Privacy Policy

Version 2026-07-30 · last updated: 30 July 2026

1. Controller

The controller responsible for data processing on this website is HYWOS, Von-Stauffenberg-Straße 66, 19061 Schwerin, Germany — email support@hywos.com, phone +49 157 83462052.

2. Website, application and your plan — the key point

There are two separate things. This website and account system handle your account, plan and billing. The HYWOS desktop application runs on your own computer: your documents and projects are processed there, and the AI model runs locally as well — your documents are never uploaded, on any plan, and we never pass them or your prompts to an external AI service. What differs between plans is whether the application reports back to us at all. On every paid plan it does not: no usage data, no chat history, nothing — the software can be used fully offline between licence checks. On the free plan it does: your chat history and your activity in the software are transmitted to us and stored, as described in section 3. To be unambiguous about the one point that matters most: on the free plan the text of your prompts and the assistant's replies is stored on our servers, and it may contain excerpts you or the assistant quoted from your documents.

3. What we collect

• Account data — when you register: your name (or company), email, phone, country, and optionally your company name and your field of work — plus the date and version of the terms, privacy policy and DPA you accepted.
• Usage data — free plan only — which functions you use and when, your chat history (the full text of your prompts and the assistant's replies, which may contain excerpts quoted from your documents), the actions performed in the software (e.g. imports, generated documents, searches), the pages you visit on this website, and technical event and error data. This is transmitted to our servers in the EU and stored there for at most 12 months. Your documents themselves are never uploaded. On every paid plan none of this is collected.
• Enquiry data — when you use the contact, demo request or “Custom plan” form: the details you submit and your message.
• Licence & device data — when you activate the app on a computer: a device fingerprint, the network adapter (MAC) address, the computer name, the platform (e.g. Windows) and its version, the processor, graphics adapter and amount of memory, the HYWOS version used, and a last-seen timestamp. This enforces the one-computer licence and lets the app confirm your plan is active.
• Payment data — processed by our payment provider (Stripe). We receive confirmation and invoice data (e.g. plan, amount, status), but we do not store your full card details.
• Essential cookies — see section 8.
• Server logs — our hosting provider processes standard technical data (e.g. IP address, timestamp, requested resource) to deliver and secure the site.

4. Why we process it (legal basis)

• To provide your account, licence and device activation — Art. 6(1)(b) GDPR (performance of a contract).
• To provide the free plan itself — storing your chat history and activity records so they are available in your account — Art. 6(1)(b) GDPR (performance of a contract). Where that stored content contains personal data of third parties and you use HYWOS professionally, we process it as your processor under our Data Processing Agreement (Art. 28 GDPR).
• To keep the service working, secure and free of abuse, and to improve HYWOS — Art. 6(1)(f) GDPR (legitimate interest). Here we are the controller, not a processor: we have documented the balancing of interests and use aggregated or anonymised data for improvement. We do not use your data to train or fine-tune any AI model. You may object to this processing at any time under Art. 21 GDPR.
• To answer enquiries — Art. 6(1)(b)/(f) GDPR.
• To process payments and meet accounting/tax obligations — Art. 6(1)(b)/(c) GDPR.
• Essential cookies and secure operation of the site — Art. 6(1)(f) GDPR (legitimate interest in a working, secure service).

5. Processors and recipients

We only share data with providers who process it on our behalf under a data-processing agreement:

• Stripe — payment processing and subscription billing.
• Railway — hosting of the website, the account backend and the database, in a data centre in the EU.
• Google Analytics — optional website analytics, loaded only after you consent.
• Microsoft Clarity — optional session analytics, loaded only after you consent.

We do not sell your data or use it for advertising. Google Analytics and Microsoft Clarity are loaded only after consent. Free-plan product-usage records described in section 3 are separate account records, not cross-site tracking.

6. International transfers

Your data is stored primarily on servers in the EU. Stripe, Railway, Google and Microsoft are established in or may provide access from the USA. Any applicable international transfer is safeguarded using recognised mechanisms such as the EU Standard Contractual Clauses and appropriate supplementary measures.

7. Retention

We keep account, licence and enquiry data for as long as your account exists. Free-plan usage data, including chat history, is kept for a maximum of 12 months. If you move to a paid plan the collection stops immediately; the data already stored is kept for a further 30 days so that you can still ask for it to be handed over, and is then deleted. You may ask us to delete it sooner at any time, and closing your account deletes it too; backups follow within the ordinary backup cycle of at most 90 days. Invoices and billing records are retained for the periods required by German commercial and tax law (generally up to 10 years). After the applicable period we delete or anonymise the data.

8. Cookies

We store essential session and preference information on your device. If you select Accept, Google Analytics and Microsoft Clarity may store or read analytics identifiers and process page-view, interaction and device information. They are not loaded when you choose Essential only. You may change your decision by clearing this site’s stored data and choosing again.

9. Data security

The website is served over encrypted connections (TLS/HTTPS) and passwords are stored only as salted hashes. We apply appropriate technical and organisational measures to protect your data.

10. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. To exercise any right, contact support@hywos.com. You also have the right to lodge a complaint with a supervisory authority — for our seat this is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hesse, Germany).

11. Changes

We may update this policy. The current version, with its update date above, is always available on this page.