How we handle information

Haryts is an operational-intelligence platform operated by Haryts Intelligence Inc., a federal corporation incorporated under the Canada Business Corporations Act (corporation number 1801677-1), with its registered office in Ottawa, Ontario, Canada. This statement covers the public website (haryts.com) and the Haryts product.

Specific data-processing terms — including data residency, roles, retention, and security commitments — are agreed with each customer in a pilot agreement or contract and its DPA, which take precedence over this page.

Our privacy responsibilities depend on the data in question:

• Website & marketing data — when you visit the site, book a demo, or contact us, Haryts is the data controller, and this statement governs that data.
• Customer knowledge in the product — when your organization uses Haryts over its own documents and records, Haryts acts as a data processor, handling that content only on your organization's instructions under your agreement. Your organization remains the controller of that content.

If you submit a form (to book a demo or contact us), we collect what you provide — your name, work email, and message, and if you choose to give them, your organization, phone number and a preferred meeting time — and use it only to respond and to arrange your demo. Form submissions reach us by email through our form provider.

To keep the site secure, our host Cloudflare protects it from attacks. Cloudflare Web Analytics counts page views in aggregate without cookies and without identifying you.

The website runs no analytics, tracking or advertising tools that need your consent, so there is no cookie banner. Google Analytics, Microsoft Clarity and the LinkedIn Insight Tag were removed on 30 October 2026. The website sets one strictly necessary cookie to remember the language you choose; the Cookie Notice lists everything we set.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use the website to build advertising profiles.

Cookie NoticeSubprocessors

We use website information only for these purposes:

• Responding to your enquiry and arranging a demo — because you asked us to, as a step before a possible contract, and in our legitimate interest in answering business enquiries (GDPR / UK GDPR Art. 6(1)(b) and (f)). Under Canadian law, you consent to this use by sending the form.
• Keeping the website secure and free of spam — our legitimate interest in protecting the site and its visitors (Art. 6(1)(f)).
• Counting visits in aggregate, without cookies — our legitimate interest in understanding how the site is used, without building any profile of you (Art. 6(1)(f)).
• We no longer rely on consent for any website cookie, because we no longer set any optional one. Nothing on the site asks for your consent to be tracked, because nothing tracks you.
• We do not make automated decisions that have legal or similarly significant effects on you, and we do not profile website visitors.

Haryts is built so your knowledge stays under your control. In the product:

• Each customer workspace is isolated: every query is scoped to your organization, and knowledge is never shared across customers.
• Connector credentials and the names of people in imported records are encrypted in the database. Stored documents are not encrypted at rest yet; they stay within your deployment, protected by workspace isolation and access controls.
• Secrets are never returned in answers or API responses, and are removed from audit metadata.
• Optional Privacy Levels control how personal names from operational sources are handled — off by default (roles only), pseudonymous, or full names for authorized administrators only.
• Security-relevant actions are recorded in an append-only audit log.
• The product app sets no cookies and loads no third-party scripts. Your sign-in token and interface preferences are stored in your own browser; no analytics or marketing tracker runs in the product.
• Haryts answers with its own AI model, run on Haryts-operated hardware: no external AI provider receives your documents or questions.

Answering a question and preparing documents for search requires an AI model for language understanding and for embeddings. How your content is processed depends on the deployment:

• Haryts-managed deployment (default) — answers and document embeddings are produced by Haryts's own AI model (Haryts AI), running on hardware Haryts operates. Your questions and the retrieved evidence travel over an encrypted connection between the Haryts application server and that AI hardware. The AI hardware is operated by Haryts in Canada; the application server and database are hosted in the United States (Ashburn, Virginia). No external AI provider (such as OpenAI or Anthropic) receives your documents or questions.
• Public web research — only when you explicitly ask the Brain to search the web; then only the search text (never your documents) is sent, through Haryts's self-hosted search service, to public web search engines.
• Your own environment — Haryts can also run entirely inside your organization's environment, so that processing stays on your infrastructure.
• Haryts does not train AI models on your content; your content is used only to answer your organization's own questions.

Current subprocessors

Website — the services that run our website, forms and mailbox are provided by companies based in the United States (listed on our Subprocessors page). What you send us through the website may therefore be processed and stored in the United States or other countries where those providers operate, and may be accessible to courts and authorities there under local law.

Product — the Haryts application server and database are hosted in the United States (Ashburn, Virginia). Where personal information is processed outside your region, we rely on appropriate safeguards, such as Standard Contractual Clauses, as set out in your agreement. A fully local deployment keeps processing inside your own environment and avoids such transfers entirely.

We do not sell personal information or share it for cross-context behavioural advertising. We share it only with the subprocessors that help us run the website and the product, and where required to comply with the law or to protect our rights and users.

Customer knowledge in the product is never shared across customers and is not used to build advertising profiles.

The website is served only over HTTPS with strict security headers. In the product, access requires authentication; passwords are hashed; administrative actions are limited to administrators and rate-limited. Credential encryption, workspace isolation, and audit logging are described on our Security page.

Haryts is not currently certified to a formal standard such as SOC 2 or ISO 27001. We apply the controls described on our Security page and support customer due-diligence and security reviews.

Security

Website — we keep demo and contact requests for up to 24 months after our last exchange, then delete them, unless they lead to a customer relationship, in which case your agreement applies. Cloudflare Web Analytics keeps only aggregate counts.

Product — customer knowledge is retained for the life of your engagement. Deleting a document removes its text, its search index entries, what was derived from it, and the stored file from the live system; resetting a workspace permanently deletes all of its documents, files and data. Aging conversations are archived on a rolling schedule. We do not run automatic time-based deletion of your data; full deletion on termination is handled per your agreement.

Depending on where you live, you may have the right to access your personal information, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw your consent at any time. These include rights under the GDPR and UK GDPR, Canadian law (PIPEDA and Québec's Law 25), and US state laws such as the CCPA/CPRA (California).

To exercise a right, email us at contact@haryts.com. We will confirm your identity before acting on a request, and respond within 30 days. You can use an authorized agent where the law allows, and we will not treat you differently for exercising your rights.

For personal data inside a customer's workspace (where we are the processor), please direct your request to that organization; we will assist them as required by our agreement.

Where US state privacy laws apply: in the last 12 months the website has collected identifiers (name, email, phone number), professional information (your organization), and the content of your messages, directly from you, for the purposes described above. We disclose them only to the service providers listed on our Subprocessors page. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. We honour the Global Privacy Control browser signal as an opt-out.

If you have a concern, please contact us first so we can try to resolve it. You also have the right to complain to a privacy regulator, such as:

• Canada — the Office of the Privacy Commissioner of Canada (priv.gc.ca); in Québec, the Commission d'accès à l'information (cai.gouv.qc.ca).
• United Kingdom — the Information Commissioner's Office (ico.org.uk).
• European Union / EEA — the data protection authority in your country (listed at edpb.europa.eu).
• United States — your state's privacy regulator or attorney general; in California, the California Privacy Protection Agency (cppa.ca.gov).

The website and the product are intended for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 16.

As required by Québec's Law 25, the person in charge of the protection of personal information at Haryts Intelligence Inc. is its owner, the person with the highest authority in the organization. You can reach them at contact@haryts.com.

Haryts Intelligence Inc. is responsible, as controller, for the personal information described in this statement. We may update this statement; material changes will be reflected here with a new date.

For any privacy question or to exercise a right, email contact@haryts.com or use our contact page.