1. What we collect
- Account data — name, email, and a salted password hash. We never store plaintext passwords.
- Organization data — org names, memberships, roles, and invitations.
- Service data — the projects, functions, buckets, databases, and domains you create, plus configuration you provide.
- Usage and audit data — API calls, resource events, and audit logs (actor, action, timestamp) kept for security and billing. AI Gateway request logs record the model, token counts, cost and timing, never the prompt or the answer.
- Sign-in data — the IP address and browser of each session, so you can see and end your sessions.
- Your app's data — when your app uses Harakumo sign-in, email, payments, memory or agents, we hold your users' emails, names and password hashes, buyers' emails and countries, email recipients and subjects, memory items, and agent run inputs, outputs and tool results, on your behalf.
- Support data — messages you send through our contact form.
2. What we don't do
- We do not sell your personal data.
- We do not use your deployed code or stored content to train AI models.
- We do not read the contents of your storage buckets or databases except as needed to operate the Service or as required by law.
3. Cookies
We use a single essential session cookie (hk_session) to keep you signed in, and a preference cookie for your active organization. Nucleus, your projects' code home, is at nucleus.harakumo.com. It keeps you signed in there with its own hk_session, which ends when you sign out of either, and, for ten minutes while you sign in there,hk_nucleus_state, which checks that the sign-in started in your browser. We do not use third-party advertising or tracking cookies.
4. How data is used
Data is used to operate and secure the Service, meter usage for billing, prevent abuse, and communicate with you about your account. Aggregated, de-identified statistics may be used to improve the platform.
5. Sharing
Your workloads run on infrastructure providers (edge hosting, file storage, databases and email delivery), payments are handled by our payment processor, and domains are registered through our registrar. These processors act under data-processing terms. We share data with them only as needed to provide the Service, and with authorities only when legally required.
When you use the AI Gateway, your prompt and the answer go to the company that makes the model: the model you name, or, with harakumo-1 (the default when no model is named), the first available model in its order, which moves to another company's model if one fails. You can switch any model off for your workspace. Embeddings and edge models run on our infrastructure provider. Harakumo's request log keeps the model, token counts, cost and timing, never the prompt or the answer, and deletes it after 30 days. Agent runs keep their input, output and each tool call so you can review them; a daily clean-up deletes finished runs once they are more than 90 days old, and deleting the agent deletes them at once. We do not train AI models on your code, content or prompts. What a model company does with API traffic is set by its own terms.
Domains bought or transferred in through Harakumo are registered with Harakumo as the registrant of record, using Harakumo's contact details, so your name and contact details are not sent to the registrar or published in the domain's registration data.
6. Security
Passwords are hashed with salted PBKDF2-SHA256, API keys and session tokens are stored as SHA-256 digests and API keys are shown only once, sessions are httpOnly cookies, and two-factor sign-in is available. Harakumo staff need two-factor sign-in for every page and action in our admin tools. Every change they make to your workspace there is recorded in your workspace's audit log, and so is opening your workspace there. See our Security page for what staff can and cannot see, and what we are still switching on.
7. Retention and deletion
Account data is kept while your account is active. When you delete a resource, a workspace or your account, it is removed from production systems straight away and cannot be recovered, so download anything you want to keep first. What stays after a delete, and for how long, is on our Security page. Records in our own database can remain in the backups we keep to recover from failures, until those backups are deleted; we will state the retention period here once it is set. We keep the minimal records we must retain for legal, tax or billing purposes, such as payment, refund and balance history and who it concerned.
8. Your rights
You can see and correct your account details, download a copy of your account data (your account, workspaces and roles, sign-ins, connected AI assistants, the API keys you made, messages you sent us and your recent activity), and delete your account, from the dashboard. To get a copy of the personal data we hold about you beyond that, or for anything else the dashboard does not cover, contact us. Depending on your jurisdiction (including the EU/EEA under GDPR and California under CCPA), you may have additional rights, which we honor regardless of where you live.
9. Contact
Privacy questions or requests? Contact us and mention "privacy" in the subject line.