Hawk Managed AI Privacy Policy

Information you give us:

• Contact form: name, email address, company, phone (if given), and your message.
• Meeting booking (through HubSpot): name, email, company, time chosen, and any notes you add.
• Account and billing (paid Services): name, business name, email, billing contact, and payment details. Payments are processed by Stripe. You enter your card details on Stripe, and we never store them. At checkout, we send your organization name and work email to Stripe. Sales tax is collected where required (for example, for Connecticut customers). To calculate sales tax, we collect your billing address through Stripe. Stripe shares limited payment details with us, such as card brand, the last four digits, expiration date, and payment status, but never the full card number.
• Content you submit: prompts, documents, customer and job details, quotes, and other material you enter or connect to the Services ("Customer Content").
• Client portal sign-in: the email address you use to sign in. We sign you in by emailing you a one-time sign-in link (a "magic link"); we do not ask you to create a password.
• Client portal documents: files you or your organization upload to the client portal, such as for the Knowledge Assistant or Proposal Assistant. These are part of Customer Content and are handled as described in Section 4.
• Questions and answers: the questions your users ask in the client portal and the answers returned. We log them so they can appear on your organization's dashboard.

Information collected automatically:

• Technical data such as IP address, browser type, device data, pages viewed, and timestamps, collected by our hosting provider and security tools.
• Spam and abuse checks: Cloudflare Turnstile evaluates browser and device signals to tell people from bots.
• Rate limiting and usage caps: we record request counts and related identifiers to apply rate limits and daily usage caps, using Upstash. The identifiers used are IP address and, for signed-in users, account and user IDs. These records are kept for no more than 90 days.
• Analytics: we use Vercel Analytics to understand Site and Services usage. Vercel Analytics does not use cookies. It reports aggregated, anonymized usage, and its visitor identifier resets every 24 hours. We do not use advertising or cross-site tracking cookies. We use only cookies needed to run the Services, such as the sign-in session cookie that keeps you signed in to the client portal for up to 30 days.
• Campaign tags: if you reach our contact form from a link with campaign tags (such as utm tags or an ad click ID), your browser keeps those tags for that browser session (in session storage, not a cookie), and we include them with your contact form so we know how you found us.

When this feature launches, you may sign in or connect your Microsoft or Google account. With your permission, we receive the information you approve on the consent screen. This normally includes your name, email address, profile picture, and an account identifier. If you connect additional features such as email, calendar, contacts, or files, we receive only the scopes you approve, which are listed on the consent screen when you connect.

Tokens: we receive OAuth access and refresh tokens so the Services can act for you. We store tokens encrypted, use them only to provide the features you enabled, and never sell them. You can revoke access at any time in your Microsoft or Google account settings or by disconnecting in the Services. When you revoke access, we delete the stored tokens within 30 days.

Google API Services: Hawk Managed AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Specifically, we use Google user data only to provide or improve user-facing features you asked for. We do not transfer it except as needed to provide those features, to comply with law, or as part of a merger or acquisition with notice. We do not use it for advertising. We do not let humans read it unless you give your consent, it is needed for security or legal reasons, or it has been aggregated and anonymized. We do not use Google or Microsoft user data to train or improve generalized AI or machine-learning models, whether ours or a third party's.

• Respond to inquiries and schedule meetings.
• Provide, operate, secure, and support the Services, including AI features.
• Sign you in to the client portal by emailing a sign-in link.
• Show your organization's question-and-answer history on its dashboard.
• Apply rate limits and daily usage caps to keep the Services stable and prevent abuse.
• Bill and manage accounts, including processing payments through Stripe and collecting sales tax where required.
• Prevent spam, fraud, and abuse, and enforce our terms.
• Send service notices. We send marketing emails only where permitted by law, and you can opt out at any time.
• Comply with legal obligations.

We do not sell personal information. We do not share it for cross-context behavioral advertising.

Some features use third-party AI model providers to generate outputs, including xAI (SpaceXAI LLC). When you use an AI feature, the relevant Customer Content is sent to the provider to generate a response.

• We use xAI through a zero-data-retention configuration. Under it, xAI does not store prompts or outputs on disk after the request is processed.
• We do not use your Customer Content to train AI models. We do not allow our AI providers to train on it.
• AI outputs can be wrong. You are responsible for reviewing them before you rely on them. See our Customer Terms.
• We may add or change AI providers. We will update the subprocessor list below when we do.

Client portal and Knowledge Assistant documents

When your organization uploads documents to the client portal, we store them using Vercel Blob (file storage) and a Neon Postgres database. To answer questions, relevant document content is sent to xAI for processing under zero data retention, which means xAI does not retain the prompts or outputs. Each client's data is logically separated from other clients' data within our shared infrastructure, and each client's users can access only their own organization's data.

For documents and other Customer Content that a client uploads, we act as a processor (service provider) for that client. The client decides what to upload and controls its use, and we process it only to provide the Services to that client. Questions about personal information in a client's documents should go to that client. Our processing commitments to clients are set out in our Customer Terms, and we will provide a data processing addendum on request.

Clients must not upload payment card data, Social Security numbers, health information, student records, or privileged or confidential legal case files. See Section 10.

We share information with these providers only as needed to run the Site and Services:

• Vercel Inc.: website and application hosting, file storage for client portal documents (Vercel Blob), and analytics (Vercel Analytics).
• Resend: delivers contact-form and transactional email, including client portal sign-in links.
• Cloudflare, Inc. (Turnstile): spam and bot protection.
• Neon: Postgres database for application and client portal data.
• Upstash: rate limiting and usage caps.
• HubSpot, Inc.: meeting booking and customer relationship management.
• SpaceXAI LLC (xAI): AI model processing under zero data retention (xAI does not retain prompts or outputs).
• Microsoft and Google: only when you choose to sign in or connect your account.
• Stripe: payment processing, subscription billing, and sales tax collection. Receives your organization name and work email at checkout; card details are entered directly on Stripe.
• Analytics provider: Vercel (listed above). No other analytics provider is used.

We may also disclose information to comply with law or protect rights and safety, or in connection with a merger, acquisition, or sale of assets.

• Contact form and meeting data: kept as long as needed to respond and maintain the business relationship. Deleted 24 months after last contact unless you become a customer.
• Account data and Customer Content: kept while your account is active. After the account closes, you can export your Customer Content for 30 days. We then delete it within the next 30 days (no more than 60 days after the account closes), except where the law requires us to keep it. Deleted data is purged from backups within a further 30 days.
• Client portal documents and question-and-answer logs: treated as Customer Content and kept and deleted on the same schedule as Account data and Customer Content above. xAI does not retain them under zero data retention. During the subscription, a client can ask us to delete individual documents or question-and-answer logs by emailing hello@hawkmanaged.ai, and we will delete them promptly.
• OAuth tokens: deleted when you disconnect or revoke access, or when the account closes.
• Account and billing records (such as invoices, payment records, and the account's business name and billing contact): kept 7 years for tax and accounting.
• Security logs: 90 days.
• Rate-limit and usage-cap records: up to 90 days.

You can ask to access, correct, download, or delete your personal information by emailing hello@hawkmanaged.ai. We will verify your request and respond within 45 days. If we need more time, we may extend this by up to 45 more days and will tell you why. Connecticut residents have rights under the Connecticut Data Privacy Act where it applies, including the right to appeal a denied request by replying to our decision. Residents of other states may have similar rights. We will not discriminate against you for exercising these rights. If we process data for a business customer, we may direct you to that customer. This includes documents uploaded to the client portal, where we act as the client's processor (service provider).

We use reasonable administrative, technical, and physical safeguards. These include encryption in transit, encrypted storage of tokens, least-privilege access, and vendor review. Client portal sign-in uses one-time links sent by email, each client's data is kept separate, and rate limits and daily usage caps help prevent abuse. No method of transmission or storage is completely secure. If we confirm a security breach affecting a business customer's data, we will notify that customer without undue delay and within 72 hours of confirmation. We will also notify affected individuals and authorities as required by law.

The Site and Services are for businesses and are not directed to children. They may not be used by anyone under 16, and we do not knowingly collect information from children under 16. If you believe a child has given us information, contact us and we will delete it.

Please do not submit health information, protected health information (PHI), Social Security numbers, financial account numbers, or other sensitive data through the Services. The Services are not designed for such data. In particular, do not upload payment card data, Social Security numbers, health information, student records, or privileged or confidential legal case files to the client portal. Law firms and other professional clients are responsible for deciding whether uploading a document is consistent with their confidentiality obligations.

We are based in the United States, and data is processed in the United States. The Services are intended only for businesses in the United States. We do not offer the Services to, or target, people in the European Union, the United Kingdom, or Canada.

We may update this Policy. We will post the new version with a new date and notify account holders of material changes by email at least 30 days before they take effect.

Hawk Managed AI, PO Box 15, Colchester, CT 06415, USA. hello@hawkmanaged.ai.