Privacy policy

1. Who we are

Haycion Inc. ("Haycion", "we", "us") runs this website, the Haycion app, the Haycion Advisor Network, the profile API and the MCP server (the "Service"). We are the controller of the personal data described in this policy. When you use the Service to work for your clients, we process what you put into their workspaces on your behalf and following your instructions. Our terms govern your use of the Service.

2. What we collect

Account data. When you sign up: your name, email address and password (stored hashed, never in clear text), a profile photo if you add one, and the workspaces and roles you have.
Workspace content. What you and your team add: website addresses, briefs, uploaded documents, notes, guardrails, edits, reports, conversations with a workspace's agent, and the names and email addresses of people you invite. You decide what goes in, and it can include personal data about your clients' people.
Information from public sources. To build workspaces and listings we read companies' own websites, their competitors' websites, search results and news. These can include the names and job titles of people as they appear on those pages, for example on a team or about page.
Advisor Network listings. A listing describes a consultancy, agency or independent advisor: its name, location, services, specialisms, clients and case studies, taken from public web sources until the firm claims it, then as the firm edits it.
What you send us. The contact form (name, email, company and message); advisor requests (name, work email, company website, role, project details, timeline, budget and engagement type); and removal requests (the domain and the work email we send a confirmation code to).
Billing data. Your plan, invoices and billing contact. Card details are entered with our payment processor; we don't receive or store your full card number.
Usage and device data. Pages viewed, clicks, referring pages, browser and device type, and approximate location derived from your IP address, collected by the analytics tools in section 3 and in our servers' logs.
Listing activity. When someone views an Advisor Network listing, we record the view against the listing with a one-way hash of the visitor's IP address, so each visitor counts once a day; we also record clicks on a listing's links, and the user agent of AI crawlers that read a listing. These feed the listing's statistics and the public leaderboards, which show positions only.
Connected AI assistants. When you connect an AI assistant through the MCP server, we keep the access you approved and receive the requests it makes on your behalf.

3. Cookies and similar technologies

Necessary. The app keeps you signed in with a session identifier stored in your browser's local storage, and the website and app remember your light or dark theme the same way. These are needed for the Service to work.
Analytics. This website uses Google Analytics and Microsoft Clarity, and the app uses Microsoft Clarity, to understand how the Service is used and improve it. They set their own cookies (such as Google's _ga and Clarity's _clck and _clsk). Clarity records how pages are used, such as clicks, scrolling and mouse movement, to produce heatmaps and session replays.
No advertising cookies. We don't use advertising cookies.

You can block or delete cookies and local storage in your browser settings, and opt out of Google Analytics with Google's browser add-on. Blocking local storage will sign you out of the app.

4. How we use it, and our legal bases

To provide the Service: run your account and workspaces, build analysis, publish what you publish, connect the AI assistants you approve, and handle billing. Legal basis: performing our contract with you.
To run the Advisor Network: build listings from public business information, show them, count views and AI reads, and let firms claim or remove them. Legal basis: our legitimate interest, and the firms', in helping buyers find advisors. You can object at any time (section 10).
To answer you and handle requests: reply to messages, and route advisor requests, sharing them with the firm concerned when you've agreed to that. Legal basis: steps you ask us to take, our legitimate interests, and your consent where you give it.
To keep the Service secure: prevent abuse, fraud and spam, and enforce our terms. Legal basis: our legitimate interests.
To understand and improve the Service: analytics and product research. Legal basis: our legitimate interests, or your consent where the law requires it.
To send service emails: account verification, password resets, invitations, and notices about your account, workspaces or these policies. Legal basis: performing our contract with you.
To meet legal obligations: tax, accounting and responding to lawful requests. Legal basis: legal obligation.

We don't sell personal data, and we don't use it for targeted advertising.

5. AI processing

Haycion uses third-party AI model providers to generate analysis, reports and agent answers. To do that, we send them the relevant workspace content and public information. They process it to provide their service to us, as our service providers. Visibility checks send buyer-style questions about a client's market to AI assistants and search services and record what comes back. We don't use AI output to make decisions with legal or similarly significant effects on individuals.

Service providers that process data for us under contract: cloud hosting and storage, AI model providers, web search and search-results providers, email delivery, payment processing, and website and product analytics.
People you choose: members and clients you invite into a workspace, and AI assistants you connect.
The public: client profiles and AI agents you publish, and Advisor Network listings, are public by design.
Advisor firms: when you send an advisor request and agree to it, we may share your name, email, company and request with that firm so it can reply.
Legal and safety: where the law requires it, or to protect the rights, property or safety of Haycion, our users or others.
Business transfers: as part of a merger, acquisition or sale of assets, under this policy's protections.

7. International transfers

We're based in the United States, and our service providers may process data in the United States and other countries. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and their UK equivalent.

8. Retention

We keep personal data only as long as we need it for the purposes above:

Account data, for as long as your account is open, then deleted within a reasonable period, except records we must keep for tax and accounting.
Workspace content, until you delete it. Deleting a workspace removes it from every view at once, and a cleanup pass then purges its records.
Messages and advisor requests, for as long as needed to handle them and any follow-up.
Analytics data, for the retention periods set in those tools.
Removed domains stay on our removal list, so that nothing is created for them again.

9. Security

We protect data with isolated workspaces, role-based access checked on every request, hashed passwords and revocable API keys. The security page lists the controls in full. No system is perfectly secure, and we don't claim a security certification.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to how we use it, and to withdraw consent you've given. California residents have the right to know what personal information we collect and why, to delete and correct it, and not to be discriminated against for using these rights; we don't sell or share personal information for cross-context behavioural advertising.

Advisor Network listings. A firm can claim its listing to correct it, or remove it permanently with the "Request removal" link on the listing. Anyone named on a listing can also write to us to object.
Data in someone else's workspace. If a consultant holds your data in a workspace, they decide what it contains; contact them first, and we'll help where we can.
Everything else. Email hello@haycion.com. We'll verify your identity and respond within the time the law requires.

You can also complain to your local data protection authority.

11. Children

The Service is for businesses and is not directed at children. You must be at least 18 to use it, and we don't knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we'll delete it.

12. Changes to this policy

We may update this policy. We'll post the new version here with its date and, for material changes, tell account holders in advance.

13. Contact

Haycion Inc., 131 Continental Dr, Suite 305, Newark, DE 19713. Email hello@haycion.com.