Desktop app privacy

Controller and processor roles

When a company deploys Hapi for its staff, contractors or other authorised users, that company is normally the controller of workplace data processed in Hapi. Hapi AI Ltd acts as the company's processor and processes that data under the company's instructions, our agreement with the company, and our data processing terms.

Hapi AI Ltd is an independent controller for limited business data we use to run Hapi, such as account administration, authentication, billing, support, security logs, legal compliance and basic website communications.

Data Hapi may process

The exact data depends on the configuration chosen by the customer and user. Hapi may process:

• Account and team data: name, email address, user ID, team, role, invite status, authentication/session data and support identifiers.
• Device and app metadata: device ID, operating system, app version, app names, process/window names, window titles, focused window, open top-level windows, timestamps and capture status.
• Screen and text context: screenshots or image frames, OCR text, accessibility text, UI element metadata, browser URLs, page titles, full-text indexes and capture-derived summaries.
• User interaction context: app switches, mouse clicks, scroll/copy/paste events, aggregated text input, element context and clipboard content where configured. Individual keystroke capture is not enabled by default.
• Audio and meetings: microphone or system audio chunks, transcripts, speaker labels, meeting app, meeting title, attendee metadata and meeting timing where audio or meeting features are enabled.
• Connected services: data from services a customer or user connects, such as email, calendars, contacts, WhatsApp, browser automation tools, document stores, portals and other business systems.
• Knowledge graph and automation data: structured records and relationships Hapi creates from captured work context and connected systems, such as clients, properties, tasks, communications, approvals, workflow history, action logs, prompts, AI outputs, and generated documents or messages.
• Operational data: logs, crash reports, diagnostics, security events, billing records and communications with Hapi.

Where enabled, Hapi uses filtering and redaction controls designed to reduce unnecessary capture of personal or sensitive content. However, because Hapi observes workplace context, captured data may still include personal, confidential, special category or third-party data visible in workplace tools. Customers can also configure Hapi so that it collects only what is necessary for their purpose.

How Hapi uses data

For company services, Hapi processes customer-controlled workplace data to provide the service, including to:

• capture and index work context so users can search, replay and understand work activity;
• learn repeatable workflows and build a company knowledge graph;
• suggest tasks, draft outputs and support approved automation;
• run connected integrations and browser or portal workflows requested by the customer;
• maintain security, reliability, debugging, auditability and support.

Hapi does not sell customer data. Hapi does not use customer data to train general-purpose AI models unless a customer has expressly agreed to that in writing; data received from Google APIs is never used to develop, improve or train generalised AI or machine-learning models under any circumstances (see Google user data). Hapi is designed to assist humans and should not be used as the sole basis for employment, disciplinary or similarly significant decisions.

Google user data

Customers can connect Google accounts to Hapi (Gmail, Google Calendar, Google Contacts and Google Drive). When a Google account is connected, Hapi accesses data through Google's official APIs, using only the permissions granted on the Google consent screen:

• Gmail: Hapi reads messages, threads and attachments to show the connected mailbox inside Hapi, to answer questions about correspondence and to prepare replies, and sends emails a user has approved. Hapi does not label, archive, alter or delete mailbox content.
• Google Calendar: Hapi reads calendars and events to show availability and upcoming appointments, and — with a user's approval — creates, updates or removes events, creates calendars, shares a calendar with a person the user names, and adds calendars that have been shared with the user. Hapi never shares a calendar or changes who can access one except at a user's explicit request.
• Google Contacts: Hapi reads contacts so people appearing in emails, calendars and documents can be recognised, and creates, updates or deletes contacts a user has approved.
• Google Drive: Hapi reads files (including Docs, Sheets and Slides) to show them inside Hapi and to work with files users ask about, and — with a user's approval — updates the contents of Docs, Sheets and Slides, and saves new files it has produced into the user's Drive. Hapi does not delete Drive files.

How Google user data is used, stored and shared

Google user data is used only to provide the user-facing features described above, including passing relevant excerpts as context to our AI model providers to carry out an action a user has requested. Google sign-in credentials (OAuth tokens) are encrypted at rest and isolated per customer environment. Data retrieved from Google is shown to authorised users in the customer's Hapi environment and retained according to that customer's configuration, as described in Retention and deletion.

Google user data is never sold, never used for advertising, and never shared with third parties beyond the subprocessors needed to operate the service. Hapi staff do not read Google user data except with permission for support, for security or abuse investigations, or to comply with law.

Hapi's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is never used to develop, improve or train generalised AI or machine-learning models.

Workplace monitoring

Some Hapi features can amount to workplace monitoring because they may capture screenshots, app activity, browser activity, audio, transcripts, interaction events and connected work-system data.

The customer is responsible for choosing an appropriate lawful basis, carrying out any required data protection impact assessment, consulting staff where required, and ensuring Hapi is configured proportionately for its workplace purpose.

Sharing and subprocessors

Customer data may be made available to authorised users and admins within the customer's Hapi environment. Hapi staff may access customer data only where needed to provide support, investigate reliability or security issues, comply with legal duties, or act on the customer's instructions.

Hapi uses third-party providers for hosting, AI inference, authentication, email, billing and related service operations. Our current subprocessor list is available at hapi.foundation/subprocessors.

Where personal data is transferred outside the UK or EEA, Hapi uses appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or equivalent contractual and organisational safeguards.

Retention and deletion

For company-controlled workplace data, the customer decides the retention period unless our agreement says otherwise. Hapi keeps customer content for as long as needed to provide the service, meet the customer's instructions, maintain backups, resolve disputes, comply with law, and protect security.

Local desktop data remains on the user's device until deleted by the user, app settings, device retention controls or uninstall/cleanup processes. In server mode, capture data is streamed to the customer's Hapi environment and retained according to that customer's configuration and contract.

At the end of a customer relationship, Hapi will delete or return customer personal data in line with the applicable agreement, subject to legal, security, backup and audit requirements. Account, billing, support and legal records may be retained for longer where required for Hapi's own compliance and business records.

Security

Hapi uses technical and organisational measures designed to protect customer data, including encryption in transit, access controls, logical customer isolation, least-privilege operational access, authentication, monitoring, backup controls and incident response processes.

Customers are responsible for managing their own users, permissions, connected accounts, endpoint security, staff notices and internal policies for use of Hapi.

User and admin controls

Depending on configuration, Hapi provides controls to pause or disable capture, disable audio or screen capture, limit captured monitors or windows, ignore specified apps or URLs, skip private browsing windows, pause capture for DRM-protected streaming apps, apply text redaction, use offline/local modes, and disconnect integrations.

In team deployments, admins may configure team-level filters, integrations, roles and retention or export processes. Users should contact their employer or company admin if they need details about their company's Hapi configuration.

Your rights

Under UK GDPR and other applicable privacy laws, individuals may have rights to access, correct, erase, restrict, object to or receive a copy of their personal data.

For workplace data controlled by a Hapi customer, please contact that customer first. Hapi will assist the customer in responding where required. For data where Hapi AI Ltd is the controller, contact [email protected].

You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

Changes

We may update this notice as Hapi, our customers' configurations, or legal requirements change. If we make material changes, we will update this page and, where appropriate, notify customers through the channels set out in our agreement.

DPA and subprocessors

Company customers should read this notice alongside their agreement with Hapi, our data processing terms, and the current subprocessor list.