Privacy Policy

1. Overview

This Privacy Policy explains what personal data Haki ("Haki", "we", "us") collects when you use the console at gethaki.space and the API at api.gethaki.space, how we use it, and the rights you have over it. It applies to the hosted Haki Cloud service. If you run Haki self-hosted (docker compose up -d), none of your data ever reaches our servers and this policy does not apply to that deployment.

2. Information We Collect

• Account information — when you sign up through Clerk, our authentication provider, we receive your email address and any profile details you choose to provide. Clerk manages your password and login credentials directly; Haki never sees or stores your password.
• Billing information — your subscription plan, credit balance and billing status. Payment details themselves (card number, mobile money account, etc.) are collected and processed entirely by GeniusPay, our payment processor — see “Payment Information” below.
• Memory data submitted through the API — when your application calls POST /v1/capture (or related endpoints) to store memories, you're submitting data about your own end users, such as the conversation turns of your AI agent's users. This data is yours (or your end users'), not ours: Haki processes it as a data processor acting on your instructions, not as the owner of that data. See “Your End Users' Data” below.
• Usage and technical data — API request logs, timestamps, IP addresses and similar metadata, used for rate limiting, abuse prevention, debugging and billing accuracy.

3. How We Use Information

• To operate the Service: authenticate you, run memory capture, consolidation, context assembly and forgetting, and serve the console.
• For billing: calculate credit usage and process subscriptions and top-ups through GeniusPay.
• For support: respond to requests sent to contact@gethaki.space.
• For security: detect abuse, enforce per-project isolation, and investigate incidents.
• For legal compliance: respond to lawful requests and enforce our Terms of Service.

4. Data Storage & Security

All application data — accounts, credit ledgers, and the memory data you submit — is stored in a PostgreSQL database, hosted via Supabase.

Project-level isolation is enforced at the database layer with PostgreSQL Row-Level Security, not only in application code: a request scoped to one project cannot read another project's data even if application logic had a bug. Each API key is bound to exactly one project; requesting a resource outside that project returns 403 forbidden_scope without revealing whether the resource exists.

5. Your End Users' Data

If you use Haki to give your own AI agent a memory, the facts and events you submit through the API typically describe your end users, not you. In that relationship, you're the data controller and Haki is the data processor: you're responsible for having a lawful basis (consent, contract, etc.) to collect and submit that data to us, and for honoring your own end users' rights — including instructing Haki, via POST /v1/forget, when one of them asks to be forgotten.

Haki does not inspect the content of the memories you submit for any purpose other than operating the Service (extraction, consolidation, retrieval) and, where applicable, enforcing our Acceptable Use policy.

6. Third-Party Processors

We rely on a small number of subprocessors to run Haki:

• Clerk — authentication and account management.
• Supabase — PostgreSQL database hosting.
• GeniusPay — payment processing (see below).

We choose subprocessors that meet the security expectations of the data they handle, and we don't add new categories of subprocessor without updating this page.

7. Payment Information

All payment collection is handled by GeniusPay, a West African payment processor. When you subscribe to a Cloud plan or top up credits, GeniusPay collects the payment details it needs (card, mobile money account, phone number) directly — Haki's servers never receive, process or store your card number or equivalent payment credentials. We only receive confirmation of payment success or failure and the identifiers needed to reconcile it with your account. All billing is denominated in XOF (West African CFA franc), regardless of any other currency shown for reference on the pricing page.

8. No Sale of Personal Data

We do not sell, rent or trade your personal data — or the data you submit about your end users — to third parties for their own marketing or advertising purposes. Ever.

9. Data Retention & Deletion

Account data is retained for as long as your account is active, plus a reasonable period afterward for legal and accounting purposes (e.g., billing records).

Memory data you submit is retained until you delete it. Haki implements a real erasure mechanism: POST /v1/forget lets you disable (a reversible, ledger-tracked state change) or delete (permanent erasure) a single fact or an entire subject, scoped to a project. Deletion propagates to the derived facts, embeddings, events and traces built from that data, and every call is journaled — a timestamped receipt is written and returned so you have a record that the request was honored.

To request deletion of your account itself, contact us at contact@gethaki.space.

10. Your Rights

Depending on where you're located, you may have rights to access, correct, export or delete your personal data, or to object to or restrict certain processing. To exercise any of these rights, email contact@gethaki.space — we'll respond as quickly as we can.

11. International Data Transfers

Haki's infrastructure providers (Supabase, Clerk, GeniusPay) may process or store data in countries other than your own. We rely on each provider's own safeguards for cross-border transfers where applicable.

12. Children's Privacy

Haki is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy as the product evolves. Material changes will be reflected by updating the "Last updated" date at the top of this page; where required, we'll notify account holders directly.

14. Contact Us

Questions about this policy, or requests related to your personal data, can be sent to contact@gethaki.space.