Privacy Policy

We build AI systems for a living, so we know how much trust it takes to hand over data. This Privacy Policy explains what personal information Hiti Labs collects, why we collect it, how we use and protect it, and the choices and rights you have.

01Who we are

Hiti Labs ("Hiti Labs", "we", "us", "our") is an engineering studio that designs, builds and operates custom AI software. For the purposes of data protection law, we are the controller of the personal information described in this policy, except where section 6 says otherwise.

You can contact us about privacy at [email protected].

02Scope

This policy applies to personal information we process when you:

visit our website at hitilabs.com (the "Website");
contact us, submit an enquiry or book a discovery call;
work with us as a client, prospective client, supplier or partner, or as an employee or representative of one;
receive communications from us or attend our events.

This policy does not cover third-party websites or services that we link to, which have their own privacy policies.

03Information we collect

3.1 Information you give us

Enquiry details: your name, work email address, the services you are interested in, and anything you tell us about what you are trying to solve.
Business contact details: your job title, company name, phone number and other details you share during correspondence, calls or meetings.
Contract and billing information: billing contacts, addresses, tax identifiers and payment records. We do not store full payment card details.
Communications: the content of emails, messages, meeting notes and feedback you send us.
Recruitment information: if you apply to work with us, your CV and the information you provide in the application process.

3.2 Information collected automatically

Technical data: when you visit the Website, our hosting provider and the services the Website loads may record standard server-log information. This includes your IP address, browser type, device information, referring page, pages requested and the date and time of access.
Web fonts: the Website loads fonts from Google Fonts. To deliver the fonts, your browser connects to Google's servers, which receive your IP address and browser information. See Google's Privacy Policy.
Cookies and similar technologies: see section 13.

3.3 Information from other sources

We may receive business contact information from referrals, from partners, or from public sources such as your company's website or professional networking profiles, when this is relevant to a potential engagement.

04How we use your information

to respond to enquiries, arrange discovery calls and prepare proposals;
to deliver, manage and improve our Services and to perform our contracts with clients;
to invoice, collect payment and maintain business records;
to communicate with you about engagements, updates and administrative matters;
to operate, secure and maintain the Website, and to prevent fraud, abuse and security incidents;
with your consent where required, to send occasional updates about our work and insights;
to assess job applications;
to comply with legal, regulatory, tax and accounting obligations, and to establish, exercise or defend legal claims.

We do not sell your personal information. We do not use it for automated decision-making that produces legal or similarly significant effects on you.

05Legal bases for processing

Where the EU or UK General Data Protection Regulation (GDPR), or similar laws, apply, we rely on the following legal bases:

Purpose	Legal basis
Responding to enquiries and preparing proposals	Steps taken at your request before entering a contract, or our legitimate interest in responding to business enquiries
Delivering Services and managing engagements	Performance of a contract
Billing, record-keeping and tax	Legal obligation, and performance of a contract
Website operation and security	Legitimate interest in running a secure, functioning website
Marketing communications	Consent, or legitimate interest where permitted for existing business contacts
Recruitment	Steps taken at your request before entering a contract, and legitimate interest
Legal claims and compliance	Legal obligation, and legitimate interest

Where we rely on legitimate interests, we have weighed them against your rights and freedoms. You can ask us for more information about that assessment.

06Client project data

During an engagement, clients may give us access to datasets, documents, systems or other materials that contain personal information, for example to build, train or evaluate an AI system. In that case:

the client is the controller and Hiti Labs acts as a processor (or service provider) on the client's behalf;
we process that data only on the client's documented instructions and only to deliver the agreed Services;
our obligations are governed by our contract and data processing agreement with the client;
individuals whose data is included in client materials should direct privacy requests to the relevant client. We will assist the client in responding.

Wherever the project allows, we apply data minimisation, pseudonymisation and access controls. At the end of an engagement, we return or securely delete client data as the contract specifies.

07AI and your data

No cross-client training. We do not use one client's data to train, fine-tune or improve models for another client, or for our own general-purpose products, without express written consent.
Third-party model providers. Where a project uses a third-party AI model or API, we select providers and configurations to suit the client's privacy requirements. Where available, this includes options that disable provider data retention and training, and regional or on-premise deployment.
Enquiries. We read and respond to enquiries ourselves. We do not submit your enquiry to public AI tools that retain or train on submitted data.

We share personal information only as described below:

Service providers who process data on our behalf under contract, such as website hosting, email and productivity tools, file storage, accounting and payment services, and customer relationship management;
Subcontractors who help deliver the Services, bound by confidentiality and data protection obligations;
Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality;
Authorities, where required by law or to protect our rights, property or safety, or those of others;
Successors in connection with a merger, acquisition, financing or sale of all or part of our business, subject to this policy continuing to apply to your information.

09International transfers

We and our service providers may process personal information in countries other than your own, which may have different data protection laws. Where we transfer personal information from the EEA, the UK or Switzerland to a country without an adequacy decision, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for details of these safeguards.

10How long we keep information

We keep personal information only for as long as we need it for the purposes it was collected for, including to meet legal, accounting and reporting requirements. As a general guide:

Enquiries that don't lead to an engagement: up to 24 months after our last contact;
Client and contract records: for the duration of the relationship, plus the period required by tax and company law, typically 6–7 years;
Client project data: as set out in the client contract, and returned or deleted at the end of the engagement;
Server logs: typically no more than 90 days, unless needed to investigate a security incident;
Unsuccessful job applications: up to 12 months, unless you agree to a longer period.

11Security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or alteration. These include encryption in transit and at rest where supported, least-privilege access controls, multi-factor authentication, segregated project environments, secure development practices and staff confidentiality obligations. No method of transmission or storage is completely secure. If a data breach affects you, we will notify you and the relevant authorities as the law requires.

12Your rights

Depending on where you live, you may have some or all of the following rights over your personal information:

Access: to request a copy of the personal information we hold about you;
Correction: to have inaccurate or incomplete information corrected;
Deletion: to request that we delete your information;
Restriction: to ask us to limit how we use your information;
Portability: to receive your information in a structured, machine-readable format;
Objection: to object to processing based on legitimate interests, and to object at any time to direct marketing;
Withdraw consent: where we rely on consent, to withdraw it at any time. This does not affect processing already carried out;
Opt out of sale or sharing: under certain US state laws, including the CCPA/CPRA. We do not sell personal information or share it for cross-context behavioural advertising;
Non-discrimination: we will not treat you differently for exercising your rights.

To exercise these rights, email [email protected]. We may need to verify your identity before responding. We will reply within the time required by law, usually within one month.

You also have the right to complain to your local data protection authority. For example, this is the relevant EU supervisory authority in the EEA, or the Information Commissioner's Office (ICO) in the UK. We would appreciate the chance to address your concerns first.

13Cookies & similar technologies

The Website does not currently use advertising or analytics cookies. We may use strictly necessary cookies or local storage required for the Website to function. The Website's third-party services, such as the font provider, may process technical data as described in section 3.2.

If we introduce analytics or other non-essential cookies in the future, we will update this policy and, where required by law, ask for your consent first. You can also control cookies through your browser settings.

14Children

Our Website and Services are intended for businesses and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.

15Marketing communications

We will send you marketing emails only where you have agreed to receive them, or where the law otherwise permits it for existing business contacts. Every marketing email includes an unsubscribe link, and you can also opt out at any time by emailing us. We will still send you essential service or administrative messages.

16Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. We will post the updated version on this page and change the "Last updated" date. If a change is significant, we will take reasonable steps to notify you.

17Contact us

If you have questions about this policy or how we handle your information, please contact us:

Hiti Labs
Email: [email protected]
Address: Panchkhal, Kavrepalanchok, Nepal

This Privacy Policy is a general template. Before publishing, make sure it reflects your actual data practices and tools, and have it reviewed by a qualified legal professional.