Privacy Policy

1. Who we are

Hapitalist ("Hapitalist," "we," "us," or "our") is a product operated by Hapitalist. The Hapitalist application is available at joy.hapitalist.com. For privacy questions, contact us at support@hapitalist.com. For the purposes of applicable data-protection law, Hapitalist is the "controller" of personal information processed through Hapitalist, except where we act as a "processor" on behalf of a business customer.

2. Scope of this policy

This policy applies to personal information we process when you visit or use Hapitalist, including the website, web application, and related features (collectively, the "Service"). It does not apply to third-party websites, products, or services that we do not control, even if they link to or from the Service. Your use of the Service is also governed by our Terms of Service.

3. Information we collect

We collect information in three ways: information you provide, information generated through your use of the Service, and information from third parties.

(a) Information you provide

• Account information - name, email address, and authentication credentials (we use magic-link / token-based sign-in; we do not store your password in plaintext).
• Profile information - what you're building, your website, stage, self-identified path and ecosystem, goals, and preferences.
• Content you create - journal entries, reflections, reframes, assessment answers, planning inputs, messages, and other content you enter into the Service.
• Communications - messages you send to us, to AI features, or to other members through community and messaging features.
• Payment information - when you purchase a paid plan, payment is processed by our payment processor (Stripe). We receive limited billing details (such as plan, status, and the last four digits of a card); we do not store full card numbers.
• Optional AI keys - if you choose "bring your own key," the API key you provide for a third-party AI provider.

(b) Information generated through use

• Activity & usage data - daily check-ins and ratings, tools used, modules and games played, scores, streaks, and progress.
• Device & technical data - IP address, browser type, device and operating-system information, and similar technical identifiers, collected through logs and similar technologies.
• Diagnostic data - error reports and performance data used to operate and improve the Service.

(c) Information from third parties

• Payment & subscription status from our payment processor.
• Scheduling information if you book a call through our scheduling provider (TidyCal), such as the appointment details you submit there.
• Import data if your account was created from an existing membership or mailing list you previously joined.

4. Sensitive information & wellbeing content

5. How we use information

• To provide, maintain, and operate the Service and its features.
• To personalize your experience - surfacing relevant tools, modules, prompts, and progress.
• To process payments, manage subscriptions, and provide customer support.
• To enable community and messaging features you choose to use.
• To power AI features you engage with (see Section 7).
• To maintain safety and integrity - detecting, preventing, and responding to abuse, harmful content, fraud, and security incidents.
• To analyze and improve the Service, including aggregated and de-identified analytics.
• To communicate with you about the Service, including service announcements and, where permitted, updates.
• To comply with legal obligations and enforce our Terms of Service.

6. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process personal information under one or more of these legal bases: performance of a contract (to provide the Service you request); legitimate interests (to operate, secure, and improve the Service, balanced against your rights); consent (for certain analytics, optional communications, and any sensitive data, where required); and legal obligation (to comply with applicable law). Where we rely on consent, you may withdraw it at any time.

7. Artificial intelligence features

Some features use artificial intelligence to generate responses, reframes, recommendations, and summaries. When you use an AI feature, the content you submit (and relevant context such as your recent activity) may be sent to an AI model provider to generate a response.

• Default provider. By default, AI features are powered by a third-party model provider (Anthropic). Your inputs are transmitted to the provider to return a result.
• Bring your own key. If you supply your own AI provider key, requests are made using that key, and the provider's own terms and privacy practices also apply to you.
• No automated decisions with legal effect. AI outputs are suggestions and reflections. They are not professional, legal, financial, or medical advice and do not produce legal or similarly significant effects about you without human involvement.
• Accuracy. AI outputs can be wrong or incomplete. You are responsible for how you use them.

8. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as described here:

• With service providers who process information on our behalf (Section 9).
• With other members, only for content you choose to make visible - for example, messages you post in community rooms, cohorts, or recognitions you give. Your private journals, assessments, and tool entries are not shared with other members.
• For safety - content flagged as potentially harmful may be reviewed by our team to keep the community safe.
• For legal reasons - to comply with law, legal process, or enforceable governmental requests, and to protect the rights, property, or safety of Hapitalist, our users, or others.
• In a business transfer - in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your consent - for any other sharing you direct or authorize.

8A. SMS / text messaging

If you opt in to receive text messages from Hapitalist, the following applies:

• No sharing of mobile information. Your mobile phone number and SMS opt-in consent are collected solely to send you the messages you signed up for. We do not sell, rent, or share your mobile phone number or SMS opt-in data with any third parties or affiliates for their own marketing or promotional purposes. Any third party we use to deliver these messages on our behalf may use your number only to send them, and for no other purpose.
• Types of messages. A one-time verification code when you link your number, coaching replies from Joy in response to messages you send, and occasional account-related messages such as reminders, check-in nudges, milestone confirmations, and billing or renewal notices.
• Message frequency. Hapitalist is a conversational messaging program. Message frequency is not fixed; it depends on how often you text in and on your account activity.
• Message and data rates. Message and data rates may apply depending on your mobile carrier and plan.
• Opting out. Reply STOP to any message to stop all further messages, START to opt back in, or HELP for help. You can also unlink your number at any time from the Text Joy screen in the app, or email support@hapitalist.com.

9. Service providers & sub-processors

We rely on trusted third parties to operate the Service. They may process personal information only on our instructions and for the purposes we specify. These include, by category:

We aim to keep an accurate list of material sub-processors and will provide further detail on request to support@hapitalist.com.

10. Cookies & similar technologies

We use cookies, local storage, and similar technologies that are necessary to operate the Service - for example, to keep you signed in and remember your preferences - and, where applicable, to understand usage so we can improve. You can control cookies through your browser settings; disabling some may affect how the Service works. Where required by law, we obtain consent for non-essential cookies.

11. Data retention

We keep personal information for as long as your account is active or as needed to provide the Service, and afterward only as necessary to comply with legal obligations, resolve disputes, enforce agreements, and maintain security. When you delete content or your account, we delete or de-identify the associated personal information within a reasonable period, except where retention is required by law or for legitimate business records. Backups are purged on a rolling schedule.

12. Security

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, access controls, and row-level data isolation between members. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your account and any sign-in links confidential.

13. International transfers

We and our service providers may process and store information in countries other than your own, including the United States. Where we transfer personal information from the EEA, UK, or Switzerland to a country that has not been deemed to provide an adequate level of protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism.

14. Your rights & choices

Depending on where you live, you may have some or all of the following rights regarding your personal information: to access it; to correct inaccuracies; to delete it; to port it to another service; to restrict or object to certain processing; and to withdraw consent. You can exercise many of these directly in the app (editing your profile, deleting entries, or deleting your account) or by contacting support@hapitalist.com. We will respond as required by applicable law. You also have the right to lodge a complaint with your local data-protection authority.

15. U.S. state privacy rights

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have rights to know, access, correct, delete, and obtain a portable copy of your personal information, and to appeal a denial of these rights. We do not sell personal information and do not share it for cross-context behavioral advertising, and we do not use sensitive personal information for purposes other than those permitted by law. We will not discriminate against you for exercising your rights. To make a request, contact support@hapitalist.com; we may need to verify your identity before responding, and you may use an authorized agent.

16. Children's privacy

The Service is intended for adults and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will take steps to delete it.

17. Third-party links & services

The Service may link to or integrate third-party sites and services (for example, payment, scheduling, or AI providers). Their privacy practices are governed by their own policies, not this one. We encourage you to review them.

18. Changes to this policy

We may update this policy from time to time. If we make material changes, we will provide notice through the Service or by other reasonable means and update the "Last updated" date above. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

19. How to contact us

Questions, requests, or complaints about privacy: support@hapitalist.com. We will do our best to resolve any concern you bring to us.