Privacy Policy

Last updated: March 20, 2026

Hi Atai ("we", "us", "our") is operated by Studio HUAI, based in Denmark. We are committed to protecting your privacy and personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Danish data protection law.

1. Data controller

Studio HUAI is the data controller for personal data collected through Hi Atai. Contact us at hello@hiatai.com for any privacy-related inquiries.

2. What data we collect

Account data

When you create an account, we collect your email address and password (hashed — we never store plaintext passwords). If you sign up via the waitlist, we also collect your name.

Profile data (optional)

You may choose to provide additional information such as your first name, birthday, city, occupation, hobbies, living situation, children, and pets. This data is used exclusively to personalise your conversations with AI contacts.

Conversation data

Messages you send and receive within Hi Atai are stored in your browser's local storage on your device, and synchronised to our database (hosted on Supabase) to enable access across devices. Conversation data is associated with your account and is not shared with third parties.

Contact photos

If you upload a photo for a custom contact, it is stored as a base64 data string in your browser's local storage and in our database. Photos are used solely for AI-generated situation images within your conversations. We run an automated age-verification check on uploaded photos to prevent misuse involving minors.

Payment data

Payments are processed by Stripe. We do not store your credit card number, CVV, or full payment details. Stripe handles all payment data in accordance with PCI DSS standards. We receive and store your subscription status, tier, and transaction history.

Technical data

We collect standard web server logs including IP address, browser type, and access timestamps for security and rate-limiting purposes. We do not use tracking cookies, analytics scripts, or advertising trackers.

3. How we use your data

We use your data for the following purposes:

• Providing and operating the Hi Atai service
• Personalising AI conversations based on your profile
• Processing payments and managing subscriptions
• Protecting the service from abuse (rate limiting, age verification)
• Communicating with you about your account (e.g., approval notifications)

We do not use your data for advertising, profiling for third parties, or automated decision-making that produces legal effects.

4. Legal basis for processing (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the service you signed up for.
• Legitimate interest (Art. 6(1)(f)): Security measures, fraud prevention, and service improvement.
• Consent (Art. 6(1)(a)): Optional profile data you choose to provide. You can withdraw consent at any time by deleting your profile data in Settings.

5. Third-party processors

We use the following third-party services to operate Hi Atai:

• Supabase (database and authentication) — hosted in EU. Privacy policy
• Anthropic (Claude AI models) — processes conversation text to generate responses. Messages are sent to Anthropic's API and processed in accordance with their privacy policy. Anthropic does not use API inputs to train models.
• Groq (Llama AI models) — used for certain conversation types. Privacy policy
• Fal.ai (image generation) — processes photos to generate AI images. Privacy policy
• Stripe (payments) — processes payment transactions. Privacy policy
• Simply.com (web hosting) — hosted in Denmark.

6. Data transfers outside the EU

Some of our processors (Anthropic, Groq, Fal.ai, Stripe) are based in the United States. Data transfers to these processors are governed by Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR Chapter V.

7. Data retention

• Account data: Retained for the lifetime of your account. Deleted within 30 days of account deletion.
• Conversation data: Messages older than 30 days are automatically trimmed (only the most recent 20 messages per contact are retained). All data is deleted when you delete your account.
• Payment records: Retained for the legally required period (typically 5 years for accounting purposes under Danish law).
• Server logs: Automatically deleted after 90 days.

8. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of all data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate data via the Settings page in the app.
• Right to erasure (Art. 17): Delete all your data using the "Delete all my data" button in Settings, or by contacting us.
• Right to data portability (Art. 20): Request your data in a machine-readable format.
• Right to restrict processing (Art. 18): Request that we limit how we use your data.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at hello@hiatai.com. We will respond within 30 days.

9. Complaint to supervisory authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet): www.datatilsynet.dk.

10. Children

Hi Atai is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors. If we discover that a user is under 18, their account will be terminated and all associated data deleted.

11. Changes to this policy

We may update this privacy policy from time to time. Significant changes will be communicated via the app or email. The "last updated" date at the top of this page indicates when the policy was last revised.

12. Contact

For questions about this privacy policy or your personal data:

Studio HUAI
Email: hello@hiatai.com
Denmark