HipAI Inc. ("HipAI," "we," "our," or "us") provides an AI infrastructure platform that helps enterprises and developers improve the accuracy, reasoning, and reliability of large language models (LLMs) and AI agents. Our platform automatically generates a unified context graph from an organization's existing structured and unstructured data — enabling AI agents to query, reason, and plan against accurate structured knowledge rather than relying solely on vector embeddings.
This Privacy Policy describes how we collect, use, disclose, and protect personal data when businesses and developers ("Customers") and their authorized users ("Users") access and use our platform, API, website, and related services (collectively, the "Services").
HipAI operates in two distinct capacities with respect to personal data:
- As a data controller — when we collect and process personal data directly from Customers, Users, and website visitors for our own business purposes (e.g., account management, billing, communications).
- As a data processor — when we process personal data contained within data that Customers upload or connect to our platform as part of operating the Services ("Customer Data"). In that role, we act on Customer instructions and our processing is governed by our Data Processing Agreement (DPA).
Personal Data We Collect
1.1 Data We Collect as a Controller
When Customers and Users register for, access, or use our Services, we collect the following categories of personal data:
- Account and Identity Data — Names, email addresses, job titles, and company names of Customer administrators and Users; account credentials; billing contact information.
- Payment and Transaction Data — Billing address, invoicing information, and transaction records. Payment card data is processed directly by our third-party payment processor and is not stored by HipAI.
- Usage and Technical Data — IP addresses, browser type, operating system, and device identifiers; API access logs, feature usage, session timestamps, and query volumes; diagnostic data and error logs.
- Communications Data — Messages, inquiries, and support tickets you send us; records of calls or emails with our sales and support teams.
- Cookies and Tracking Data — Data collected through cookies and similar technologies on our website. See Section 7 for details.
1.2 Customer Data We Process as a Processor
When Customers use our platform, they may upload or connect data sources that contain personal data — for example, relational databases, internal documents, or text corpora. HipAI ingests this data solely to construct a context graph that improves AI agent performance.
Customers are responsible for ensuring they have a legal basis to submit any personal data to HipAI and for providing appropriate notices to their own end users.
How We Use Personal Data
2.1 Controller Purposes
- Providing the Services — Creating and managing accounts, authenticating users, delivering API access, and operating platform features.
- Billing and Contracts — Processing payments, issuing invoices, and managing Customer agreements.
- Customer Support — Responding to inquiries, diagnosing issues, and providing technical assistance.
- Product Improvement — Analyzing usage patterns, fixing bugs, and improving performance and features (using aggregated and de-identified data where possible).
- Security and Fraud Prevention — Monitoring for unauthorized access, abuse, and violations of our Terms of Service.
- Communications — Sending transactional messages and, where you have opted in or where permitted by law, product updates and marketing communications.
- Legal Compliance — Complying with applicable laws, responding to lawful requests, and protecting HipAI's legal rights.
2.2 Processor Purposes
When acting as a processor, HipAI uses Customer Data only to:
- Ingest and transform Customer-supplied data sources into a context graph;
- Enable AI agents and LLMs to query the context graph as a tool call;
- Allow Customers and authorized Users to refine and maintain the graph; and
- Perform any other processing activities specified in the applicable DPA or Customer agreement.
We do not use Customer Data to train our general-purpose models, build profiles of third parties, or for any purpose beyond providing the Services to the Customer that submitted the data.
Legal Bases for Processing (EEA, UK & Switzerland)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our processing of your personal data as a controller is based on the following legal grounds:
- Contract Performance (Art. 6(1)(b) GDPR) — Processing necessary to perform the contract with you or to take pre-contractual steps at your request.
- Legitimate Interests (Art. 6(1)(f) GDPR) — Processing necessary for our legitimate interests, including platform security, fraud prevention, analytics, and improving our Services, where these interests are not overridden by your rights.
- Legal Obligation (Art. 6(1)(c) GDPR) — Processing necessary to comply with a legal obligation.
- Consent (Art. 6(1)(a) GDPR) — Where you have given specific consent, for example for marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
When HipAI acts as a data processor on behalf of a Customer, the Customer is the data controller and is responsible for identifying the appropriate legal basis for that processing.
How We Share Personal Data
We share personal data only in the following limited circumstances:
- Service Providers — We engage trusted third-party vendors (subprocessors) for cloud infrastructure, payment processing, analytics, monitoring, and customer support. These vendors may only process personal data on our behalf and in accordance with our instructions..
- Customer Instructions — When acting as a processor, we share Customer Data only as directed by the Customer or as necessary to provide the Services.
- Business Transfers — If HipAI is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice of any such transfer and the choices available to you.
- Legal Requirements and Safety — We may disclose personal data if required by law or court order; to protect the safety of any person; to prevent fraud or security threats; or to protect HipAI's legal rights.
- With Your Consent — We may share personal data with third parties when you have given us prior consent to do so.
International Data Transfers
HipAI Inc. is headquartered in the United States. When we transfer personal data from the EEA, UK, or Switzerland to the US or other countries with different data protection standards, we rely on appropriate safeguards including:
- Standard Contractual Clauses (SCCs) approved by the European Commission for EEA transfers;
- The UK International Data Transfer Agreement (IDTA) or UK Addendum to SCCs for transfers from the United Kingdom; and
- Other transfer mechanisms recognized under applicable data protection law.
You may request a copy of the relevant transfer mechanisms by contacting us at [email protected].
Data Retention
We retain personal data we control for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. When your account is terminated or a contract expires, we will delete or anonymize your personal data within 30 days, except where longer retention is required by law.
Customer Data processed by HipAI as a processor is retained in accordance with the applicable Customer agreement and DPA. Customers may request deletion of their Customer Data at any time through the platform or by contacting us.
Cookies and Tracking Technologies
We use cookies and similar technologies on our website and platform. We use the following categories:
- Strictly Necessary — Required for the Services to function (e.g., authentication, session management). These cannot be disabled.
- Functional — Remember your preferences and settings to improve your experience.
- Analytics — Help us understand how visitors interact with our website so we can improve it, using aggregated and de-identified data.
- Marketing — Deliver relevant communications and measure campaign effectiveness. Used only where you have given consent or where permitted by applicable law.
Where required by law, we will request your consent before placing non-essential cookies. You can manage your preferences through our cookie consent tool or your browser settings.
Data Security
HipAI implements appropriate technical and organizational security measures, including:
- Encryption of data in transit (TLS) and at rest (AES-256 or equivalent);
- Role-based access controls and least-privilege principles;
- Regular security assessments, penetration testing, and vulnerability management;
- Incident detection and response procedures; and
- Employee security training and confidentiality obligations.
In the event of a personal data breach likely to result in a high risk to affected individuals, we will notify the relevant supervisory authorities and affected Customers in accordance with applicable law. To report a potential security vulnerability, contact [email protected].
Your Rights and Choices
9.1 EEA, UK, and Swiss Residents (GDPR and UK GDPR)
If you are located in the EEA, UK, or Switzerland, you have the following rights with respect to personal data for which HipAI acts as a controller:
- Right of Access — Request a copy of the personal data we hold about you.
- Right to Rectification — Request correction of inaccurate or incomplete personal data.
- Right to Erasure — Request deletion of your personal data, subject to certain exceptions.
- Right to Restriction — Request that we restrict how we use your data in certain circumstances.
- Right to Data Portability — Receive your personal data in a structured, machine-readable format.
- Right to Object — Object to processing based on legitimate interests or for direct marketing purposes.
- Rights Related to Automated Decision-Making — The right not to be subject to solely automated decisions that produce significant legal effects, where applicable.
To exercise these rights, contact us at [email protected]. We will respond within 30 days (extendable by a further two months for complex requests). You also have the right to lodge a complaint with your local supervisory authority — EEA authorities are listed at edpb.europa.eu; the UK authority is the Information Commissioner's Office.
9.2 U.S. Residents
- California (CCPA/CPRA) — Rights to know, delete, correct, and opt out of the sale or sharing of personal information. HipAI does not sell personal information. To exercise California rights, contact us at [email protected].
- Virginia, Colorado, Connecticut, Texas, and other states — Similar rights to access, delete, correct, and opt out of certain processing may apply. Contact us at [email protected].
We will not discriminate against you for exercising your privacy rights.
9.3 End Users of Customer Systems
If your personal data has been processed by HipAI as part of a Customer's data submission, please direct your privacy requests to that Customer directly. HipAI will cooperate with Customer instructions to assist in fulfilling end-user rights requests as required under our DPA.
Children's Privacy
Our Services are designed for use by businesses and professional developers and are not directed to children under the age of 18 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data directly from children. Customers are responsible for ensuring that any data they submit to HipAI complies with applicable laws regarding minors. If you believe we have inadvertently collected personal data from a child, please contact us at [email protected].
Third-Party Links and Integrations
Our website and platform may contain links to third-party websites or support integrations with third-party services and data sources. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access in connection with HipAI.
Data Processing Agreement
For Customers subject to the GDPR, UK GDPR, or other data protection laws that require a data processing agreement, HipAI offers a DPA that governs our processing of Customer Data as a processor. The DPA includes:
- A description of processing activities and purposes;
- Sub-processor obligations and a list of approved sub-processors;
- Data security obligations;
- Data breach notification procedures;
- International transfer mechanisms (including Standard Contractual Clauses); and
- Provisions for data subject rights assistance.
To request a DPA or for questions about our processor obligations, contact [email protected].
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify Customers by email (to the primary account contact) or through a prominent notice on our website or within the platform at least 30 days before the changes take effect. The "Last Updated" date at the top of this policy reflects when it was most recently revised.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: