AIHQ

Privacy Policy

Last updated: September 14, 2026

Draft — registered address, retention schedules, and international transfer arrangements must be confirmed before publication.

1. Scope and responsibility

This policy describes the hosted AIHQ control plane at ai-hq.eu. AIHQ coordinates coding-bot tasks and separate execution runners. For a self-hosted installation, the organization operating that installation determines how personal data is handled.

The hosted service operator, ai-hq.eu, is responsible for account and service administration data. If you submit personal data on behalf of an organization, that organization determines the purpose of the processing; applicable processing terms must be agreed before using AIHQ for that data.

2. Information processed

  • Account information: email address, account identifiers, and identity information supplied by Google or GitHub when you choose those sign-in methods. Email and password authentication is handled by Supabase Auth.
  • Workspace information: projects, repository references, task instructions, runner registrations, capabilities, and connection status.
  • Execution records: run attempts, provider session identifiers, events, logs, approvals, final responses, patches, changed-file manifests, and command evidence. These may include source code and personal data you or your runners submit.
  • Operational information: authentication activity and technical request information, such as IP addresses and timestamps, processed by the hosting and authentication infrastructure.

Provider credentials and repository access credentials belong on runners. The control plane stores a hash of each runner authentication token. Avoid submitting secrets or unnecessary personal data in tasks, logs, and artifacts.

3. Purposes and legal bases

Account and execution information is used to authenticate you, isolate your workspace, schedule work, display results, and support the service. Where GDPR applies, processing necessary to provide the service to you is based on performance of a contract. Service security, abuse prevention, and troubleshooting are based on legitimate interests in operating a reliable and secure service, balanced against your rights. Records required by law are processed to comply with legal obligations.

Account information is required to use authenticated features. Task and runner information is needed to execute the work you request.

4. Service providers and runners

The hosted control plane uses Fly.io for application hosting and Supabase for authentication and database services. Google or GitHub processes your sign-in under its own privacy terms when selected.

Runners access repositories and send instructions and relevant execution context to the coding-bot providers you configure, such as OpenAI or Anthropic. Their processing depends on your provider account and settings. Runner operators also control local files, processes, and execution records.

Information may also be disclosed when required by law or necessary to investigate abuse and protect the service. Hosting and provider services may process information outside your country. Applicable transfer locations and safeguards must be confirmed by the hosted operator.

5. Cookies and browser storage

AIHQ uses authentication cookies and browser storage to maintain your session. Blocking or clearing these may prevent sign-in or end your session. The application currently includes no advertising or analytics trackers. Selected sign-in providers may use their own cookies on their services.

6. Retention and security

Account and workspace records are retained to operate your account and provide execution history. Security and legal records may need separate retention periods. The operator must define the deletion process and backup expiry schedule before this policy is finalized.

AIHQ separates control-plane access from runner execution, scopes records to account owners, and hashes runner tokens. No storage or transmission system can guarantee absolute security. You are responsible for securing your runners and deciding what they submit.

7. Your rights

Where applicable, you may request access, correction, deletion, restriction, or portability of your personal data, and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. These rights are subject to applicable conditions and exceptions.

You may complain to your local data protection authority. AIHQ orchestrates the bot tasks you request; it is not intended to make solely automated decisions producing legal or similarly significant effects about individuals.

8. Contact and changes

Operator: ai-hq.eu. Privacy contact: support@ai-hq.eu. Registered address: awaiting confirmation.

Updates will appear on this page with a revised date. Material changes will be communicated through the service or account email where appropriate.