This policy explains what personal data hlix processes, why, who receives it, how long we keep it, and what you can do about it. We keep it short and plain. If anything is unclear, write to support@hlix.ai.
1. Who we are
hlix is operated by Hlix, Inc., a Delaware corporation, 28 Geary Street, Suite 650, San Francisco, CA 94108, United States ("hlix", "we", "us").
We are the controller for your account data, billing data, logs and our website. For the content your workspace puts into hlix, the business that owns the workspace is the controller and we process it on its behalf. Business customers can get our Data Processing Addendum.
Our EU representative is Hlix UG (haftungsbeschränkt), Karl-Kessler-Str. 1, 85551 Kirchheim b. München, Bavaria, Germany.
2. What this policy covers
It covers our website, the hlix dashboard, the desktop app, the command-line tool, our API, and the hlix connector for AI assistants. It does not cover services you connect to hlix. Their own policies apply to them.
3. What we collect
Account data
- Your name, email address and profile picture.
- How you sign in: a password (stored only as a hash), a one-time email code, a Google or GitHub sign-in, or a passkey.
- Your sessions, including the IP address and browser or device they came from.
- Your workspaces, roles and invitations. When you invite someone, we store their email address.
Workspace content
- Projects, briefs, cycles, tasks, comments and mentions.
- Chat messages with hlix and with your team, and the replies hlix writes.
- Code, repository contents, files, previews and the work our agents produce.
- Screenshots and screen recordings our automated checks take of your app's preview.
- Environment variables and secrets you store for a project.
Connected services
When you connect a code host, an issue tracker, a chat app or your own AI model account, we store the access token or key it gives us.
Usage and billing
- Which AI models ran for your workspace, how many tokens they used, and what that cost.
- Your plan and subscription status. Our payment provider collects your payment details. We do not store full card numbers.
Presence
While you have a project open, your teammates can see that you are there, which tab or file you are viewing, and when you are typing.
Audit and technical logs
- An audit log of actions in your workspace: who did what, when, from which IP address and browser.
- Technical logs of agent runs and errors, used to operate and fix the service.
Support
What you send us when you email support.
Our website
Our hosting provider processes your IP address and browser details to deliver the site.
4. Why we use it, and our legal bases
- To provide hlix, including running AI agents on your work: performance of our contract with you (GDPR Art. 6(1)(b)).
- To send service email, such as sign-in codes, invitations and mentions: contract (Art. 6(1)(b)).
- To bill you and keep financial records: contract and legal obligation (Art. 6(1)(b) and (c)).
- To keep hlix secure, prevent abuse, keep the audit log and fix problems: our legitimate interest in a safe, working service (Art. 6(1)(f)).
- To answer you when you contact us: legitimate interest (Art. 6(1)(f)).
We do not send marketing email without your consent.
5. AI processing
hlix is an AI service. To do the work you ask for, we send the relevant workspace content to AI models, mostly through a model gateway. That includes your instructions, code, files and chat.
- hlix does not use your content to train AI models.
- The model providers process that data only to run the models, under their own terms.
- If you connect your own AI model account, those requests go to that provider under your agreement with it.
- hlix can suggest working rules for your workspace from finished work. They stay in your workspace, and a workspace owner or admin must approve them before they apply.
- We make no decisions about you by automated means that have legal or similarly significant effects.
6. Connecting an AI assistant
You can connect an AI assistant or code editor to hlix. It then acts as you, in the workspace you choose.
- Read access lets it see your projects, cycles, tasks and their status.
- Write access also lets it create and change items, for example create a task. Write access is off unless you grant it.
- We receive only the requests the assistant sends to hlix. We do not receive your conversation with the assistant.
- What the assistant does with the answers is covered by its provider's policy, not this one.
- To disconnect, remove hlix in the assistant's settings, or revoke its key under Developer Tools in the dashboard.
7. Who receives your data
We share personal data only with the service providers we need to run hlix, under contracts that limit their use of it:
- Cloud hosting, databases and file storage, in the EU.
- Isolated environments that run your project's code, in the EU.
- AI model providers, reached through a model gateway, and a text embedding provider for search and memory.
- A web page reading service, when hlix reads a link.
- Email delivery.
- Payment processing.
- Website hosting and content delivery.
We also share data:
- With services you connect, when you tell hlix to use them.
- With the people in your workspace, including clients you invite to a project, as your workspace settings allow.
- With authorities, when the law requires it.
- With a buyer or successor, if hlix is sold or merged. This policy keeps applying to your data.
Our Subprocessors page lists these by category, purpose and location. The named list is available on request at support@hlix.ai.
We do not sell your personal information. We do not share it for cross-context behavioral advertising.
8. Where your data is stored
We store your account data and workspace content in the EU. That includes our database, your files and the environments that run your code.
Some providers, such as AI model providers, email delivery and payment processing, may process data outside the EU, including in the United States. hlix itself is a US company. When data leaves the EU or UK, we protect it with the Standard Contractual Clauses.
9. How long we keep it
- Account data: while your account exists. After you ask us to delete it, within 30 days, unless the law requires us to keep something.
- Workspace content and chat history: until you or your workspace delete it, or the workspace is closed. Chat history does not expire on its own.
- Code environments: each one is short-lived. We remove it when its job ends, or 15 minutes after an open terminal or desktop is last used. A project's saved environment is removed when you delete the project. The project's files and history stay.
- Audit log: 24 months. Entries cannot be edited or deleted before then.
- Activity feed: 6 months.
- Technical logs and agent run traces: 30 days.
- Records of finished agent runs: 90 days.
- Presence: about an hour after you leave a project.
- Billing records: as long as tax law requires, up to 7 years.
- Backups: rolling backups are kept for up to 30 days, then deleted.
10. How we protect it
- We host your data in the EU.
- All traffic to hlix is encrypted in transit with HTTPS.
- Secrets, access tokens and your own AI model keys are encrypted with AES-GCM before we store them.
- Code runs in isolated environments, never on the servers that hold your account data.
- Agents get credentials scoped to one project. We revoke them when the task ends.
- The audit log is append-only and hash-chained, so changes to it can be detected.
- Access inside a workspace follows the roles you assign.
Our Security page has more detail. No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
11. Your rights
If you are in the EU, the EEA or the UK, you have the right to:
- access your personal data and get a copy of it;
- correct it;
- have it deleted;
- restrict or object to how we use it;
- receive it in a portable format;
- withdraw consent at any time, where we rely on consent;
- complain to your local data protection authority.
To use a right, email support@hlix.ai from the address on your account. We answer within one month.
- Delete your account: email us. We delete it and tell you when it is done.
- Delete a project: workspace owners and admins can do this in the dashboard.
- Get your files: download them from the dashboard, or pull them with the hlix command-line tool.
If your data is in a workspace another business controls, we pass your request to that business and help it respond.
12. US state privacy rights
If you live in California or another US state with a privacy law, this section applies to you too.
- What we collect: identifiers (name, email, IP address), commercial information (plan and billing), internet activity (sessions, logs, usage), and the content you put into hlix. Section 3 has the detail.
- Sources: you, your workspace, and the services you connect.
- Why: the purposes in section 4.
- Who receives it: the categories in section 7.
- Sale and sharing: we do not sell or share personal information, and have not in the past 12 months. We use no advertising trackers.
- Sensitive information: we use account credentials only to sign you in and keep your account secure.
You have the right to know, access, correct and delete your personal information, and to not be treated differently for using these rights. You can use them yourself or through an authorized agent, by emailing support@hlix.ai. We verify your identity by confirming control of the email address on your account.
13. Cookies and browser storage
hlix uses only the cookies it needs: to keep you signed in, and to remember whether the dashboard sidebar is open. Our website sets no cookies of its own. We use no analytics or advertising trackers. Our Cookie Policy lists every cookie.
14. Children
hlix is a business service. It is not meant for anyone under 18. We do not knowingly collect data from children. If you think a child has given us data, email us and we will delete it.
15. Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change matters, we will tell you by email or in the dashboard before it takes effect.
16. Contact
Questions and requests: support@hlix.ai.
Hlix, Inc., 28 Geary Street, Suite 650, San Francisco, CA 94108, United States.