Hal — Privacy Policy
Version 2026-10-31 · Pedro Nobre Guedes Unipessoal Lda (PT518628507), Portugal · hal@hirehal.ai
Controller for the owner's own data and for the service: Pedro Nobre Guedes Unipessoal Lda, Portugal, hal@hirehal.ai. For the business's clients' data, the business is the controller and we are its processor (Section 4).
1. What we collect and why
- Owners and staff: phone number, first name, business name, country and language (to run the service and verify the account); email, only if you give one (used only to confirm rare, sensitive changes and to alert you); the conversation with Hal (to do what you ask and to remember what you told it); connected-service tokens (to act in those services), stored encrypted and never shown to anyone.
- Clients of the business: phone number (or the address on the channel they wrote on), name if given, bookings, notes the client or the business gives Hal (which may include health details such as allergies, kept only for the provider), language. Collected when a client writes to the business through a channel Hal answers.
- Technical: webhook metadata from messaging providers (message ids, delivery status), request logs for security, and the cost of each AI call per business.
2. Legal bases
Contract (providing Hal to the business); legitimate interests (security, abuse prevention, service improvement from aggregate, non-personal metrics); consent where required (marketing to owners, which we do not do today; health details given voluntarily by clients).
3. AI processing
Hal's replies are generated by a large language model operated by Anthropic under a commercial agreement that forbids training on our data. We never train models on your data or your clients' data, and we never use it for anything but providing Hal. Hal identifies itself as an AI on first contact with every client and whenever asked.
4. The business's clients: processor terms
For client data, the business decides why and how it is used; we process it only on the business's instructions as given through Hal, under these terms, which constitute the data-processing agreement: subject matter and duration (the service, while the business uses Hal), nature and purpose (receptionist tasks), categories (contact details, bookings, notes, language), obligations (confidentiality, security as in Section 6, subprocessors as in Section 5, assistance with data-subject requests, deletion or return at the end, audit information on request).
5. Subprocessors
Cloudflare (hosting, storage, email sending; EU/US); Anthropic (language model; US); Twilio (WhatsApp, SMS and verification codes; US); Sendblue (iMessage line; US); Google (calendar, only when the business connects one; US). Transfers outside the EEA rely on the EU-US Data Privacy Framework where the provider is certified and otherwise on standard contractual clauses. We tell businesses 30 days before adding a subprocessor.
6. Security
Encryption in transit and at rest; connected-service tokens sealed with keys separate from the data; one isolated database per business; access to production limited to the founder and logged; dangerous actions require a second confirmation on the owner's email and are held before taking effect; no secret is ever returned to the chat. See the public summary of our threat model on request.
7. Retention
Conversations: the last 200 messages per person, and 180 days of audit history; bookings: 180 days after the appointment, then archived summaries; costs: 400 days; the whole business: deleted within 30 days of the business ending the service or asking for deletion, except where a legal obligation requires longer.
8. Your rights
Access, rectification, erasure, restriction, portability and objection, by message to Hal ("export my data", "delete my data") or by email. Owners' requests are confirmed on the owner's email before deletion. Clients may ask the business, or us, and we help the business respond within one month. Complaints: Comissão Nacional de Proteção de Dados (Portugal) or your local authority.
9. Children
Hal is for businesses and their adult clients; we do not knowingly process data of children under 16.
10. Cookies
The site sets one cookie, only during sign-up: a secure, HTTP-only session cookie on /hire that expires after 30 minutes and is needed for the sign-up to work. No analytics, advertising or tracking cookies, and the site loads nothing from third parties. If that ever changes, we ask before setting anything that isn't strictly necessary.
11. Changes
We notify owners by message 30 days before material changes.