Legal
Privacy Policy
Last updated: March 2026
Data Collection
We collect information you provide directly to us when you register for an account, request a demo, or contact us. This includes your name, work email address, company name, and any information you include in your message. When you use the Hesper AI API, we collect API usage metadata including timestamps, request IDs, fraud scores, and structured findings. We do not collect or store the documents you submit for analysis.
Data Use
We use the information we collect to provide, maintain, and improve our services; to process transactions and send related information; to send technical notices, updates, security alerts, and support messages; to respond to your comments and questions; and to monitor and analyse usage patterns to improve the service. We do not sell your personal data to third parties. We do not use your documents to train our models.
Data Retention
We do not store submitted documents beyond the analysis request. Documents are loaded into memory, analyzed, and immediately discarded. No document data is written to disk, logged, or retained in any storage system. Analysis metadata (fraud score, findings, timestamps, request IDs) is retained for 90 days to support your audit and compliance workflows, after which it is permanently deleted. Account data is retained for the duration of your account and deleted within 30 days of account termination upon request.
Third Parties
We use a limited set of third-party service providers to operate our service, including cloud infrastructure (AWS, with data residency configurable to EU regions), analytics, and customer communication tools. All third parties are bound by appropriate data processing agreements. We do not share your data with third parties for marketing purposes. In the event of a business transfer, your data may be transferred as part of the transaction, and we will notify affected customers.
Security
We implement industry-standard security measures to protect your data, including encryption in transit (TLS 1.2+) and at rest (AES-256), strict access controls, and regular security audits. We are pursuing SOC 2 Type II certification and will notify customers of the outcome. If you discover a security vulnerability, please disclose it responsibly to security@hesper.ai.
Your Rights
If you are located in the European Economic Area, United Kingdom, or certain other jurisdictions, you have rights including: access to your personal data, correction of inaccurate data, deletion of your data, objection to or restriction of processing, and data portability. To exercise these rights, contact us at privacy@hesper.ai. We will respond within 30 days.
Contact
If you have questions about this privacy policy or our data practices, contact us at privacy@hesper.ai or by post at Hesper AI Ltd, 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. This policy was last updated in March 2026.