This Privacy Policy explains how HiT Land LTD ("HiT Land", "we", "us", or "our") collects, uses, stores, and protects personal data through HiT OS (os.hit.land) and associated services (the "Service"), in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR).

1. Who We Are and Data Protection Roles

1.1. Data Controller & Contact:

Entity: HiT Land LTD
Company Registration: 14117142 (incorporated in England and Wales)
Registered Address: 2 Frederick Street, Kings Cross, London WC1X 0ND, United Kingdom
Privacy & Support Inquiries: [email protected]

1.2. Dual Regulatory Roles:

We act as a Data Controller for the personal data of our direct B2B customers, users, and account holders (such as account credentials, contact details, billing history, and direct correspondence with us).
We act as a Data Processor (or service provider) for Customer Data—meaning the contacts, customer communications, WhatsApp/Instagram messages, media files, and voice recordings uploaded, received, or processed by our business customers through their use of the Service. In this context, our customer is the Data Controller, and we process such data strictly under their instructions. Our Data Processing Addendum sets out the terms of this role.

1.3. Age: The Service is intended for business users aged 18 or over. We do not knowingly collect personal data from children; if you believe a child has given us personal data, contact us and we will delete it.

2. Personal Data We Collect and Process

A. Data We Collect as a Controller

Account & Profile Data: Name, work email address, company name, phone number, passwords, and user settings.
Billing & Transaction Data: Payment status, subscription plan details, transaction history, and VAT/tax identifiers. (Note: Full payment card details are collected and processed directly by our payment processor, Stripe, and are not stored on our servers).
Technical & Usage Logs: IP address, browser type, operating system, login times, feature usage, and diagnostics.
Customer Support Inquiries: Communications sent to our support email or helpdesk.

B. Data We Process as a Processor (on behalf of Customers)

Connected Channel Communications: WhatsApp messages, Instagram direct messages, sender/recipient phone numbers, user handles, and chat timestamps.
CRM Records: Contact lists, notes, customer status tags, and metadata entered by your team.
Audio & Voice Data: Voice notes, audio files submitted for transcription, speech audio for voice cloning (processed only upon explicit verification of consent), and synthesized dubbing audio.

3. Purposes and Legal Bases for Processing (Controller)

Under UK and EU GDPR, we process personal data under the following legal bases:

Purpose	Category of Data	Legal Basis (UK/EU GDPR)
Creating and managing accounts; providing SaaS access	Account and profile data	Performance of a contract (Article 6(1)(b))
Processing subscription payments and credit purchases	Billing and transaction details	Performance of a contract (Article 6(1)(b))
Maintaining statutory financial, accounting, and tax records	Invoices, payment records	Legal obligation (Article 6(1)(c))
Platform security, abuse prevention, and debugging	Technical logs, usage patterns	Legitimate interests (Article 6(1)(f))
Providing customer support and operational updates	Support tickets, account email	Performance of a contract & Legitimate interests
Product announcements or opt-in newsletters	Marketing email	Consent (Article 6(1)(a)) [can be withdrawn anytime]

We do not sell personal data. We disclose personal data only to trusted third-party service providers acting on our behalf under strict contractual data protection terms, categorized as follows:

Hosting Provider in the EU (Germany): Core cloud hosting infrastructure, secure application servers, and primary databases are hosted in certified datacenters located within Germany (European Union).
Payment Processor: Stripe (processes credit card transactions, fraud prevention, and recurring billing securely under PCI-DSS compliance).
AI Model Providers: Third-party artificial intelligence foundation model providers utilized to process message text, context, and prompts to produce automated response drafts, summaries, and chat intelligence.
Voice Providers: Specialized audio and speech synthesis providers utilized to transcribe voice notes (speech-to-text), generate text-to-speech audio, and perform voice cloning and dubbing features.
Third-Party Connection Providers: Services facilitating integrations with connected business apps (e.g. Google Workspace, Trello, Slack, Notion, Shopify, WhatsApp, and Instagram).

The providers we use today are: Hetzner Online (hosting, Germany); Cloudflare (network, security and content delivery); Stripe (payments); Google (Gemini AI models), OpenAI, Anthropic and OpenRouter (AI models); ElevenLabs (voice); Meta Platforms (WhatsApp and Instagram, when you connect them); Composio (connected business apps, when you connect them); Apify (reading public social profile data, when you use features that need it); and our email delivery provider (service emails). We will update this list when it changes.

5. International Data Transfers

5.1. Our primary server infrastructure and customer databases are hosted within the European Union (Germany).

5.2. Where data is transferred to sub-processors outside the United Kingdom or European Economic Area (EEA), we ensure adequate safeguards are in place in compliance with UK and EU GDPR. These safeguards include:

Standard Contractual Clauses (EU SCCs) approved by the European Commission;
The UK International Data Transfer Addendum or Agreement (IDTA); or
Transfers to jurisdictions recognized by the UK and European Commission as providing an adequate level of data protection.

6. Data Retention

6.1. Account and Billing Records: Kept for the duration of your active subscription and retained for up to six (6) years following account closure to comply with statutory UK tax and accounting obligations.

6.2. Customer Processor Data: Retained in active storage for as long as your account remains active or until explicitly deleted by you via your dashboard. Upon account termination, customer data is purged from active databases within 30 days, and from backups as they are rotated out; we keep backups for no longer than 90 days.

6.3. AI Inputs and Ephemeral Processing: Data sent to AI model and voice providers for generation or transcription is processed ephemerally and is not utilized to train public foundation models without consent.

7. Security Measures

We maintain technical and organizational safeguards designed to protect personal data from accidental loss, unauthorized access, alteration, or disclosure, including:

Encryption of data in transit using modern Transport Layer Security (TLS/HTTPS);
Encryption of stored credentials and integration tokens (such as connected-account access tokens) in our database;
Role-based access controls and least-privilege administrative access;
Continuous infrastructure monitoring and firewall protections.

8. Your Data Protection Rights

Under UK GDPR and EU GDPR, you (and your end customers where applicable) have rights regarding your personal data:

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where retention is no longer justified.
Right to Restriction: Request restriction of processing under certain circumstances.
Right to Data Portability: Request transfer of your data in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at [email protected].

You also have the right to lodge a complaint with a supervisory authority:

In the United Kingdom: The Information Commissioner's Office (ICO) at ico.org.uk.
In the EU: Your local competent data protection authority.

9. Cookies and Tracking Technologies

9.1. Essential Cookies: Necessary for the operation of the Service (e.g. authenticating users, maintaining session security, routing traffic).

9.2. Referral Cookie (Non-Essential): We do not use advertising cookies, and our analytics are cookie-less. The only non-essential cookie is a referral cookie set for up to 60 days when you arrive through an invite link, so the person who invited you can be credited; you can delete it at any time in your browser settings.

10. Contact Us

For any privacy-related inquiries, requests, or questions regarding this policy, please reach out to:

Controller (account data, see section 1): HiT Land LTD (Company No. 14117142)
Registered Office: 2 Frederick Street, Kings Cross, London WC1X 0ND, United Kingdom
Email: [email protected]
If we are required to appoint a representative in the European Union under Article 27 GDPR, their details will be published on this page. Until then, EU residents can contact us directly at [email protected].