This policy explains what Hassle collects, how we use it, and the controls you have. The short version: we're local-first, we store derived claims rather than your source, and you decide what leaves your environment.
Account data. Name, email, organisation, role and authentication details needed to run your workspace.
Verification data. Identity and address information you submit for vetting. This is encrypted, used only for verification, and never exposed to investors.
Derived evidence. Structured findings produced by the local scanner and connectors — architecture summaries, test maturity, security posture, verified revenue and usage. We store the claims, not the underlying source.
Activity. Access requests, questions, grants, publishes and exports, retained as an audit trail for you and the relevant counterparty.
The scanner runs in your environment. By default it does not upload raw source files, .env files, secrets, customer data or raw logs. What leaves your machine is the set of derived claims you choose to make available, at the access level you set.
Summaries can be generated through Hassle's governed model gateway, your approved provider, or a private local model. In all cases, only structured findings are sent to a model — after redaction — and you can preview the exact payload with hassle scan --preview-model-context. Model-generated content is always labelled separately from verified claims. Model choice changes the provider and billing path; it does not change the trust boundary.
Investors and legal counsel only see what you approve, at the level you grant. We do not sell raw founder data. We share data with infrastructure sub-processors strictly to operate the service, under contract. Where a fund or firm uses enterprise BYOK, their provider credentials are isolated per organisation and Hassle still enforces redaction, scope and audit.
You can access, correct, export or delete your data. You can revoke any investor or legal access instantly, pause your room, and delete your evidence bundle. Under UK GDPR you also have rights to object and to lodge a complaint with the ICO.
We keep derived evidence and audit logs for as long as your workspace is active, and for a limited period afterwards to meet legal and dispute-resolution obligations. Deleting your evidence bundle removes derived claims; audit records of past disclosures are retained where required.
Questions about privacy or a data request? Reach our team at the contact page or email privacy@hassle.dev.