This Privacy Policy explains how Hagency ("Hagency", "we", "us") collects, uses, discloses and retains personal information when you visit hagency.cloud, create or administer an account or Workspace, purchase a plan, contact support, or otherwise use the Services. Hagency is the controller or business for account, billing, security, support and website information whose use we determine. For personal data contained in a Customer's Matrix Workspace and processed only on that Customer's instructions, the Customer is the controller and Hagency is its processor or service provider under the Data Processing Addendum. End users should first direct Workspace-specific requests to their Workspace administrator.
If you do not provide information needed for an account, payment, security verification or requested feature, we may be unable to provide that part of the Services. We do not use solely automated decision-making that produces legal or similarly significant effects, although automated systems may flag fraud, abuse or security risk for restriction or review.
Matrix communications are not confined to Hagency when you join federated rooms, contact users on another homeserver, make a room or profile public, or enable a bridge, bot, webhook or identity integration. Relevant content, identifiers, IP-derived routing data and metadata may be sent to other homeservers, networks, administrators, members and integration providers at your or your administrator's direction. Those recipients independently control their copies and may retain data after it is deleted from Hagency. Search engines or third parties may index information you make public. Review room, federation, bridge and client settings before sharing sensitive information.
End-to-end encryption is controlled by Matrix room and client configuration and does not cover every room, message, file, bridge, bot, notification or item of metadata. When encryption is active and keys remain only with users, Hagency generally stores ciphertext and cannot decrypt it. We may process unencrypted Customer Data and metadata as needed to operate, secure and support the Services, respond to a request you initiate, enforce the Agreement or comply with law. Authorized personnel access production systems only on a need-to-know basis subject to confidentiality and access controls.
We do not sell personal information for money. We may disclose it:
The particular vendors used may depend on region, plan, payment method and enabled features. You may request current subprocessor information through support.
Hagency, its providers, federated homeservers and integrations may process information in countries other than yours. Laws in those countries may differ. Where required for a restricted transfer, we use an adequacy decision, approved standard contractual clauses, the UK Addendum or another lawful safeguard. Federation and integrations you direct may create transfers for which you are responsible as controller.
We retain information for as long as reasonably needed to provide the Services, meet the purposes above, comply with law and contracts, resolve disputes and protect the Services. Retention varies by record and configuration:
Scheduling account deletion begins a 30-day cancellation period. Workspace deletion initiated through the designated permanent-delete control may begin immediately. Deletion from active systems and operational copies may occur at different times. We may retain limited information for legal holds, security, fraud prevention, financial compliance, enforcement and proof of consent or deletion. Data already delivered to federated or third-party systems is outside our control.
We use administrative, technical and physical safeguards designed to protect personal information, such as access controls, credential hashing, encryption in transit, secret protection, logging and tenant isolation where appropriate. No online service, transmission, storage or backup is completely secure, and we cannot guarantee that unauthorized access, loss or disclosure will never occur. You are responsible for securing devices, credentials and encryption recovery material, configuring users and integrations, and promptly reporting suspected incidents.
We use first-party cookies or browser storage that are necessary for sessions, security, language and preferences. Registration may load a configured CAPTCHA provider, which receives technical data such as IP address and browser information under its own policy. Payment, identity and other features may redirect to or embed third-party services. We do not currently use third-party advertising cookies on the Hagency marketing site. If we introduce non-essential analytics or advertising technologies where consent is required, we will provide the required choice. Blocking necessary storage may prevent sign-in or other functions. We do not currently respond to browser "Do Not Track" signals.
Depending on where you live and subject to legal exceptions, you may request access, correction, deletion, restriction, objection, portability or withdrawal of consent, and may appeal a denied privacy request. You may also complain to your local data-protection authority. Account settings allow you to update certain profile data, manage sessions and preferences, export available account information, and schedule account deletion. Workspace administrators control most Workspace content and end-user records.
Submit a request through the authenticated support-ticket system or support@hagency.cloud. We may verify identity and authority, ask you to use an administrator channel, or decline or limit a request where permitted by law. Authorized agents must provide proof of authority. We will not discriminate against you for exercising applicable privacy rights.
Depending on use, we may collect identifiers; customer records; commercial information; internet or electronic activity; approximate geolocation; audio, visual or similar content; professional information you submit; and inferences related to security or service use. The sources, purposes and recipients are described above. Hagency does not knowingly sell personal information for money. Hagency also does not knowingly share personal information for cross-context behavioral advertising. If our practices change, we will provide any required opt-out mechanism. We use and disclose sensitive personal information, such as account credentials and precise contents of private communications, only for permitted service, security and legal purposes and not to infer characteristics for advertising.
The Services are not directed to children under 13 or the higher age required by local law, and we do not knowingly collect their personal information without required authorization. A parent or guardian who believes a child provided information unlawfully should contact us. Customers that permit minors to use a Workspace are responsible for required notices, permissions and safeguards.
We may update this Policy to reflect changes in law, technology or the Services. We will post the revised Policy and update the date above; material changes will also be notified through email or the Services when required. Questions, requests and complaints may be sent to support@hagency.cloud or submitted through the authenticated support-ticket system.