Privacy Policy

Hinzel is a product of Optimus Foundry Inc. ("Optimus Foundry", "we", "us"), a corporation incorporated under the Canada Business Corporations Act (corporation number 1828053-3), with its registered office in Ottawa, Ontario, Canada.

This policy explains how we handle personal information when you visit hinzel.ai, use the Hinzel app, or contact us. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws that apply to you.

1. Two roles: our data and your organization's data

We decide how we use account, billing, website and support information. For this information we are responsible under privacy law.

We process for you the content your organization puts into Hinzel. This includes messages, tickets, files, records, agent memory and data from tools you connect. Your organization decides what goes in and who can see it. We use this "customer content" only to run Hinzel for your organization, as set out in our Terms of Service. If someone asks us about customer content, we refer them to that organization.

2. Information we collect

Information you give us

• Account details: name, email address, organization and role.
• Sign-in details: if you sign in with Google, we receive your name and email address from Google.
• Billing details: billing contact and address. Stripe processes card details. We never see or store full card numbers.
• Messages you send us, such as early-access requests and support questions.

Customer content

• Conversations with Hinzel agents in web chat, Slack, GitHub, Jira, Zendesk and other channels your organization connects.
• Content agents read or write in connected tools, files you attach, and records and memory your projects keep.
• Credentials for connected accounts. We encrypt these, and agents never see them.

Information collected automatically

• Website visits. When you visit hinzel.ai, our host Cloudflare records your IP address, browser user agent, referring page, page path, approximate city and country, and network provider. We use this to count visits and stop abuse.
• App activity. When you use the app, we record actions, rule decisions, approvals and errors. Our audit trail and safety features depend on these records.
• Error reports. When the app fails, Sentry receives a technical report. It can include your IP address, browser details and the page you were on.

3. Cookies and browser storage

hinzel.ai sets no cookies and uses no advertising or cross-site tracking. It saves your light or dark theme choice in your browser's local storage. The site loads fonts from Google Fonts, which sends your IP address to Google.

The Hinzel app uses cookies only to keep you signed in and to secure your session. The app needs these cookies to work.

4. How we use information

• Provide, secure and support Hinzel, including running agents, enforcing your rules and keeping the audit trail.
• Create and manage accounts, and bill for the service.
• Send service messages, such as sign-in links, approval requests, security notices and changes to these terms.
• Find and fix errors, prevent abuse, and keep the service reliable.
• Measure use of the product with analytics that leave out personal fields.
• Meet legal obligations and enforce our terms.

We send marketing email only if you agree to receive it. Every marketing email names us and has an unsubscribe link, as Canada's Anti-Spam Legislation (CASL) requires.

5. AI models and customer content

Hinzel agents run on Claude models from Anthropic. To answer a request, we send the relevant customer content to Anthropic for processing. Under our agreement with Anthropic, it does not use this content to train its models.

We do not use customer content to train any model, and we do not sell it.

6. How we share information

We do not sell or rent personal information. We share it only:

• With service providers that run parts of Hinzel for us, under contracts that limit their use of the data. See our subprocessors list.
• With tools your organization connects, when an agent acts in them on your organization's instructions.
• Inside your organization, according to the roles and project settings your administrators choose.
• If the law requires it, or to protect the rights, safety or property of our users, the public or us.
• With a buyer or successor if we merge, are acquired or sell assets. This policy continues to apply to the information.

7. Where we store information

We store and process information in the United States, mainly in Amazon Web Services (us-east-1). Some service providers process information in other countries. While information is outside Canada, the laws of that country apply to it, and its courts, police or security agencies can lawfully access it.

8. How long we keep information

We keep each kind of customer content for a fixed period. See the table on our security page. For example, conversation text is removed after 180 days. Organizations on some plans can extend some of these periods.

• Website visit records: about 3 months.
• Account information: while the account is open, then deleted when the organization closes.
• Billing records: as long as tax and accounting law requires, usually 7 years.

When an organization owner closes the organization, we stop its agents, cancel its billing and delete its data.

9. How we protect information

We encrypt connection secrets and sign-in tokens with keys managed in AWS KMS. Files and transcripts live in private, encrypted storage. Each agent run works in its own isolated workspace, and agents reach your tools only through our gateway. No system is fully secure, so if a breach creates a real risk of significant harm, we notify you and the Privacy Commissioner of Canada.

10. Your rights

You can ask us to:

• Tell you what personal information we hold about you, and how we use and share it.
• Correct information that is wrong or incomplete.
• Delete your information, unless the law requires us to keep it.
• Stop sending you marketing email. Use the unsubscribe link in any marketing email.
• Withdraw your consent, subject to legal or contract limits. This can stop us from providing the service.

We reply within 30 days. If your request is about customer content, we pass it to the organization that controls that content.

If you are in the European Economic Area, the United Kingdom, Quebec or a US state with a privacy law, you may have further rights under your local law. Contact us and we will help you use them.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

11. Children

Hinzel is a service for businesses. It is not for children, and we do not knowingly collect information from anyone under 18.

12. Changes to this policy

If we change this policy, we post the new version here and update the date at the top. If a change is significant, we also tell account owners by email before it takes effect.

13. Contact us

Our Privacy Officer is responsible for this policy. For questions, requests or complaints, email [email protected].

Optimus Foundry Inc.
Attention: Privacy Officer
Ottawa, Ontario, Canada