Privacy Policy

1. Who handles your information

HussleBook is a product/trading name. In these policies, “we”, “us” and “our” refer to the operators of the service. For support, privacy requests and customer grievances, contact [email protected].

For account, billing, support and security activities, the operators determine the relevant purposes and means of processing. For personal data in business customer documents, the customer may be controller/Data Fiduciary and HussleBook its processor, depending on the arrangement. Business customers who need a data processing agreement can request one at [email protected].

Dodo Payments acts as an independent controller for its payment, transaction-tax, fraud and dispute activities. Its merchant-of-record role does not transfer responsibility for HussleBook’s app data processing to Dodo.

2. Information we handle

We handle name, email, authentication identifiers and approved sign-in profile details; uploaded documents/images, text and metadata; extracted fields/JSON, embeddings, prompts, conversations and outputs; technical identifiers, request/device information, usage and diagnostic records; and billing references, purchases, subscription/refund status and support correspondence. Dodo handles payment-method details entered in its checkout. Do not send passwords or full payment-card details to support.

3. Purposes and legal grounds

We process information to authenticate accounts, operate workspaces, provide requested document/AI features, meter usage, process billing, prevent abuse, troubleshoot problems, respond to requests and meet legal obligations. Where applicable, legal grounds include contractual necessity, legal obligations, consent and legitimate interests assessed against your rights. The lawful basis for personal data inside customer uploads also depends on the customer’s authority and instructions. We use limited usage analytics under our legitimate interest in understanding and improving the service (see section 7); you can object at any time by emailing [email protected]. Optional analytics cookies use separate consent.

4. How AI processing works

Requested features may process original documents/images, extracted text, structured fields/JSON, prompts, relevant conversation context, outputs and embeddings used for retrieval. Only relevant information is sent to the providers/components involved in the selected operation. Search or other optional tools may involve additional recipients listed under Service providers.

AI providers’ handling, retention and any training use depend on their applicable contracts, endpoints and account settings. We do not describe unverified training opt-outs, zero-retention settings or regional guarantees as active. We do not take a general license to publish customer documents or sell them as training datasets. Necessary provider details and applicable arrangements are available through the service-provider list and support.

Extraction and chat can omit information, hallucinate, misidentify fields or produce invalid/inaccurate results. Check important outputs against source documents and apply human judgment. AI output is not a guarantee or regulated professional advice. Generated content may not be unique and may involve third-party rights.

Deleting a source and clearing related extracts, embeddings, artifacts or backups are distinct operations; see Retention and deletion.

5. Providers and international processing

Relevant service providers receive only information needed for their functions, including application hosting/storage, AI inference and embeddings, authentication, email and diagnostics. Dodo also acts independently for payment, tax and fraud obligations; Google has its own sign-in privacy terms. See Service providers for the relevant organizations and purposes. Self-hosted software is distinguished from a vendor receiving data.

Information may be processed outside your country. We identify applicable recipients, locations and legally required transfer safeguards before restricted transfers. Contact us for applicable details; this notice does not promise that all information remains in India or that an unexecuted transfer agreement is already in place.

6. Service providers

A locally used MaxMind GeoLite2 database is distinguished from a managed vendor receiving user queries. The actual hosting organization and any enabled external search/tool recipient must be identified for the relevant processing; contact support for applicable details.

We review new recipients and purposes before activation and follow any applicable notice, objection and contractual requirements. Contact us at [email protected].

7. Cookies and analytics

Essential app storage supports sign-in, security, preferences and operation.

Website visits. Our website counts visits with PostHog without setting cookies or using device storage; PostHog derives a short-lived anonymous hash on its servers to tell visits apart.

Product usage. From 27 October 2026, 8:30 am US Eastern Time (12:30 UTC), we record a small set of product events (for example “uploaded a document” or “started a subscription”) linked to a pseudonymous account ID, as part of operating and improving the service, under our legitimate interest. These events never include document contents, filenames, questions or email addresses. If you object, email [email protected] and we will stop recording them for your account.

Optional analytics cookies. Analytics cookies that follow your use of the website and app in more detail run only if you choose “Yes”, during onboarding, in the cookie banner, or in the Privacy section of your profile menu (select your name at the top right of the app). Your choice is stored in a cookie shared by our website and app so you are not asked twice, and you can withdraw it in either place at any time.

Withdrawal or objection stops future optional collection but does not erase records we must lawfully retain. Diagnostic and security processing is assessed separately from analytics.

8. Retention and deletion

Current signup benefits provide 15 days of free access and a 30-day window to preserve eligible signup benefits by subscribing. After free or paid access ends, the current lifecycle provides 30 days of read-only access, then freezes viewing/downloads until paid access is restored. Billing expiry and cancellation do not automatically purge workspace data. This is not a promise of indefinite storage.

Export accessible information before requesting deletion. Moving a document to Trash, permanently deleting it and erasing an account are different actions. Use available controls or contact us at [email protected]. Account erasure requires proportionate identity and intent verification. If external cleanup fails, deletion remains incomplete; some content may already have been removed. Retry or contact support for follow-up. Backups, provider-held copies and restricted legal records require separate handling.

Backups, diagnostic/security logs, provider-held records and legally necessary billing or dispute evidence may follow separate restricted retention schedules. We retain them only for justified purposes and applicable obligations, restrict further use, and delete or anonymize them when no longer needed. Exact periods must reflect verified operational and legal requirements; contact support for the applicable arrangements. A billing cancellation is not an instruction to erase legally required records.

Use the in-app controls or contact us for access, export, correction, deletion or retention questions. We explain lawful restrictions or exceptions and applicable response timelines.

9. Requests, complaints and children

Contact us at [email protected] for applicable access, correction, deletion, export, restriction, objection or consent-withdrawal requests. We verify identity proportionately and explain any lawful refusal or extension, using applicable response deadlines. Business-document requests may need to be handled through the customer responsible for that data. You may complain to an authority or forum where the law permits.

Accounts are for adults aged at least 18 or the higher applicable age of majority. Adults may upload information about children only with appropriate authority and safeguards. Tell us if a child has created an account. Regional rights, including UK/EEA and applicable US state rights, depend on the law and circumstances; mandatory rights are preserved.

10. Indian data-protection requirements

India’s Digital Personal Data Protection Act, 2023 and notified Rules have phased commencement. We distinguish provisions in force from those commencing later and apply requirements as they become applicable. This notice does not claim that every DPDP provision was already in force on the review date. Applicable existing privacy, security and consumer obligations continue to be assessed. Privacy requests and grievances go to our Grievance Officer (designation: Grievance Officer, HussleBook) at [email protected].

11. Security, incidents and changes

HussleBook uses authenticated access, account-scoped authorization, encrypted HTTPS connections and controlled operational access. Security controls are maintained and assessed for their intended function; no statement here is a certification, penetration-test result or guarantee that attacks or data loss are impossible.

Protect your sign-in provider, devices and credentials. Upload only authorized material and verify exports before sharing. Do not place information in HussleBook that requires an unagreed regulated or specialized security arrangement. Keep independent copies of important source documents.

Report suspected account compromise or a vulnerability to us at [email protected]. Include the affected feature, approximate time and a safe description; do not send passwords, live credentials or unnecessary customer documents. Do not exploit a suspected issue to access other customers’ data.

We assess reports, restrict inappropriate access, mitigate confirmed incidents and make legally required notifications to affected customers, individuals or authorities. We do not publish internal network layouts, access credentials or detailed defensive procedures.

No system is risk-free. Material changes to this notice are communicated through the app or account email; legally required new consent is obtained separately.