Privacy Policy
How HyperNoesis collects, uses and protects your personal data, which third parties process it, and the rights you have over it.
Draft — not yet legally reviewed. This document was prepared from the application's actual data flows and describes them accurately, but it has not been reviewed by a qualified lawyer. Have it reviewed before relying on it for compliance purposes.
Last updated: 26 October 2026
This policy explains what personal data HyperNoesis processes when you use the website and the applications, why we process it, who else it reaches, and what you can do about it.
Who we are
HyperNoesis operates this website and the AI applications available through it. If you have a question about this policy or want to exercise any of the rights below, use the contact page.
What we collect
Account data. When you create an account we store your email address, display name, an optional avatar image, and whether your email has been verified. If you sign in with a social provider we also store the identifier that provider gives us. If you never sign up, an anonymous account is still created for you so the applications can function; it holds no personal details beyond a generated identifier.
Content you provide. Chat messages, documents you upload for question-answering, image prompts and generated images, text you submit for speech synthesis, and voice sessions. This content is stored against your account so you can return to it.
Billing data. If you subscribe, we store a customer record, your subscription and order history. We never see or store your card details — those go directly to Stripe.
Technical data. Your IP address and browser user-agent reach our hosting provider as part of ordinary web traffic. If you consent to analytics, we also collect usage events and session recordings (see Cookies and analytics).
Hosted servers. If you rent a Noë Bot, Hermes or OpenClaw server, we keep the time zone your browser reports and the time of the last AI model call the server made through our metered service. We use them only to schedule the server's updates — when it is not busy, or at night in your time zone.
Why we process it
- To provide the applications you are using — this is the performance of our contract with you.
- To keep the service secure and diagnose failures — our legitimate interest.
- To take payment and meet our accounting obligations — contract and legal obligation.
- To understand product usage through analytics — only with your consent, which you can withdraw at any time.
We do not sell your personal data, and we do not use your content to train our own models.
Who else processes your data
Running this service means your data passes through other companies. Each is used for a specific purpose:
| Processor | Purpose | What reaches them |
|---|---|---|
| Vercel | Hosting | Requests, IP address, user-agent |
| Supabase | Database (EU, Frankfurt) | Account data, your content, billing records |
| AI model providers — Anthropic, OpenAI, Google, xAI, DeepSeek, Fireworks, Replicate | Generating responses, images and speech | The prompts, documents and text you submit |
| LiveKit | Real-time voice sessions | Audio during a voice call |
| Amazon S3 | File storage | Files you upload and media you generate |
| Stripe | Payments | Your billing details, entered directly with them |
| Email delivery | Transactional email | Your email address and the message |
| PostHog | Product analytics and session replay | Usage events, replay recordings — only after you consent |
| Sentry | Error monitoring | Error reports carrying your account identifier only |
Some of these providers are outside the European Economic Area. Where that is the case, transfers rely on the safeguards those providers offer, such as standard contractual clauses.
Your prompts and uploads are sent to the AI provider you are using in order to produce a response. Their handling of that content is governed by their own terms.
Cookies and analytics
Strictly necessary cookies keep you signed in and remember your language and your cookie choice. These do not require consent.
Analytics and session replay run only if you accept them. Session replay records how you interact with the interface; the text you type into form fields is masked and is not captured. You can change or withdraw your choice at any time through Cookie preferences in the footer. Withdrawing consent stops further collection and clears the analytics identifiers from your browser.
Error monitoring runs without consent, under our legitimate interest in keeping the service working. Those reports carry your account identifier so we can correlate a failure to a session — they do not carry your cookies, your request contents, or your IP address.
The Cookie Policy describes each cookie in more detail.
How long we keep it
Account data and your content are kept while your account exists. Delete your account and they are deleted with it, including your chats, documents, generated media and credit balance. Billing records are kept for as long as tax and accounting law requires. For a hosted server, the time zone and the time of its last model call are kept for as long as the server exists. Analytics data follows the retention period configured in PostHog; error reports follow Sentry's.
Your rights
If you are in the UK or the EEA you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a portable copy, and withdraw consent at any time. You can delete your account and everything attached to it yourself from Settings → General. For anything else, use the contact page.
You also have the right to complain to your local data protection authority.
Changes
If this policy changes materially we will update the date above and, where the change affects you meaningfully, tell you in the application.