DRAFT: not reviewed by counsel. This page is not in force.
Data Privacy Policy
Last drafted: 2026-10-23. Effective date: [TO BE SET WHEN APPROVED].
This policy explains what personal data Mad Hare ([LEGAL ENTITY NAME AND ADDRESS: TO CONFIRM], "we") collects through its websites and its Overnight Queue Pilot service, why, how long we keep it, and what choices you have. It covers madhare.ai and agents.madhare.ai.
1. Who is responsible for your data
- For visitors, enquirers and customers' contacts (website data, orders, support, email): Mad Hare is the controller.
- For the content of a customer's repository, issues and run outputs: the customer is the controller and Mad Hare is the processor. A data processing addendum is available for this on request.
Contact for privacy questions and requests: support@madhare.ai. [A PRIVACY@ ALIAS AND, IF REQUIRED, A DATA PROTECTION OFFICER OR EU/UK REPRESENTATIVE: TO CONFIRM]
2. What we collect
| What | When | Why we use it | Retention |
|---|---|---|---|
| Text you type into a demo (for example a product idea or name) | You use a demo on the Site | To run the demo and show you the result | [12 months, then deleted: TO CONFIRM] |
| Email address and message | You email us | To reply and keep a record | 24 months after the last message |
| Name, email, company, billing details, order record | You order a Pilot | To sell, deliver, invoice and meet tax duties | The legal tax-record period [7 years: ACCOUNTANT TO CONFIRM] |
| Intake form answers: repository URL, issue list, test command, branch rules, data-sensitivity answers, opt-in choices | You complete intake | To scope and run the Pilot and to honour your choices | 12 months after close-out |
| Repository contents and issues that the GitHub App can read | During the Pilot week | To do the work you ordered | Working copies are deleted within 7 days of close-out |
| Run telemetry: turn counts, model spend, tool calls, reviewer verdicts, timestamps | Each Pilot run | To produce receipts, enforce the spend cap and diagnose faults | Receipts and telemetry for 12 months |
| Prompts and model outputs for your Pilot runs | Each Pilot run | To deliver and audit the work | Deleted within 7 days of close-out, unless you ask us to keep them |
| Website usage statistics (pages, referrer, browser type, country) | Only if you accept analytics in the cookie banner | To see which pages help | See the Analytics Policy |
| Sign-in details (Google account email and name) | You sign in to the portal, when portal sign-in is available | To let you in | While your account exists, then deleted |
| Email sending records: address, send time, delivery and unsubscribe status | We email you | To send what you asked for and to honour opt-outs | Unsubscribe records are kept so we do not email you again |
| Standard server logs: IP address, request path, time | Every visit | To keep the Site secure and working | [30 days: TO CONFIRM] |
We do not knowingly collect personal data from anyone under 18. We do not collect special-category data on purpose. Tell us before the scoping call if your repository contains any.
3. What we do not do
- We do not sell personal data, and we do not share it for cross-context advertising.
- We do not use your code, issues, prompts or outputs to train or fine-tune any model, or to build evaluation datasets, unless you tick a separate opt-in. Even then we use anonymised statistics only, not code.
- We do not run advertising trackers or use advertising cookies.
- Our internal model-tuning dataset is built only from Mad Hare's own build work. Customer and client data is excluded, and ingestion refuses any tenant other than Mad Hare's own.
4. Why we are allowed to use it (GDPR and UK GDPR)
- Performing a contract or steps you ask for before one: orders, intake, Pilot delivery, support.
- Legitimate interests: securing the Site, preventing abuse, keeping business records, replying to enquiries. We weigh these against your rights.
- Legal obligation: tax and accounting records.
- Consent: website analytics and optional marketing email. You can withdraw consent at any time. See the Cookie Policy and the Email Policy.
5. Who we share it with
We use the providers below to run the service. They process data on our instructions.
| Provider | Role | Data |
|---|---|---|
| Google Cloud (hosting, database, Vertex AI) | Hosting, storage, model access | Site data, order and intake data, Pilot run data. Region: [us-central1: TO CONFIRM] |
| Anthropic | Model API (commercial terms) | Prompts and repository excerpts sent to the model during Pilot runs |
| Google (Gemini API / Vertex AI) | Model API (commercial terms) | The same |
| OpenAI | Model API, only if used for your Pilot | The same |
| GitHub | Source hosting and the GitHub App | Repository access you grant |
| Stripe | Payments | Billing and payment details, collected by Stripe. [NOT YET SET UP] |
| Email delivery provider | Sending email | Address and message. [PROVIDER NOT YET CHOSEN] |
| Scheduling and intake form tools | Booking calls and collecting intake | Contact and intake answers. [TOOLS NOT YET CHOSEN] |
| Analytics (self-hosted by us) | Website statistics | Described in the Analytics Policy. No third party receives it |
Providers' current commercial API terms apply to model use. We have chosen the commercial API tiers because they do not train on API data by default. [VERIFY AGAINST EACH PROVIDER'S CURRENT TERMS: DATE CHECKED TO BE RECORDED]
We may also disclose data if the law requires it, or to a successor if Mad Hare is sold, with notice to you.
6. Transfers outside your country
Our hosting and our providers are mainly in the United States. If you are in the EEA, UK or Switzerland, transfers rely on [STANDARD CONTRACTUAL CLAUSES AND/OR THE EU-US DATA PRIVACY FRAMEWORK: COUNSEL TO CONFIRM].
7. Security
We use access controls, repository-scoped credentials with pull-request-only permissions, a separate model API key and spending limit per customer, encrypted connections, and logging. No system is perfectly secure. If a breach affects your data we will tell you as the law requires, and in any case without undue delay.
8. Your rights
Depending on where you live you may ask us to: give you a copy of your data, correct it, delete it, restrict or object to our use, move it to another provider, or stop marketing email. You may withdraw consent at any time. California residents have the right to know, delete, correct, and to opt out of sale or sharing. We do not sell or share. We will not discriminate against you for using these rights.
Email support@madhare.ai. We reply within 30 days. We may need to confirm who you are first. If you are not happy with our answer you can complain to your data protection authority.
9. Cookies and analytics
The Site sets no advertising cookies. Read the Cookie Policy and the Analytics Policy.
10. Changes
When we change this policy we post the new version with a new date. For a material change we will also tell Pilot customers by email.