Privacy Policy

1. Who we are

The data controller is 0x0800 SRL, Chaussée Brunehault 702, 4042 Herstal, Belgium (enterprise number BE 1021.845.609). For any question about your data, write to privacy@hygur.ai.

2. What this policy covers

It covers the public website at hygur.ai, Hygur Cloud, our optional managed hosting of Hygur Server, and the Hygur apps for iPhone, iPad and Mac when you sign them in to Hygur Cloud: connected this way, the apps send what you type, dictate or import to your Hygur Cloud space. It does not cover the app used on its own or a self-hosted Server: those run on your own machine or infrastructure, index your data locally, and send no personal data to us. If you only use the app locally or self-host the Server, your documents, mail, notes and prompts never reach us.

3. Data we process

Public website. The site is static, needs no account, and runs no advertising, analytics or social trackers; fonts are self-hosted. Our hosting provider records the technical data needed to serve pages — IP address, requested URL, timestamp and user agent — in server logs, kept for a limited period for security and delivery, and not used to profile you.

Hygur Cloud (if you subscribe). We process:

• your account email, collected through Stripe at checkout, and the passkey credential that identifies your device;
• the content you connect or import — extracted text from your mail and files, your notes and prompts — and the search vectors and indexes derived from it. This is the sensitive core of the service;
• usage counters (token counts) for billing and quotas, and minimal operational and security logs;
• if you use the Hygur app for iPhone, iPad or Mac and turn on notifications: an Apple push token for that device, used only to deliver Hygur's notifications. Notifications never contain what you wrote.

On your device. In the Hygur apps, dictation is transcribed on the device and the audio is never sent; the camera is used only to read a sign-in QR code, on the device; your sign-in credentials stay in the device's keychain. The apps contain no advertising, analytics or tracking code.

Payment is handled by Stripe; we never store your card details.

4. Purposes and legal bases

• Providing the service (your knowledge assistant): performance of our contract with you.
• Security, abuse prevention and quota enforcement: our legitimate interest.
• Billing and accounting: compliance with a legal obligation and performance of the contract.

We do not use your content to train any model, and we do not sell or share it.

5. Sub-processors and international transfers

We rely on a small number of processors:

• Infomaniak (Switzerland / EU) — AI inference, storage and encrypted backups for Hygur Cloud. Your content is processed under a no-training commitment.
• Stripe (EU / US) — payment processing. We hold no card data.
• Hetzner Online GmbH (Germany, EU) — hosting of the instances.
• Apple (EU / US): delivery of push notifications to the Hygur apps. Apple receives the device's push token and the notification, which never contains what you wrote.

Transfers outside the EU are covered: Switzerland benefits from a European Commission adequacy decision, and transfers to Stripe and Apple rely on the Standard Contractual Clauses. The current list of sub-processors is kept in our records and updated as it changes.

6. Security and encryption

Each customer's space is encrypted at rest with SQLCipher under its own dedicated encryption key. Spaces are isolated from one another, with separate keys. Sign-in uses passkeys, so we store no passwords. Backups are encrypted and kept off-site.

7. Retention and deletion

We keep your content while your account is active. When you cancel, your space and its encryption key are kept for 30 days, so that you can resubscribe without losing anything. After those 30 days the encryption key is destroyed and the space is purged: the data is then permanently lost. Encrypted backups remain in the backup repository for up to 35 days, after which they are deleted. You can export the content you created in Hygur at any time.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing. To exercise these rights, write to privacy@hygur.ai; we respond within 30 days. You may also lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit).

9. Cookies

The service uses only essential session and authentication cookies. No advertising, analytics or tracking cookies are set, so no consent banner is required.

10. Changes and contact

We may update this policy as the service evolves; the effective date is shown above, and we will notify you of any substantial change. This is version 1.2.0. For any question, write to privacy@hygur.ai.