once to work out your city, region, country and time zone, and then we discard them. We keep only your city.

Payments. You enter your card, name and billing address on Stripe’s page, not ours. Stripe sends us a customer ID, your plan and purchases, and payment records, and we keep these records as Stripe sends them. They may include your name, email address, billing address and country, any tax ID you give, and your card’s brand, country, last four digits and expiry date. We never receive your full card number. We also keep a record of your usage: what you spent, on what, and when.

Technical data. When you sign in, we record your IP address and browser with your session. We log sign-in attempts. Our servers keep basic logs: your IP address, the page address without its query, the response, the referring page and your browser. They don’t contain what you type. The app gives your browser a device ID and sends it with your messages so they’re delivered reliably. If you turn on push notifications, your browser gives us an address to send them to. New accounts may be randomly assigned one of two versions of the first experience, so we can learn which one helps people more.

When you contact us. If you join our waitlist, we get your email address, your name, your note and where your request came from. If you use the contact form on our site, we get your name, email address, topic, any link you add and your message. Our team receives both in a private chat in a messaging app. If you email us, we get your address and what you write.

Your email choices. Whether you agreed to receive product updates and offers, and the history of those choices.

We don’t buy data about you from anyone. We don’t use analytics, error trackers or advertising trackers in the app or on the site.

What you have to give us. To have an account, you need an email address or a Google account, and your date of birth. To pay, you give your payment details to Stripe. Everything else is up to you, but some features need certain data: for example, local answers need your location, and a connector needs access to the service you connect.

If you’re in the EEA, the UK or Switzerland, the law requires a legal basis for each use. Here they are.

Where we rely on legitimate interests, you can object (section 18). We don’t make decisions about you that have legal or similarly significant effects based only on automated processing.

hu’s answers come from AI models, including models made and run by other companies. The kinds of providers we use are on our Subprocessors page.

To answer you, we send a model what that request needs. That can include your message, earlier messages in the conversation, facts from memory, parts of your files, results from connected services, and your profile. The providers process this data only to send us answers. They don’t train their models on it.

We keep records of the requests we send to AI models and of the answers we get back. We use them to deliver answers, find and fix problems, check quality and costs, protect huSpace from abuse, and for the purposes below.

Improving huSpace and training our own models. We may use your data, including your conversations, files, memory, ratings and the records above, to improve huSpace and to train our own AI models. This applies to every account. We do it because a better hu is in your interest and ours.

• Data from Gmail and Google Calendar is never used for this (section 7).
• If you don’t want your data used this way, write to [email protected]. From then on, we’ll stop using your data to improve huSpace and train our models, unless the law allows us to continue.

• hu remembers facts from your conversations so it can help you better. AI models help pick out the facts (see section 4).
• In Memory, you can see what hu remembers, change it, or tell hu to forget it. Forgetting takes effect at once, and you can undo it.
• A project can keep its memory to itself: what hu learns there isn’t used in your other chats.
• Night learning is on by default (Settings › Memory & Dreaming). Each night, hu goes over your day and suggests changes, and nothing changes until you apply them. If you switch it off, your days aren’t reviewed at night.
• Memory may hold sensitive details if you share them, such as your health, relationships or beliefs. hu keeps them to help you, and you can tell hu to forget them at any time.
• When you delete a chat, hu stops using the facts it learned from that chat. We may keep a copy of them, as described in section 16.
• To have all of your memory deleted, write to [email protected].

• During a call, your voice goes from your browser to our servers, and from there to an AI model that listens, speaks and takes turns. Files you drop into a call go to it too.
• We don’t record or store call audio. We keep the written transcript of both sides, added to the chat as messages, a short summary of the call, and how long you talked.
• Dictation turns short speech into text with an AI model. We don’t keep the audio.
• The providers of these models process the audio only to run the call or the dictation, and don’t train their models on it.

You choose which services to connect, and you can disconnect them at any time in Settings › Connectors.

• Google Calendar. We ask to see and edit your events, see your list of calendars, and read your calendar settings. While your calendar is connected, we keep a copy of your events on our servers, and Google keeps it up to date. When you disconnect, we delete the copy and cancel our access.
• Gmail. We ask to read your email and to send email for you. hu reads your mail when a request needs it. hu sends an email only after you press Send, and then you have 60 seconds to undo it.
• hu may remember important things from your emails and meetings, like anything else you share. You can see them and make hu forget them in Memory.
• Other apps. You can connect apps from our list, from a public directory of connectors, or any connector you add by its address. hu sends them what your request needs and gets their results back. Actions marked as risky or paid always need your confirmation.
• What hu reads from a connected service goes into its request to the AI model, like the rest of the conversation (section 4).
• We keep results from connected services, and the answers services give to actions hu takes there, only for a short time.
• We store access keys encrypted. When you disconnect, we delete the key, and for Google services we also ask Google to cancel our access.
• Each connected service keeps its own copy of your data, under its own privacy policy.

Google user data

Our use of information we receive from Google APIs, and any transfer of it to other apps, follows the Google API Services User Data Policy (opens in a new tab), including its Limited Use requirements. In particular:

• we use Gmail and Google Calendar data only to provide the features you use in hu;
• we don’t use it for advertising, and we don’t sell it;
• we never use it to train or improve AI or machine-learning models, ours or anyone else’s;
• our staff don’t read it, unless you ask us to, it’s needed for security or to comply with the law, or it has been aggregated and anonymised for running our service;
• we pass it on only to provide those features, for security, to comply with the law, or as part of a merger or sale, after telling you.

• Files you upload, documents hu writes and Studio results are stored with our file storage provider. Details about each file are kept in our own database.
• Some files are read on our own servers. To understand pictures, scans, audio and video, we may send them, or frames from them, to an AI model.
• You can delete a file you uploaded on its own, or together with the chat it belongs to.
• Documents and decks that hu writes are kept, with their versions, while your account exists.
• Studio sends your prompt, settings and any reference files to the provider that runs the model you choose. The results are copied to our storage.
• We and our providers may check Studio prompts, reference images and results for content our rules don’t allow.
• Deleting a Studio job deletes its result files at once.

• When hu searches the web for you, it sends the search words to a web search provider.
• When hu opens a public web page, our servers fetch it. The website sees our server, not you.
• Tasks and research keep their request, steps, sources and results. Deleting the chat or project a task belongs to stops the task.
• Websites and code that hu builds run on our servers, kept apart from the rest of huSpace. Preview links expire, after 3 days by default.

• hu uses your location only if you share it, for one chat or for later chats too. You can stop sharing at any time.
• We use your coordinates once to find your city, region, country and time zone, and then we discard them. We keep only the city. This lookup runs on our own servers.
• When you look for a place, the search words go to a place search service. Weather cards send the place’s coordinates to a weather service.
• Maps in the app load from a map service, which sees your IP address and the part of the map you look at.

• A shared link shows a read-only copy of a conversation’s text, as it was when you shared it. Cards, tool results, files, memory and anything private are left out.
• Anyone with the link can view it until it expires or you turn it off. Deleting the chat turns it off too. We ask search engines not to index shared pages.
• We count views. The count doesn’t record who viewed the link or their IP address.
• We store link addresses only as hashes. Like any visit, a view shows up in our server logs for a short time, with the link’s address hidden.

• We send email through our email provider: sign-in codes and links, address checks, a welcome letter, letters about your plan and trial, results of tasks you asked for, notices about changes to our terms and policies, and calendar invitations to your guests when you ask hu to send them.
• Our emails don’t contain tracking pixels.
• Stripe may also email you receipts, invoices, refund notices, failed-payment notices and reminders before a plan renews.
• We send product updates and offers only if you agree. We ask once, and you can change your answer in Settings › Notifications or unsubscribe from any of these emails. We keep a record of your choices.

We don’t sell your personal data, and we don’t share it for advertising. We share it only:

• with service providers who help us run huSpace: hosting and file storage, network and security, AI models, web search, Studio, content safety checks, payments, email, maps, places and weather, push notifications, and the messaging app our team uses for waitlist requests and contact-form messages. They may use it only to provide their service to us. Our Subprocessors page lists each kind and what it receives;
• with the services you connect, when you ask hu to read from them or act in them;
• with people you choose, for example through a shared link or a calendar invitation;
• with Stripe, which processes payments and is also responsible for its own handling of payment data, under its own privacy policy;
• with authorities, only when the law requires it, or when someone’s life or safety is at risk. See how we handle requests from authorities;
• in a business deal, such as a merger or a sale, or if huSpace moves to another company. Your data would stay protected by this policy, and we’d tell you before it came under a different one;
• with your consent, in any other case.

Only authorised people at huSpace can access your data, and only when it’s needed: to help you when you ask, to find and fix problems, to look into security problems or abuse, or to comply with the law.

• Our servers and databases are in Finland, in the European Union. Our providers store and process data in the European Union, the United States and other countries. Our network and security provider handles traffic around the world.
• Many of our providers, including AI model providers, are based in the United States. Some Studio models may run in China. The messaging app our team uses is run from outside the EEA, including from the British Virgin Islands and the United Arab Emirates.
• Some of these countries aren’t recognised by the EU, the UK or Switzerland as protecting data well enough. For transfers there, we use safeguards that the law approves: the European Commission’s standard contractual clauses, with the UK addendum where needed, or the EU-US Data Privacy Framework where the recipient is certified.
• To get a copy of these safeguards, write to [email protected].

We keep your data while your account exists and for as long as we need it to run and improve huSpace, or longer when the law requires it.

When you delete something in the app. A chat, a file, a fact in memory or a Studio job disappears for you at once, and hu stops using it. We may keep a copy to analyse and improve huSpace and to train our own models (section 4). Data from Gmail and Google Calendar is never kept for these purposes.

When you ask us to delete your account or all your data. Write to [email protected]. We delete all of it within one month, copies included, except what the law makes us keep, such as payment and tax records.

• Traffic to huSpace is encrypted, and it passes through our network provider’s protection against attacks.
• In our main databases, each person’s data is walled off by access rules at the database level.
• Access keys for connected services are encrypted. Passwords and shared-link addresses are stored only as hashes.
• Our application logs record IDs and counts, not your words.
• No system is perfectly secure. If a breach affects your data, we’ll tell you and the authorities as the law requires.
• Found a security problem? Write to [email protected] with “Security” in the subject. See how to report a security problem.

In the app, you can:

• delete a chat, a file or a Studio job;
• see, change and forget what hu remembers, and switch night learning off;
• turn off shared links (Settings › Shared links);
• stop sharing your location;
• disconnect a service (Settings › Connectors);
• stop product updates and offers (Settings › Notifications, or the unsubscribe link);
• cancel your plan.

By writing to [email protected], you can:

• get a copy of your data, in a common machine-readable format;
• delete your account and all its data;
• correct your data, or ask us to fix something wrong that hu says about you;
• object to how we use your data, including to improve huSpace and train our models, or ask us to limit it;
• withdraw a consent you gave us. This doesn’t affect what we did before.

Depending on where you live, the GDPR, the UK GDPR or other laws give you these rights. We’ll reply within one month. If a request is complex, we may need up to two more months, and we’ll tell you. To protect your data, we’ll check that the request comes from you, usually by writing to your account’s email. Someone else can make a request for you if you’ve authorised them, and we may ask for proof.

If we turn down a request, we’ll explain why. You can ask us to look at it again, and you can complain to a data protection authority (section 24).

Your data can reach us when someone else uses hu. For example, they may connect a mailbox or calendar that holds your emails or invitations, upload a file that mentions you, or invite you to an event through hu. We process that data to provide hu to that person and, like the rest of their data, to improve huSpace (section 4). We don’t contact you or build a profile of you. Guests invited through hu get an email from us on that person’s behalf. To ask about your data, write to [email protected].

This section adds to the rest of this policy for residents of California and other US states with privacy laws.

What we collect. In the last 12 months, we collected the categories of personal information listed below, for the purposes described above. They came from you, from your devices, from Google when you sign in with it, from Stripe, and from the services you connect.

• identifiers: name, email address, account and device IDs, IP address;
• personal details: your date of birth;
• commercial information: your plan, purchases and payment records;
• internet and network activity: sessions, usage and logs;
• approximate location: your city, if you share your location;
• audio and electronic information: voice streamed during calls (not stored by us) and call transcripts;
• inferences: what hu remembers about you and your profile;
• the content of your conversations, files and connected services.

Sensitive personal information. We collect some: your account sign-in details, the content of emails and messages when you connect Gmail or share them with hu, your precise location for a moment when you share it, and sensitive details you choose to tell hu, for example about your health. We use it to provide hu to you, memory included, and to keep huSpace safe. Apart from data from Gmail and Google Calendar, we may also use what you tell hu to improve huSpace and train our own models. You can ask us to limit this by writing to [email protected].

Sale and sharing. We don’t sell personal information. We don’t share it for cross-context behavioural advertising. So there is nothing to opt out of. We have no actual knowledge of selling or sharing personal information of anyone under 16.

Who receives it. We disclose each category for business purposes to the kinds of service providers on our Subprocessors page, and as described in section 13.

Your rights. You can ask to know what we collect and how we use it, get a copy, correct it, delete it, and limit the use of sensitive personal information. We won’t treat you differently for using these rights. Write to [email protected]. An authorised agent can make a request for you. If we refuse a request, you can appeal by replying to our answer.

How long we keep it. See section 16.

huSpace is for people aged 18 and over. We ask for your date of birth when you sign up. If it shows you’re under 18, the account doesn’t open. We keep that email address and date of birth so the check can’t be bypassed, and we delete them if you write to [email protected]. We don’t knowingly collect other data from children. If you think a child is using huSpace, write to [email protected]. We’ll close the account and delete its data.

We use only the cookies and browser storage that huSpace needs to work and to remember your choices. We don’t use analytics or advertising cookies. Because we don’t track you across sites, or sell or share your data, Do Not Track and Global Privacy Control signals don’t change what we do. Our Cookie Policy has the details.

When we change this policy, we’ll post the new version here with a new date. If a change matters, we’ll tell you by email at least 7 days before it applies. Earlier versions stay on our Legal page.

• Email: [email protected]
• Post: Alperen LTD, Ayiou Ayapitikou 31, Paphos 8041, Cyprus

If you’re unhappy with how we handle your data, please tell us first. You also have the right to complain to a data protection authority: the one where you live or work, or our lead authority, the Commissioner for Personal Data Protection in Cyprus. In the UK, that’s the Information Commissioner’s Office (ICO). In Switzerland, it’s the Federal Data Protection and Information Commissioner (FDPIC).