Hatz AI

GDPR overview

The privacy policy, last updated on 3 February 2026, engages with the GDPR in concrete terms rather than in passing. It names the Article 6 legal bases used — consent, legitimate interests, contract performance and legal obligations — and lists the rights available to residents of the EEA, the United Kingdom and Switzerland, including access, rectification, erasure, objection, portability, withdrawal of consent and complaint to a supervisory authority. Transfers are addressed directly: servers sit in the United States and Standard Contractual Clauses are cited as the safeguard. Requests are routed first through the customer's MSP, or directly to help@hatz.ai. Three gaps remain visible: no Article 27 EU representative is designated, no data protection officer is named, and no subprocessor list or data processing agreement is published.

Who owns the data?

Customers keep ownership. The End Customer Terms state that Hatz AI claims no ownership of End Customer Data, including uploaded documents, prompts and generated outputs, and the Terms of Use confirm that MSP Content stays the exclusive property of the MSP. Hatz receives only a limited, non-exclusive, revocable licence to process that data in order to deliver the service through the MSP, and it is expressly barred from using it to train or improve models for other customers. Two carve-outs matter: operational and usage data such as logs, volumes and workflow metadata belong to Hatz, and Hatz holds a perpetual right to aggregate and anonymise MSP Content for product improvement and benchmarking.

Reuse rights

End users may reuse their own inputs and the outputs the platform generates without asking Hatz for permission: as between the parties, the customer owns all right, title and interest in that material, and Hatz creates no derivative works beyond the outputs the user requested. The terms are honest about the limits of that freedom, however. Outputs are delivered as is, with no warranty of accuracy, completeness or timeliness; the same or a similar output may be produced for another customer, and the customer has no claim over what other users receive; Hatz makes no representation that outputs are protectable by intellectual property rights, nor that they avoid infringing someone else's. Commercial reuse is therefore permitted but sits entirely at the customer's own risk, and feedback sent to Hatz about the product is separately licensed to Hatz on a perpetual, irrevocable basis, although normal working data such as queries and uploaded documents is explicitly excluded from that feedback licence.

Data retention & training

Hosting summary

All conversation histories, user settings and organisational data are held in secured AWS data centres in Virginia, in the United States, logically separated by tenant, organisation and user. The privacy policy confirms that the servers sit in the United States and that service providers in other countries may be involved; for transfers from the European Economic Area, the United Kingdom or Switzerland, Standard Contractual Clauses are cited as the safeguard. The architecture deliberately separates the inference layer from stored history, so the models hold no persistent access to earlier interactions unless a user explicitly brings them back. A multi-cloud approach keeps several model families, including Anthropic, Llama, Mixtral and Google models, inside controlled environments, while calls to external APIs such as OpenAI are governed by agreements specifying near-zero retention and no training. Encryption in transit and at rest, role-based access controls, multi-factor authentication, vulnerability management and audit logging complete the picture. No European data residency option is announced.