Hikaia — Privacy Policy
1. Introduction
Hikaia, Inc. ("Hikaia," "we," "us," "our") provides an AI-powered marketing automation platform (the "Service"). This Privacy Policy explains what personal information we collect through the Service and our website, how we use it, who we share it with, how long we keep it, and the rights you have with respect to it. Capitalized terms not defined here have the meanings given in the Hikaia Terms of Service, available at hikaia.ai/terms.
This Policy applies to visitors of hikaia.ai, individuals whose organizations subscribe to the Service (each, a "Customer"), users authorized by a Customer to use the Service, and third parties whose information is submitted to the Service by a Customer.
2. Information We Collect
We collect the following categories of information:
Account and Identity Information. Name, work email address, company name, job title or role, billing contact, phone number (optional), and authentication identifiers such as passwords (hashed) or single sign-on tokens. When Customer connects a Third-Party Platform account (for example LinkedIn or Meta), the Service receives and stores OAuth access and refresh tokens issued by that platform. These tokens allow the Service to publish or read content on Customer's behalf and are treated as Customer Data. Tokens are stored in access-controlled storage and are revoked when Customer disconnects the account, when a token expires, or when Customer requests deletion.
Customer Materials. Any content a Customer or its authorized users upload, create, generate, or transmit through the Service — including brand assets, briefs, prompts, campaigns, drafts, feedback, revisions, media files, and generated outputs. Customer Materials may contain personal information about the Customer's employees, contractors, customers, or other third parties.
Usage Data. In-product actions, features used, buttons clicked, sessions started and ended, session duration, click paths, page views, timestamps, and error events.
Technical Data. IP address, device identifiers, browser type and version, operating system, screen size, language, referrer URL, and cookies and similar technologies (see Section 8).
Third-Party Platform Data. When a Customer connects an external account (for example, LinkedIn, Meta, X, or a CRM) to the Service, we receive information returned by that platform's APIs, which may include profile information for the connected account, page or channel metadata, published-post metadata, engagement statistics, and delivery outcomes.
Payment Information. Billing contact name, billing address, plan level, invoice history, and, once a production billing rail is live, the last four digits and card type of the payment method. Full payment card numbers will be collected and stored by our payment processor; Hikaia does not itself store full card data.
Communications. Support requests, emails, in-product chat transcripts, feedback submissions, survey responses, and records of our correspondence with you.
Prohibited Data (No Health Information)
The Service is a marketing automation tool, not a medical, clinical, financial, or otherwise regulated system. We do not intentionally collect, and Customer is strictly prohibited from submitting, any Protected Health Information (PHI), patient records, recognizable patient images, clinical outcomes, identifiable medical histories, Payment Card Industry (PCI) data, or other data subject to sector-specific regulation that the Service is not designed to process. If we discover that such information has been uploaded to the Service in violation of our Terms of Service, we reserve the right to immediately delete the data and suspend the violating Account to protect the integrity of our systems.
3. How We Use Information
We use the information described above to:
Provide, operate, maintain, and secure the Service, including authentication, session management, and account administration.
Personalize outputs and tailor Service behavior to the Customer's brand, voice, and prior interactions (per-tenant editorial memory).
Bill Customers, process payments, and manage subscriptions.
Communicate with users about the Service, including transactional notices, security alerts, product updates, and, subject to applicable law and preferences, marketing communications.
Monitor for abuse, fraud, security incidents, and violations of the Terms of Service, and enforce our policies.
Train, fine-tune, evaluate, and improve AI Systems that power the Service, on the scopes described in Section 8 of the Terms of Service (operational processing, tenant-specific personalization, Aggregate Data, and opt-in generalized model training).
Produce aggregate insights, benchmarks, and analytics for internal use and, where the data is de-identified and aggregated, for external publication.
Comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.
4. Use of Artificial Intelligence
Hikaia uses artificial intelligence to power core Service features. Certain Service functionality relies on Hikaia-developed AI orchestration, rules, personalization systems, and third-party AI models, currently including models provided by Anthropic and OpenAI (and other providers Hikaia may add or replace over time as disclosed on our sub-processors page). Customer Materials, prompts, feedback, and interactions may be processed by these AI systems and, subject to the Terms of Service, may be used to improve the Service or to train models on the scope described in Section 8 of the Terms of Service (which distinguishes operational processing, tenant-specific personalization, aggregate learnings, and opt-in generalized model training).
Certain features may process Customer inputs through commercial web tiers of third-party AI providers rather than through direct enterprise APIs. Data submitted through those channels may be subject to the training rights and data usage policies of the underlying third-party providers. Where feasible, Hikaia configures third-party provider settings to opt out of provider training and to limit data usage to the extent supported by the provider.
The safety guardrails referenced in Section 5A of the Terms of Service are controlled principally by the underlying third-party AI providers; Hikaia does not independently guarantee detection of any specific category of prohibited content. AI outputs are probabilistic and may contain errors, inaccuracies, or content requiring editorial review before publication.
4A. Hikaia's Legal Roles
Hikaia may act as a "controller" or "business" (as defined by applicable data protection law) for its website, billing, account administration, direct communications, and its own corporate analytics. Hikaia acts as a "processor" or "service provider" for Customer-supplied personal information used solely to provide the Service to Customer. For processing subject to the EU/UK GDPR, California CPRA/CCPA, or comparable laws, Hikaia's processing role and obligations are governed by the applicable Data Processing Addendum.
5. Third-Party Service Providers and Sub-Processors
Hikaia uses third-party providers to operate the Service. As of the effective date of this Policy, Hikaia's material sub-processors include, by category:
Application hosting — a cloud application platform used to host the Hikaia web application (currently Railway; migration to a different managed platform is planned).
AI model providers — third-party AI providers whose models Hikaia uses to generate Outputs; currently including Anthropic and OpenAI.
Video generation providers — third-party services used to generate video assets; currently including Higgsfield.
Third-Party Platform APIs — platforms Hikaia integrates with on Customer's authorized behalf, including LinkedIn, Meta (Facebook, Instagram), Medium, and others named in the Terms of Service.
Source-code hosting — used to store Hikaia's proprietary source code; Customer Materials are not stored in the source-code repository.
Additional providers (payment processing, analytics, error monitoring, email delivery, customer support) will be added to Hikaia's sub-processor list when they are contracted; those providers are not currently in production. The current sub-processor list is available at hikaia.ai/subprocessors. For processing subject to GDPR-style processor obligations, Hikaia will provide notice of material sub-processor additions or replacements and an opportunity to object as required by the applicable Data Processing Addendum.
6. Data Storage and Security
Hikaia maintains commercially reasonable administrative, technical, and organizational safeguards appropriate to the nature of the Service and the information processed. Specific security measures applicable to an Enterprise subscription, if any, will be described in the applicable Order Form, Data Processing Addendum, or Security Exhibit. No method of electronic transmission or storage is completely secure, and Hikaia does not guarantee absolute security. Hikaia will notify Customer of any confirmed security incident affecting Customer Data in accordance with applicable law.
7. Data Retention and Deletion
Hikaia retains personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data category and legal requirement.
A Customer may delete Customer Materials at any time through in-product controls. Deleted Customer Materials are removed from active systems within thirty (30) days and from backups within ninety (90) days, subject to the exceptions described in the Terms of Service (including legally-required retention, log files that expire on their normal retention schedule, and transformed, de-identified, or aggregated derivatives used to train AI Systems or produce Aggregate Data, which are not reversible).
Individuals may request deletion of personal information about them by contacting support@hikaia.ai. We will honor deletion requests to the extent required by applicable law and after verifying the requester's identity.
8. Cookies and Tracking Technologies
Hikaia and its analytics providers use cookies, local storage, and similar technologies to operate the Service, remember preferences, understand usage, and improve the product. Categories include:
Strictly Necessary. Required for authentication, session management, and security. These cannot be disabled through the Service.
Performance. Help us understand how the Service is used so we can improve it (for example, product analytics).
Functional. Remember user preferences and personalization.
Analytics. Measure engagement with our website and marketing pages.
Where required by law, we present a cookie banner allowing you to accept or reject non-essential cookies. You can also control cookies through your browser settings; blocking essential cookies may impair the Service.
9. Your Rights
Depending on your jurisdiction, you may have rights over personal information about you, including:
Access. Request confirmation of whether we process personal information about you and a copy of that information.
Correction. Request that we correct inaccurate or incomplete personal information.
Deletion. Request that we delete personal information about you, subject to exceptions in applicable law.
Portability. Request a copy of certain personal information in a structured, commonly used, and machine-readable format.
Restriction or Objection. Request that we restrict or object to certain processing of personal information about you.
Withdraw Consent. Where processing is based on consent, withdraw that consent at any time (without affecting the lawfulness of prior processing).
Opt-out of Sale or Sharing. Where applicable law provides such rights (for example, CCPA/CPRA), opt out of the "sale" or "sharing" of personal information. Hikaia does not sell personal information for money and does not share personal information for cross-context behavioral advertising.
Non-discrimination. We will not discriminate against you for exercising your rights.
California Notice at Collection
In accordance with the California CPRA/CCPA, Hikaia collects the categories of personal information described in Section 2 above for the purposes described in Section 3. Hikaia does not "sell" personal information as that term is defined under the CPRA and does not "share" personal information for cross-context behavioral advertising. Hikaia may disclose personal information to the sub-processor categories described in Section 5 for the operational purposes of providing the Service. Hikaia retains personal information for the periods described in Section 7 and for so long as necessary to provide the Service and to comply with legal obligations. California residents may exercise their rights (know, delete, correct, limit use of sensitive personal information, opt out of sale/sharing, non-discrimination) as described in this "Your Rights" section.
To exercise these rights, email support@hikaia.ai. If you are an authorized user of a Customer's account, please also contact your Customer administrator, who acts as the data controller with respect to Customer Materials. We may need to verify your identity before responding. You may have the right to lodge a complaint with your local data protection authority.
10. International Data Transfers
Hikaia is based in the United States. Personal information we collect may be transferred to, stored in, and processed in the United States or in other countries where Hikaia or its sub-processors operate. Data protection laws in those countries may differ from those in your country of residence. Where required by law, Hikaia relies on Standard Contractual Clauses, adequacy decisions, or equivalent transfer mechanisms to legitimize transfers of personal information from the European Economic Area, the United Kingdom, or Switzerland to countries that have not received an adequacy determination.
11. Children
The Service is not directed to children under the age of 16, and Hikaia does not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without parental consent, we will delete that information. If you believe a child has provided us with personal information, please contact support@hikaia.ai.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Where required by applicable law, we will provide notice of material changes and obtain consent where consent is required.
13. Contact
Questions or requests about this Privacy Policy may be directed to: