Privacy policy
Last updated 6 November 2026
This policy explains what personal data Hefti collects and what we do with it. Tann Clan Ltd (England & Wales) runs Hefti and is the data controller for your account details. For the content your business puts into Hefti (for example customer messages), your business is the controller and we process it on your behalf. We follow the UK GDPR and the Data Protection Act 2018.
What we store
- Account details: your name, email, password (stored hashed, never readable), your business name, and which businesses you belong to.
- What you put in: chats with your agents, files, notes and facts you share, scheduled jobs, voice and writing style settings.
- Connected apps: which apps you link and the data your agents read from them to do the jobs you ask for. Access keys are stored encrypted.
- Usage: what you use, AI costs per business, setup progress, and basic logs (IP address, browser) to keep Hefti secure and stop abuse.
Why we use it (and the legal basis)
- To run Hefti for you and your team (contract).
- To keep it secure, prevent abuse and fix problems (legitimate interests).
- To send account emails such as password resets (contract), and a few setup reminders, each with an unsubscribe link (legitimate interests; you can opt out any time).
- To meet legal obligations, such as keeping financial records (legal obligation).
We don't sell your data, we don't use it for advertising, and we don't use your content to train our own AI models.
Who we share it with
We use these sub-processors to run Hefti. Each only gets what it needs for its job:
| Who | What for | Where |
|---|---|---|
| Supabase | Database, logins and file storage | EU (London region) |
| Vercel | Hosting the Hefti app | EU / US |
| OpenRouter and the AI model providers it routes to (such as Anthropic, OpenAI, Google) | Writing your agents' replies | US / EU |
| Composio | Connecting the apps you choose (email, calendar and others) | US |
| Telegram | Chatting with Hefti on Telegram, if you link it | Global |
| Slack | Chatting with Hefti in Slack, if you install it | US / EU |
| Resend | Sending account and setup emails | US / EU |
Where data leaves the UK, we rely on UK adequacy regulations or the UK International Data Transfer Addendum / standard contractual clauses. AI model providers receive the text needed to write a reply; we choose providers that don't train on API data.
How long we keep it
- Your business's data: while your account is open. When you ask us to delete your business, we delete it within 30 days (backups roll off within a further 30 days).
- Security and usage logs: up to 12 months.
- Setup reminder history: while your account is open.
Your rights
You can ask to see, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. Email support@hefti.ai and we'll reply within one month. To delete your account or business, email us from the address on the account. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Cookies
We only use cookies needed to keep you signed in and remember which business you're working in. No advertising or tracking cookies.
Children
Hefti is for businesses and isn't meant for anyone under 18.
Changes
If we change this policy in a way that matters, we'll tell you by email or in the app. Contact: support@hefti.ai.
Hefti is a product of Tann Clan Ltd, a company registered in England & Wales. Questions: support@hefti.ai