Privacy Policy

Last Updated: November 24, 2025

Hatchpad Studio ("we," "our," or "us") is the creator of Oli, an AI-powered website builder. This Privacy Policy describes how we collect, use, process, and disclose your information, including personal data, in conjunction with your access to and use of the Oli platform and our website (collectively, the "Services").

This Policy is incorporated into and is subject to our Terms of Service. By using our Services, you acknowledge that you have read and understood this Policy.

1. Definitions and Data Categories

To ensure clarity, we distinguish between two types of data we collect:

"Customer Data": This refers to the proprietary inputs and outputs generated within your workspace. It includes:
- Input: Your natural language prompts, design constraints, uploaded assets (images, logos), and specific instructions.
- Output: The code (HTML/React/Tailwind), website layouts, and file structures generated by Oli.
"Service Data": This refers to the operational telemetry we collect to run the platform. It includes:
- Usage Logs: Button clicks, feature adoption rates, session duration, and API latency metrics.
- Device Data: IP address, browser type, operating system, and crash reports.

2. Artificial Intelligence & Model Training

This section governs how your data interacts with our AI infrastructure (the "AI Gateway").

2.1. The "Value Exchange" (Data Training)

We operate a tiered data usage policy to support our Free Tier availability:

Free Tier Users: By using the Free Tier, you grant us a non-exclusive, worldwide, royalty-free license to use your anonymized Customer Data (Prompts and Generated Code) to fine-tune and improve Hatchpad Studio's proprietary AI models. We strip personally identifiable information (PII) before entering this data into any training set.
Paid Tier Users: We do not use Customer Data from Paid Subscription workspaces to train our general-purpose AI models. Your proprietary logic and prompts remain isolated to your workspace.

2.2. Third-Party AI Sub-Processors

Oli utilizes Large Language Models (LLMs) from third-party providers to generate code.

Pass-Through Processing: When you submit a prompt, strictly necessary data is transmitted to providers (including OpenAI, Anthropic, and Google Gemini) solely for inference (generating the response).
No Third-Party Training: We have configured our API integrations to opt-out of data training by these third-party providers where available. Your data is not used to improve OpenAI or Anthropic's public models.

3. Information We Collect

A. Information You Provide

Registration Data: We collect your name, email address, and profile picture via Supabase Auth (supporting Email and Google OAuth).
Billing Data: All payment data is handled directly by Stripe. We store only the reference ID and subscription status; we do not touch or store full credit card details.
Beta Feedback: During our Private Beta, we may collect qualitative feedback you provide via email, Discord, or in-app surveys.

B. Information Collected Automatically

Application Telemetry: We use PostHog to record session replays and clickstream data. This helps us understand UX friction points.
Deployment Metadata: When you publish a site, we log the build status, Vercel deployment URL, and error logs associated with the build process.

4. How We Use Your Information

We process your data for the following legitimate business interests:

Service Provision: To generate, host, and deploy your web projects.
Platform Security: To detect unusual API spiking, abuse, or unauthorized access attempts.
Debugging (Beta Phase): To analyze crash logs and resolve "hallucinations" (errors) in the AI's code generation.
Communication: To send transactional emails (e.g., "Build Complete," "Subscription Invoice") and, with your consent, product updates.

5. Data Sharing and Sub-Processors

We do not sell your personal data. We transfer data to the following third-party sub-processors to power our infrastructure. We have entered into data processing agreements with these vendors where applicable.

Sub-Processor	Role	Location
Supabase	Database, Auth, & Backend	USA
Vercel	Website Hosting & Edge Functions	USA
Stripe	Payment Processing	USA
PostHog	Product Analytics & Telemetry	USA
OpenAI	AI Inference Provider	USA
Anthropic	AI Inference Provider	USA
Google (Vertex AI)	AI Inference Provider	USA

6. Roles: Controller vs. Processor

Hatchpad Studio as Controller: We act as the Data Controller for your account information (name, email, billing status) and Service Data.
Hatchpad Studio as Processor: We act as the Data Processor for the Customer Data (the websites you build) and any end-user data your published websites might collect. You are the Controller of the websites you create; we merely provide the infrastructure.

7. Private Beta & Data Integrity

Beta Disclaimer:

Oli is currently in Private Beta. The Services are provided "AS IS" and "AS AVAILABLE."

Data Loss Risk: You acknowledge that experimental features may result in data inconsistency or loss. We reserve the right to perform database resets ("wipes") if necessitated by significant architectural changes. We will make reasonable efforts to notify users via email prior to any planned resets.
No Service Level Agreement (SLA): During the Beta phase, we do not guarantee specific uptime percentages.

8. Data Retention and Deletion

We retain your personal information only as long as necessary to fulfill the purposes for which it was collected.

8.1. Retention Periods by Category

Customer Data (Active Accounts): We retain your Customer Data (projects, code, and prompts) for as long as your account is active.
Service Data (Telemetry): We retain high-resolution logs for 90 days to assist with debugging. After this period, Service Data is aggregated and anonymized and retained indefinitely for long-term product analytics.
Billing Data: We retain billing transaction history for a period of 7 years to comply with tax and accounting regulations.

8.2. Account Deletion & The "AI Exception"

If you request the deletion of your account:

Personal Identifiers: We will permanently delete or anonymize your name, email, and billing details from our active databases within 30 days.
Backups: Encrypted fragments of your data may persist in our disaster recovery backups for up to 90 days.
AI Training Data (The Exception): You acknowledge that anonymized User Input (prompts) and Generated Output (code) previously used to fine-tune our AI models prior to your deletion request cannot be extracted or deleted from the neural network weights. This anonymized data is retained indefinitely.

9. International Data Transfers

Hatchpad Studio is based in the United States. If you are accessing the Services from the European Economic Area (EEA), United Kingdom, or Switzerland:

You acknowledge that your data will be transferred to and processed in the United States.
We rely on Standard Contractual Clauses (SCCs) and the necessity of performance of a contract to legitimize these transfers.

10. Your Rights

Subject to local law (e.g., GDPR, CCPA), you have the right to:

Access: Request a copy of the personal data we hold about you.
Rectification: Correct inaccurate personal data in your settings.
Erasure: Request the deletion of your account.
Export: You retain full ownership of the code generated by Oli (subject to payment of fees). You may export this code at any time via the "Export" feature.

11. Cookies and Tracking

We use cookies to distinguish you from other users of our Service.

Essential Cookies: Required for Supabase Auth (keeping you logged in) and Stripe (processing payments). You cannot opt-out of these.
Analytics Cookies: Used by PostHog and Google Analytics to track performance. You may opt-out of these via your browser settings.

12. Contact & Data Protection Officer

For privacy concerns, data subject requests, or questions regarding this policy, please contact us at:

Email: founders@witholi.com

Subject Line: Privacy Inquiry

Mailing Address: 418 BROADWAY STE R, ALBANY, NY, UNITED STATES, 12207