Last updated: 30 October 2026
This page includes a translation for convenience. The English version controls if anything differs.
Hatchio AI is run by Breeznord Company (شركة بريزنورد), a company registered in the Kingdom of Saudi Arabia under commercial registration number 7055337617, at Al Fadail, Al Narjis District, Riyadh 13333, Saudi Arabia. Breeznord Company decides why and how your personal data is used, which makes it the controller of that data under Saudi Arabia’s Personal Data Protection Law and, for people in the European Union, under the GDPR. For anything about your data, write to support@hatchioai.com or use our contact form.
Your email address. Signing in works by sending a code to your email, so we need it to identify your account.
What you type. Your business idea, business name, answers to your team's questions, and any notes you send. This is the content the service works on. When you start a project we also ask where the business is based: its country, city and currency. We suggest an answer from what you wrote and from the country and city your connection resolves to (the lookup described below), you confirm or change it, and we keep only what you confirm, with the project. If your business already has a website, you can give us its address: we read up to five of its public pages, and its robots.txt and sitemap files, to review them for your project, keep what we found with the project, and delete it with the project.
What the service produces. The documents your AI team generates, and a record of which steps ran. If you use the standalone AI Pitch Deck Generator, we process the company details and business description you submit to draft slide content. If you use the AI Image Generator, we process your image prompt and store the generated image in our file storage so we can return it to you. If you use the AI CV Generator, the file you choose is opened in your browser and is not uploaded. When you confirm an AI run, the text of your CV, or the details you typed, passes through our servers to one of the AI providers named below to be written, reviewed or translated, and the result is returned to your browser. We do not store the CV text or the result: we keep only a record that the run happened, which provider handled it, what it cost and the credits charged. What you type on that page is held in your browser’s session storage, on your device, until you close the tab or choose to start again, so that signing in does not lose it. A CV usually contains personal data, so include only what you are content to have processed in this way. If you use the AI SEO Analysis, our servers request public pages of the website address you give (its home page, up to five more pages, robots.txt, the sitemap and llms.txt), identifying themselves as HatchioSEO, and first look the website’s name up through a public DNS service (Cloudflare’s, or Google’s if that one cannot be reached) to check that it is a public website; that lookup contains the website’s name and nothing about you. The titles, descriptions, headings and opening text of those pages are sent to one of the AI providers named below to write the content assessment. Public pages can contain personal data, such as names or contact details the website publishes; it is processed only to produce the report. We store the report (the address, what was read from the pages, the scores and the assessment) with your account so that you can open it again. You can delete a report at any time, and reports are deleted with your account. The address you type is held in your browser’s session storage until you close the tab, and a tick you put on a finding is kept in your browser’s local storage. If you publish a PDF or a video behind a QR code, the file is kept in our file storage and anyone who has the code or its link can open it. We count how many times it is opened each day, as a number only, with nothing about who opened it. The file is deleted when you delete it or your account. The prompt and relevant generation request are sent to the configured AI provider; do not include confidential personal data or information you are not entitled to submit.
Websites you publish. If you put your generated website online, its files (pages, styles, scripts and the pictures generated for it) are copied to our website-hosting provider so they can be served to the public, and we keep a log of publishing actions (publish, roll back, take offline, put back online, suspension) with their times. See “Websites you publish” below.
Usage records. Credits held, charged and returned, when, and on what, and what each piece of work cost us to run, so your balance is accurate, billing questions can be answered and prices follow real costs.
Domain search. When you search for a domain name, our server asks the public lookup service of the registry that runs each ending (for example Verisign for .com) whether the name is registered. The registry receives the name, from our server; it does not receive your network address or anything else about you. When the search is connected to Cloudflare Registrar, our server also sends the name to Cloudflare, Inc., which checks whether the name can be registered and at what price, and may suggest similar names; Cloudflare likewise receives the name only, not your network address or anything else about you. We keep the name and the registry’s answer for about a day, so that the same name is not asked about again and again; they are not linked to you. To limit how many searches one connection can make, we keep a one-way scrambled form of your network address with a count, for no more than two days; it cannot be turned back into an address. The links to registrars open their own websites, which have their own privacy policies.
Restaurant menus. If you build a restaurant menu, we store what you enter (the restaurant’s name and description, the dishes and their prices) and the photos or the PDF you upload, in our database and file storage. A draft is visible only to you. A menu you publish, with its photos or its PDF, is public: anyone with its address or its QR code can open it. Where your browser can, a photo is made smaller before it is uploaded, which also drops the hidden details a photo file can carry, such as where and when it was taken; a PDF is stored as you upload it. Your menu and the files uploaded for it are deleted with your account.
Usage measurement. Which pages are opened and which steps of the sign-up flow are reached. Each record carries a random id your browser generates for itself and, when you are signed in, your account’s id, so we can see how the product is used after sign-up. We also record your browser's timezone (for example “Europe/Stockholm”) and, from the network address your browser connects with, the country and city it resolves to. That lookup is done by the company that serves our website, as part of serving it. We do not send your address to a separate tracking company, and we do not store the address itself. What we keep is the place name, for example “Sweden” and “Stockholm”. We do not use a third-party analytics service. Clearing your site data makes you a new visitor to us; the records that carry your account’s id are deleted with your account. If you are in the European Union, the EEA, the United Kingdom or Switzerland, we ask you first: until you say yes, nothing is recorded for this and nothing is kept in your browser for it. Anyone can say yes or no at any time with “Measurement choices” at the foot of each page; saying no removes the random id from your browser and stops these records. We keep your answer in your browser, so that we do not ask again on every page.
Where you arrived from. If you reach us through a link or a campaign, we record the campaign tags in the link (the standard utm_ values) and the website name you came from, for example “linkedin.com”. We do not store the full address of the page you came from, which can contain a search you typed or a private path. These are recorded with the same usage measurement records, under the same ids, so we can tell which channels bring people who actually find Hatchio useful. When you create an account, the channel of the visit you signed up in is also kept with your account, and deleted with it. These follow the same choice as usage measurement.
Security records. When a request is refused (a rate limit, a failed signature check, too many sign-in codes), we record that it happened, which endpoint it hit, and a one-way scrambled form of the network address. That scrambled value lets us see the same source trying repeatedly; it cannot be turned back into an address.
Error reports. When a page breaks in your browser, the browser sends us a short report so we can fix it: the error message, the first lines of where in our code it happened, the page’s route (never its full address, which can carry a private link), the country, the kind of device (phone, tablet or computer) and the language. A report carries no account id and no visitor id.
Messages you send us. If you use the contact form, including to ask for help with a domain, we keep your name, your email address, your phone number if you give one, the subject, the domain name you ask about and your message, so we can answer. Each message is also forwarded by email to our support mailbox, support@hatchioai.com, where we read it and reply.
When you give feedback in Hatchio, we keep it with your account to improve the product. When we ask about your project (for example after your first draft) or you send us feedback, we keep your like or dislike or your rating, your optional comment and whether we may contact you about it; the comment and that permission are deleted after 180 days, and if you close the question without answering, we note that so we do not ask again. When you rate a document, we keep your thumbs up or down and your optional note until you delete the project. All feedback is deleted when you delete the project it belongs to or your account.
We do not collect your card details. We do not sell your data. We do not run advertising trackers. We do not store your IP address, the full address of the page you came from, or the contents of the pages you visit, and we do not record your precise coordinates: the country and city above are as specific as it gets.
When you publish a website we built for you, its contact or enquiry form sends what a visitor types to us, and we store it so you can read it in your site’s owner dashboard. We hold this on your behalf: it is your business’s data, kept separate from every other business, and only you, signed in with your project’s email, can read it. You are responsible for telling your own visitors what you collect and why. We do not use it for anything else, and deleting your project deletes it.
Numbers you enter about your business (sales, orders, customers and inquiries) are stored with your project, shown only to you, used to show your results and to aim improvement cycles you start, and deleted with the project or your account.
The AI providers. To produce your documents, the text you write is sent to an AI model provider. This is unavoidable: it is how the service works. Do not enter information you would not want processed by a third party, such as passwords, payment details or national ID numbers.
We use several providers, and which one handles a given request depends on the kind of work and on which is available at the time, so any of them may process any of your text. They are OpenAI, Anthropic, Google and xAI, which are based in the United States, and DeepSeek, which is based in China and states in its own privacy policy that it collects, processes and stores data in the People’s Republic of China. Images are generated from a description of your business by OpenAI, Google or Higgsfield; Higgsfield is based in the United States and states that it also has a location in Kazakhstan.
Photos you attach to an idea. If you add a photo to your idea, your browser first makes it smaller and saves a fresh copy, which drops the hidden details a photo file can carry, such as where and when it was taken. That copy is sent to Google, which returns one or two sentences describing what the photo shows; those sentences are added to your idea and treated like the rest of its text. We do not store the photo: it is not saved on our servers or in our database. We ask for a description that does not identify people and does not repeat personal details such as names or phone numbers.
Voice typing. The microphone button in the idea box uses your browser’s own speech recognition, not ours. Depending on the browser, what you say may be sent to the browser maker’s service to be turned into text (Google Chrome, for example, uses Google’s servers). We receive only the text that appears in the box, as if you had typed it; we never receive or store the sound.
One deliberate exception. The outreach tool asks you for the names and contact details of people you want to write to, and a note about why. That note is sent to one of the AI providers above so it can draft a message. Everything under “Contacts you add” below applies to it. Outside that tool, the advice above stands: do not put other people's personal data into a business description.
Our web search provider. When your team researches your market, customers, competitors or the rules that apply to you, short search queries written from your business description are sent to a web search service to find published pages. Contact details, links and anything that looks like an email address or phone number are removed from a query before it is sent. The pages found are listed with each deliverable.
Our hosting and database provider. Your account and content are stored on infrastructure operated by our hosting provider.
Our website-hosting provider. Websites you publish are stored and served by Cloudflare, Inc. (United States): the files sit in Cloudflare's Western Europe storage region, and public copies are cached on its network around the world so the website loads quickly wherever it is opened. Cloudflare sees the network address of every visitor as part of serving the website, and keeps short-lived operational logs of those requests (currently three days) and the page-view counts described under “Websites you publish” (three months), under its own privacy policy. We do not copy those logs, and we do not store visitors' addresses. Cloudflare's email service also receives the replies you forward to a project's own address and passes them to us (see “Leads and replies”).
Our payment provider. If you buy credits, the payment is processed by Moyasar, a licensed Saudi payment provider, who handles your card details directly. We never see or store them. From Moyasar we receive the payment's status, amount and currency, the card brand and the country that issued the card, which we use only to check which VAT applies. At checkout we ask for your billing country and, if you want it on your invoice, your city; whether you are buying as an individual or a business; and for a Saudi business its VAT number, name and address, so that we charge the right VAT and issue a correct invoice. We pre-fill the country and city from the location your connection suggests (or from your last purchase), and you can change them. We keep the country your connection came from as supporting evidence for the VAT decision, and what was suggested next to what you chose, to learn how often the suggestion is wrong; neither changes the price, and the suggestion is erased if you delete your account. Prices are in US dollars and charged in US dollars. If you pay with Apple Pay, you are charged the same price in Saudi riyals, converted at the Saudi Central Bank’s fixed rate of 3.75 riyals per US dollar, and an Apple Pay refund is made in riyals.
Ads on free QR codes. A free QR code opens a short page with an advertisement before it continues; a code without ads (a paid option) goes straight to where it points. Until Google AdSense is switched on for these pages, the advertisement is our own and sets no cookie. Once it is switched on, the advertisement is served by Google AdSense, a Google service, which may use cookies or similar identifiers on that page to show, measure and limit ads and to detect fraud. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked for their consent through Google's consent message before ads use cookies or personal data. How Google uses information from sites that show its ads is described at policies.google.com/technologies/partner-sites, and anyone can change their ad settings at adssettings.google.com. We receive no personal data from Google about the people who open a code.
Our email providers. Resend (Resend, Inc., United States) sends your sign-in codes and your invoices and credit notes from support@hatchioai.com. Our hosting provider’s email service sends a sign-in code whenever Resend cannot, an email when a project's first result is ready, and a copy of each contact-form message to our support mailbox. Both receive your email address and the message, and nothing else.
Our check against automated abuse. When you send a message through the contact form or ask for a sign-in code, your browser may run Cloudflare Turnstile, a check by Cloudflare, Inc. (United States) that tells people from automated programs, usually without asking you anything. Cloudflare receives your network address and information about your browser and device for this check, under its own privacy terms; we receive only whether the check passed.
The outreach tool lets you build a list of people to write to. Those are real people, and the details you add about them are their personal data, not yours. You are the one deciding to hold it, so you are responsible for having a lawful reason to, and for answering them if they ask what you hold.
What we do with it: we store the name, and whatever else you add (email, company, role, and your note about why you are writing). The note is sent to one of the AI providers above to draft a message. Nothing is ever sent to any of those people until you read the drafts and approve them, and nothing can be sent at all until you connect an account to send from, such as Gmail, and press Send.
Marking somebody as opted out keeps them on your list and skips them, rather than deleting them. That is deliberate: a deleted contact is added back by the next import and starts receiving messages again. Deleting your account deletes your contacts and every draft written about them.
We do not scrape, buy or enrich data about people, and Hatchio never searches for people. Every person on your list is one you put there.
Where the Customers tab is switched on, Hatchio helps you find and win customers. To find organisations that may buy from you, Hatchio searches public sources for organisations only, and keeps each one's name, website and the pages it used with the lead, so you can see where it came from. It never searches for people: you add any person at a lead, and their contact details, yourself, and “Contacts you add” above applies to them.
Replies you paste or forward. A reply you paste into a lead, or forward to your project's own address, is stored with the lead and sent to one of the AI providers above to sort it (interested, a question, not now, an opt-out and so on) and to suggest a next step. Attachments are dropped: only the text is kept. A forwarded reply passes through Cloudflare's email service on its way to us, and is accepted only when it comes from your own email address.
Opt-outs. Each message ends with a line telling the recipient how to opt out. A reply asking you to stop reaches you, and is recorded as an opt-out when you paste or forward it; an unsubscribe request made through the option some email apps show reaches us directly. An opt-out is kept as a one-way hash of the address (a scrambled form that cannot be turned back into it), so that address is not written to again, even if it is added back later.
How long. Leads, their timelines and the replies stored with them are deleted with the project or with your account. Opt-out hashes are kept until your account is deleted, so an opt-out outlives a deleted project. So that the unsubscribe option in a message keeps working after its project is deleted, a one-way hash of each address a message went to is kept until your account is deleted.
If you connect an account such as Gmail, LinkedIn, GitHub or Notion, you do it on that platform's own consent screen. We never ask for, receive or store your password. What we receive is an access token scoped to the permissions you approved.
For Google we ask to send email on your behalf and to read and change messages in your mailbox (Google's gmail.modify permission), and to read your account's email address, so that messages go out from it. Hatchio uses that access for two things only. It sends a message you wrote or approved in Hatchio, to a person you added, one at a time; we keep the message id Google returns so the page can show you what went out and when. And, when you ask for it in Hatchio, it lists messages in your mailbox and changes their labels; the list is shown to you and Hatchio does not keep it. Hatchio does not delete your mail or move it to Trash or Spam, and it does not read your mailbox unless you ask. Your Google data is never sold, shared with advertisers or used to train models.
For GitHub we ask for the repo permission, which is how GitHub lets an app create a private repository and write to it. That permission is broad: it reaches every repository your account can see. Hatchio uses it only to create one private repository per project and push that project’s website files to it, and only when you press Send. It does not read or change any other repository. For Notion there are no permission levels to choose; you pick the pages Hatchio may use on Notion’s own page picker, and Hatchio adds a deliverable to the end of a page you chose, when you ask it to. What we send to GitHub or Notion is then stored by them, under their own terms.
That token is encrypted before it is written down, is never sent to your browser, and is read only by the part of our server that calls that platform. Disconnecting deletes our copy immediately. It does not, today, revoke our access at the platform itself: to do that as well, remove Hatchio in that account's connected apps settings. We say so on the page too.
Some deliverables become real files: a budget spreadsheet, an outreach plan, an investor deck. They are stored with your project and the download link is created fresh each time you open the page, for your account only. The link is never saved anywhere, so a copy of our database is not a copy of your files. Deleting your account or rebuilding a file deletes the old one.
A published website is public: anyone with its address can open it, and search engines may index it. Publish only what you are willing to make public. Its footer carries a “Built with Hatchio AI” badge and a “Report this site” link, in the website’s own language; a report reaches us through our contact form, like any other message, and we keep it as “How long we keep it” describes.
Visitors to your website. We set no cookies on your website and add no tracking script to it. While it is online, page views are counted for you: for each page opened we record which website, the page path, the country the visitor's network address resolves to (looked up by Cloudflare as part of serving the page) and the published version, and nothing else. The visitor's address, browser and other activity are not stored, and requests that identify themselves as automated (search-engine crawlers and similar) are not counted. The counts are kept for three months and shown to you in your workspace as totals.
Taking a website offline. If we take a website offline for a breach of our terms or on a credible complaint, its address answers with a notice that the website is unavailable, and your workspace shows that it has been suspended.
Your projects are tied to your account, and every request to read them is checked against your signed-in session on the server. Other users cannot read your projects, documents, or answers.
Data is currently stored on servers in the European Union, operated by our hosting provider. If you are outside that region, your information is transferred there to provide the service.
Storage and processing are not the same place. Your projects are stored in the European Union, but the text of each request is processed outside the European Union by the AI provider that handles it, including in the United States and, for DeepSeek, in the People’s Republic of China. The providers are listed under “Who else sees it” above.
The files of a website you publish are stored in Cloudflare's Western Europe region, and public copies of its pages are cached on Cloudflare's network around the world, because a published website is meant to be reached from anywhere.
We keep your account and projects while your account is open. If you ask us to delete your account, we delete your projects and generated documents. We keep your orders, invoices and credit notes for at least six years, as Saudi VAT law requires, even if you delete your account; they keep only what the invoice and the VAT decision need.
We keep the last three published versions of your website, and its current version while you have taken it offline, so you can roll back or put it back online. Deleting the project or your account deletes the website and its files at the hosting provider. Page-view counts for your website are kept for three months.
Before we start work on an idea, including a free preview, we check what the idea would do. We keep the result of that check (allowed, refused or a question, the kind of concern and a short note on why) for 60 days. When a signed-in project idea is allowed, its words are kept with the check for no more than seven hours, so the project starts from exactly what was checked, and are then removed from it.
Usage measurement records are kept for 13 months and then deleted; those that carry your account’s id go sooner if you delete your account. Error reports are kept for 90 days and security records for 60 days.
If you redeem a promotion code, we record that the code was used, with a scrambled (hashed) form of your email address and of your network address, so the same code cannot be used twice. We keep that record for one month (30 days) from the day you redeem the code, also if you delete your account in that time, and then delete it. The credits the code gave you, and the line in your credit history that records them, stay with your account and are deleted with it.
Messages you send us are kept for 12 months after we last dealt with them. A waitlist address is kept until we tell you we have opened, plus six months, or until you ask us to remove it. A complaint about a published website, and what we did about it, is kept for two years after it is closed, and longer only while a website stays held because of it.
You can ask for a copy of your data, ask us to correct it, or ask us to delete your account and its contents. Send the request through our contact form or by email to support@hatchioai.com, and we will respond within 30 days. You can also download a copy of your account’s data yourself, as one file, with “Download my data” in your workspace.
This service is for adults running or starting a business. It is not intended for children, and we do not knowingly collect their information.
If we change how we handle your information, we will update this page and change the date above.
This policy is written in English. Translations are provided for convenience only and may not capture every legal nuance. If a translation differs from the English version, the English version controls and is the version that applies.
Privacy questions: our contact form or support@hatchioai.com