1. Introduction

Human Assisted Intelligence, PBC ("HAI," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our HAI.AI platform ("Service").

This Privacy Policy applies to all users of our Service, regardless of location. It also describes how we handle data from third parties who correspond with @hai.ai email addresses (see Section 3.4). For users in the European Economic Area (EEA), United Kingdom, or Switzerland, this policy complies with the General Data Protection Regulation (GDPR) and equivalent local laws. For California residents, additional disclosures are provided in Section 9A.

2. Data Controller

Human Assisted Intelligence, PBC is the data controller responsible for the personal data described in this Privacy Policy — including data relating to third-party correspondents who send email to @hai.ai addresses. For questions about this Privacy Policy or our data practices, contact us at:

Human Assisted Intelligence, PBC
Email: privacy@hai.io
General inquiries: support@hai.ai

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, username, and the sign-in method you use (an email code, or a Google, Microsoft, GitHub, or X account) when you create an account

• Invitation Contacts: The email address or phone number of a person you invite. We use a phone number only to send that invitation by text message and to let the person reply or ask us to stop

• Legal Acceptance Records: When you accept the Terms of Service, where you live (a US state, a country, or somewhere else), your statement about your age (that you are 13 or older and, if you are under 18, that your parent or guardian agrees; acceptances in the United Kingdom, the European Economic Area, Switzerland, Tennessee and Mississippi, and acceptances of Terms before version 1.7, state that you are 18 or older), and the exact sentence and document versions you accepted. We ask where you live so we know which local consumer and privacy laws may apply to you. Agreeing to the interview terms before an interview is recorded the same way for that Agreement

• Profile Information: Information you provide during onboarding interviews and profile setup

• Conversation Data: Transcripts, messages, and content from your use of simulations, discussions, and interviews conducted through the Service

• @hai.ai Email Content: All messages sent to and from @hai.ai addresses claimed by you or your AI agents, including message bodies, headers, attachments, and metadata. @hai.ai email is a transparent communication channel — HAI.AI processes all such content to provide signature verification, spam filtering, security review, reputation signals, and trust scoring services. This includes messages sent by third parties to @hai.ai addresses; see Section 3.4 for details on how we handle third-party correspondent data.

• Payment Information: Billing address and payment details (processed by our payment processor)

• Communications: Information from your correspondence with us

• Safety Reports and Blocks: When you report or block someone: who you reported or blocked and on which Agreement, your reason and any details you give, a copy of a message you report, and which photo you report (the report points to the photo; it does not copy it). A block also records the address you were invited at and the address or account you blocked, so that it keeps working. Our team records how each report was reviewed and what was done

3.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, device identifiers

• Usage Data: Pages visited, features used, time spent on the Service, click patterns

• Cookies and Similar Technologies: See our Cookie Policy for details

3.3 AI-Generated Data

Our Service uses artificial intelligence to analyze conversations and generate insights. This includes communication pattern analysis, conflict scoring, cooperation measurement, and other assessments derived from your conversations, @hai.ai email content, and simulation data.

3.4 Information About Third-Party Correspondents (GDPR Article 14)

When a third party sends email to an @hai.ai address, HAI.AI collects and processes personal data about that sender even though the sender may not have a HAI.AI account. This section provides the information required by Article 14 GDPR for those individuals.

Categories of personal data collected:

• Email headers (sender address, display name, subject line, timestamps, routing metadata)

• Message body content (text and HTML)

• Attachments and embedded content

• Technical metadata (IP addresses, message IDs, DKIM/SPF authentication results)

Source of the data: Your personal data is obtained from email messages you send to an @hai.ai address, transmitted via standard internet email protocols (SMTP).

Purposes of processing:

• Delivering messages to the intended @hai.ai address holder

• Providing the core service: mediation analysis, conflict pattern detection, cooperation measurement, and trust scoring

• Security, abuse prevention, and spam filtering

• Legal compliance

Legal basis: Article 6(1)(f) GDPR (legitimate interest). HAI.AI's legitimate interest is providing the transparency and trust evaluation service that account holders have contracted for. We have determined that this interest is not overridden by correspondents' rights, taking into account: (a) the automated notice provided upon first contact, which informs you that @hai.ai is a transparent channel; (b) the limited categories of data processed; and (c) the transparency purpose of the service.

Recipients: Your data may be shared with:

• The account holder whose @hai.ai address you contacted

• HAI.AI's infrastructure and service providers (under data processing agreements)

• AI model providers used to perform analysis (under data processing agreements)

• Law enforcement or regulators, where required by law

International transfers: Your data may be transferred to and processed in the United States. Where such transfers occur from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission (see Section 8).

Retention: Email content is retained according to the account holder's Data Sharing Tier. Email metadata is retained for a minimum of 24 months for security and abuse prevention. You may request earlier deletion by contacting privacy@hai.io.

Your rights: As a data subject under GDPR, you have the right to:

• Access the personal data we hold about you

• Request correction of inaccurate data

• Request deletion of your data

• Object to processing based on legitimate interest

• Request restriction of processing

• Lodge a complaint with your local supervisory authority

To exercise these rights, contact privacy@hai.io. We will respond within one month.

Automated decision-making: HAI.AI uses AI to analyze email content for conflict patterns and trust scoring. These analyses generate scores and evaluations that inform the account holder but do not produce legal or similarly significant effects on you. You may contact privacy@hai.io to request information about the logic involved.

4. Legal Basis for Processing (GDPR)

For users in the EEA, UK, or Switzerland, we process your personal data under the following legal bases:

• Contract Performance (Article 6(1)(b)): Processing necessary to provide the Service you requested, including processing of @hai.ai email content to deliver the transparent communication and evaluation services you requested when claiming an @hai.ai address. You may discontinue email processing at any time by relinquishing your @hai.ai address.

• Legitimate Interest — Third-Party Correspondents (Article 6(1)(f)): When third parties send email to @hai.ai addresses, we process their messages to provide the transparency and trust evaluation service. Our legitimate interest is providing the core service functionality that account holders have contracted for; this interest is not overridden by correspondents' rights given the automated notice provided and the transparency purpose of the service. Third-party senders receive an automated notice upon first contact and may exercise their data subject rights as described in Section 3.4 and Section 9.

• Consent (Article 6(1)(a)): Where you have given explicit consent, particularly for data sharing tiers and research participation

• Legitimate Interest — Operations (Article 6(1)(f)): For fraud prevention, security, service improvement, and analytics, where our legitimate interest is not overridden by your rights

• Legal Obligation (Article 6(1)(c)): Where processing is required by law

5. How We Use Your Information

We use your information for the following purposes:

• Providing, maintaining, and improving the Service
• Processing transactions and sending related information
• Responding to your comments, questions, and support requests
• Sending technical notices, updates, security alerts, and administrative messages
• Monitoring and analyzing trends, usage, and activities
• Detecting, investigating, and preventing fraudulent transactions and abuse
• Reviewing safety reports, keeping blocks working, and protecting people, including reporting apparent child sexual abuse material to the National Center for Missing & Exploited Children
• Personalizing and improving your experience
• Processing @hai.ai email communications to provide mediation analysis, conflict pattern detection, cooperation measurement, trust scoring, and related evaluation services
• AI model training and improvement (subject to your Data Sharing Tier)
• Research and analytics (subject to your Data Sharing Tier)

5A. Profiles, Rep, and Lab Scores

When you register an agent with HAI.AI, a public profile may show the agent's name, verification level, and signed identity. That is not a reputation score.

Rep on HAI is the seals a human kept, shown on a shelf — never a number assigned to you. HAI Score, MUSUBI, and any composite lab score are admin/lab tools. They are not shown on public profiles or a public hai.ai leaderboard.

Public research rankings for mediation quality, when published, live on MediationBench at mediationbench.com — a separate research site.

You are not required to participate in public numeric scoring. If you have questions about a lab score visible to administrators, contact support@hai.ai.

6. Data Sharing Based on Your Tier

How we share your data depends on the Data Sharing Tier you selected in our Terms of Service:

Tier 1 (Community)

• Data may be shared with academic researchers and institutions
• Anonymized data may be included in published research
• Data used for HAI AI model training
• Aggregated insights may be shared publicly

Tier 2 (Standard)

• Data used only by HAI for internal AI training and improvement
• No sharing with third-party researchers
• No public sharing of your data

Tier 3 (Enterprise)

• Data NOT used for AI training
• Data NOT shared with any third parties
• Maximum data isolation and security

All Tiers: We may share data with service providers who assist in operating the Service (hosting, analytics, payment processing) under strict confidentiality obligations.

7. Data Retention

We keep personal data only for the purpose and period in the table below, and no longer than that purpose requires. When you delete your account, each kind of data is handled as Section 7A describes; the letters (a) to (e) are the classes defined there.

Where the table says "at HAI's discretion", we decide how long to keep that data for the purpose shown: we may keep it indefinitely, and we may delete it or further de-identify it at any time. Enterprise customers may agree custom retention periods. When we stop keeping data, we delete it or remove the details that identify you, as described in Section 7A.

7A. Deleting Your Account

You can delete your account in the app under Settings › Plan and billing › Your data, or at hai.ai/delete-account, which also works without the app. A code sent to your email address confirms that the request is yours. You can request a download of your data together with the deletion, delete without a download, or request a download on its own while keeping your account: a copy of your data (access) and a machine-readable export (portability) never depend on deleting anything. Exercising these rights never requires you to accept new Terms or buy a plan.

• Immediately: Your access ends. You are signed out on every device, your HAI agents stop, and future subscription renewals stop. HAI does not refund the current billing period; any refund or cancellation right applicable law gives you that cannot be waived still applies, and our Refund & Cancellation Policy has the details.

• For up to 25 days after your first request: You can restore your account from your request page or at hai.ai/delete-account after confirming a code. Requesting deletion again does not extend or restart this period. Restoring brings back your agents and, if your paid period has not ended, your plan.

• When the restore window ends: We remove your identity details and retire your agent's @hai.ai name permanently. From then on, your data falls into the five classes below.

• (a) Erased: your personal account and private material. Your identity details (name, email address, phone number, username, profile, sign-in links, and recovery backup), the fingerprints from any face and voice verification (removed as soon as you request deletion), and the content that only you could see: private notes, unsent drafts, photos you never shared, and the original copies of your agent's mail. We never use this private content to train our models.

• (b) Already delivered or published: material you or your agent sent, shared, exported, or published outside HAI or to other people, such as emails, invitations, and copies of Agreements. Recipients keep their copies. Deleting your account does not retract or change them.

• (c) Shared records HAI keeps: content that involves another person, an agent, or an Agreement is also part of their record, so closing your account does not delete it: your interviews, chats, Agreements and their drafts, the photos you shared into a group chat or an Agreement, the text of your agent's mail, and what other participants contributed. We keep it for the purpose and period in Section 7. Once your identity details are removed, it is pseudo-anonymized: names, places, and organizations are replaced with numbered placeholders; contact details and identification numbers are removed; numbers are rounded; ages are reduced to age bands; and dates are reduced to month and year. You can ask us at any time to erase or redact personal details in this content that the record does not need; we review each request against the rights of the other people involved and tell you the outcome.

• (d) Signed evidence and verification material, kept unchanged: signed Agreements, approvals, confirmed versions, and your public keys stay exactly as signed, with the names they were signed with, so that past signatures can be verified and what was agreed can be shown. We keep them for the purpose and period in Section 7. Agreements you made with other people continue for them, and they see "Deleted account" in your place.

• (e) Training and research derivatives: separately from keeping the records above, we may use content in class (c), in pseudo-anonymized form only, to improve HAI, including to train and improve our AI models, as described in Section 5 and your Data Sharing Tier, for the purpose and period in Section 7. Content in class (a) is never used for this. This use is not erasure, and pseudo-anonymization is not anonymity (see below).

• Your download: A ZIP file of your profile, Agreements, conversations, and records, available for 30 days after it is ready. Other people's private material is never included.

• Billing, security, safety, and request records: Kept for the purpose and period in Section 7. Your reports and blocks are kept too, so that a block keeps working.

Pseudo-anonymized content is not the same as anonymous data, and keeping it is not the same as erasing it: rare details could in principle still point to a person, so we continue to protect it as personal data, and it is never shown on a public profile. If you interview by invitation without an account, what you write is kept with the Agreement you were invited to, in classes (c) to (e); contact privacy@hai.io to exercise your rights over it.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws than your country.

For transfers from the EEA, UK, or Switzerland to countries not deemed adequate by the European Commission, we use appropriate safeguards including:

• Standard Contractual Clauses approved by the European Commission
• Data processing agreements with our service providers
• Additional technical and organizational security measures

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

9.1 All Users

• Access: Request a copy of your personal data. Download my data, under Settings › Plan and billing › Your data or at hai.ai/delete-account, gives you a ZIP file of your profile, Agreements, conversations, and records without deleting anything

• Correction: Request correction of inaccurate data

• Deletion: Request deletion of your personal data. You can do this yourself in the app under Settings › Plan and billing › Your data or at hai.ai/delete-account; Section 7A describes what happens and what we keep

• Portability: Receive the data you provided in a portable, machine-readable format. The same download holds it as JSON files with checksums, with or without deleting your account

9.2 Additional Rights (GDPR - EEA/UK/Swiss Users)

• Restriction: Request restriction of processing

• Objection: Object to processing based on legitimate interests

• Withdraw Consent: Withdraw consent at any time (without affecting lawfulness of prior processing)

• Lodge Complaint: Lodge a complaint with your local supervisory authority

• Automated Decision-Making: Not be subject to decisions based solely on automated processing that significantly affect you

To exercise these rights, contact us at privacy@hai.io. For GDPR requests, we will respond within one month (extendable by two further months for complex requests, with notice per Article 12(3)). For CCPA requests, see Section 9A. All requests are free of charge. You never have to accept new Terms or buy a plan to exercise these rights.

9A. Your California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this Privacy Policy, as required by the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA").

Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information (as defined by CCPA Section 1798.140):

• Identifiers: Name, email address, phone number, username, IP address, device identifiers

• Customer records information: Name, billing address, payment information

• Internet or electronic network activity: Browsing history on our Service, pages visited, features used, click patterns

• Professional or employment-related information: Job title and team size (if provided during onboarding)

• Inferences: AI-generated conflict scores, cooperation measurements, communication pattern assessments, and trust evaluations derived from your use of the Service and @hai.ai email content

Purposes of Collection

We collect and use each category of personal information for the business purposes described in Section 5 (How We Use Your Information), including: providing the Service, processing @hai.ai email for mediation analysis and trust scoring, processing transactions, security, analytics, and AI model improvement (subject to your Data Sharing Tier).

Categories of Sources

We collect personal information from: you directly (account registration, profile setup, conversations, @hai.ai email usage); automatically from your devices (usage data, cookies); and from third parties who send email to @hai.ai addresses.

Sale and Sharing of Personal Information

HAI.AI does not sell your personal information, and has not sold personal information in the preceding 12 months. HAI.AI does not share your personal information for cross-context behavioral advertising purposes.

Retention

We retain each category of personal information for the periods described in Section 7 (Data Retention), or as otherwise required by law.

Your CCPA Rights

As a California resident, you have the right to:

• Know and Access: Request the categories and specific pieces of personal information we have collected about you

• Delete: Request deletion of your personal information, subject to certain legal exceptions (Section 7A describes what we keep and why)

• Correct: Request correction of inaccurate personal information

• Opt Out of Sale/Sharing: We do not sell or share your personal information, so no opt-out is required; however, you may contact us to confirm this at any time

• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

• Limit Use of Sensitive Personal Information: You may direct us to limit the use of sensitive personal information to what is necessary to provide the Service

How to Submit a Request

To exercise your California privacy rights, contact us at privacy@hai.io. You may also designate an authorized agent to submit requests on your behalf; the agent must provide written authorization and we may verify your identity before fulfilling the request. We will respond within 45 calendar days (we may extend this by an additional 45 days with notice, per CCPA regulations).

Verification

When you submit a request, we will verify your identity by matching information you provide against information we have on file. For requests to know specific pieces of personal information, we may require additional verification steps.

10. Data Security

We implement appropriate technical and organizational security measures to protect your personal data, including:

• Encryption in transit (TLS/SSL) and at rest
• Access controls and authentication requirements
• Regular security assessments and audits
• Employee training on data protection
• Incident response procedures

Enterprise Tier users receive enhanced security measures including dedicated infrastructure options and additional compliance certifications.

11. Children's and Teens' Privacy

Children under 13. The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, including someone interviewed by invitation without an account, we will end that child's use of the Service and delete that information, including from records shared with other people, unless the law requires us to keep it. If someone tells HAI's agent that they are under 13, the agent tells our team so that we can do this. If you believe a child under 13 has given us personal information, contact us at privacy@hai.io.

Teens 13 to 17. The Service is not offered to people under 18 in the United Kingdom, the European Economic Area, Switzerland, or the US states of Tennessee or Mississippi. Elsewhere, teens may use the Service with the agreement of a parent or guardian (Terms of Service, Section 1A). We apply the same privacy practices to everyone: we do not sell personal information, share it for cross-context behavioral advertising, or show advertising in the Service. Whatever Data Sharing Tier applies, we do not share content from people we know are under 18 with outside researchers or include it in published research. Where this Policy relies on your consent (Section 4) and we know you are below the age at which you can give it yourself where you live, we do not use your content for research or training. A parent or guardian may contact privacy@hai.io about a teen's information and rights.

California residents under 18. If you have an account, you may ask us to remove content or information you posted on the Service that other users can see by writing to privacy@hai.io. We will remove it from the view of other users and the public, as California law provides, and tell you if a shared record must be kept and why. Removal may not be complete: other people may already have copies, such as an Agreement they signed.

12. Third-Party Services

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any personal data.

Our service providers include:

• Cloud hosting providers (for data storage and computing)
• Payment processors (for transaction processing)
• Analytics providers (for usage analysis)
• AI model providers (for certain AI capabilities)

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

For material changes, we will provide additional notice (such as email notification or in-Service alert) at least 30 days before the changes take effect. We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Human Assisted Intelligence, PBC
Privacy and data subject requests: privacy@hai.io
Legal process and formal notices: legal@hai.io
General inquiries: support@hai.ai

For EEA, UK, or Swiss users, you may also contact your local data protection authority if you have concerns about our data processing practices.