Privacy Policy

1. The data we process

• Account — your email, display name, optional profile picture, language, and authentication data (a password hash or the social sign-in you choose).
• Learning activity — the packs and collections you open, lesson progress and mastery, quiz answers, certificates earned, and items you save or bookmark.
• Organization membership — the communities you join, your role, and (only if you consent at join) the progress you choose to share with a community.
• AI Coach questions — the questions you ask the Coach (in the app or over a messaging line) and the answers given, used to answer you and, in aggregate and without identifying you, to improve the service.
• Messaging / reach lines — see section 3.
• Payments — if you buy a pack or subscription, our payment processor handles your card or mobile-money details; we receive only a confirmation and minimal transaction metadata, never full card numbers.
• Support and communications — messages you send us and the system and notification emails we send you.
• Technical — basic request logs (IP, device or browser, timestamps) for security and reliability, and cookieless, aggregate analytics (self-hosted Plausible) that set no cookies and do not identify you.

2. Why we process it, and our legal basis

• Provide your account, learning and certificates — performance of a contract.
• Answer your Coach questions — contract and our legitimate interests.
• Let you join and share with a community — consent (for sharing) and contract (for membership).
• Send proactive community updates (section 3) — your consent.
• Security, fraud prevention and reliability — legitimate interests and legal obligation.
• Process payments — contract and legal obligation.
• Aggregate, non-identifying analytics and service improvement — legitimate interests.

3. Messaging lines and community updates (reach)

Communities may offer a line where you can ask questions on WhatsApp, SMS or Telegram and get answers drawn from their published materials, and — on Telegram — opt in to occasional updates.

Asking questions (inbound). When you message a line, we process your message to answer it. We identify repeat conversations using a salted, one-way hash of your phone number or chat — we do not store your raw number for this. Message content is processed to generate an answer (see section 4).

Community updates (opt-in broadcast). You receive proactive updates only if you explicitly opt in (for example, by tapping “Get updates”). For this — and only this — we store your Telegram chat ID (so we can reach you), which community you subscribed to, and your opt-in and opt-out dates. This is personal data, kept on the basis of your consent.

• Every update names the community and tells you how to stop.
• Send STOP at any time (or email us) to unsubscribe — we stop immediately and keep only a minimal suppression record so we do not message you again. You can ask us to erase that too.

4. AI processing (the Coach)

Your Coach questions are answered by large-language-model providers we use as processors (currently OpenAI and xAI, and web-search providers for freshness). We send them your question and the relevant grounding content; we do not permit them to train general models on your content. Answers are educational and may be imperfect — see the Terms.

5. Who we share it with (processors)

We do not sell or rent your data. We share it only with vendors that process it on our behalf under a data processing agreement, and only as needed:

• Messaging delivery — Twilio and Meta (WhatsApp), Africa’s Talking (SMS/USSD, where enabled), and Telegram Messenger Inc. (Telegram delivery for the reach lines and opt-in updates).
• AI — OpenAI, xAI, and web-search providers (question answering).
• Email — Resend (system and notification email).
• Payments — our payment processor or processors (card and mobile money).
• Hosting and infrastructure — our cloud host and self-hosted analytics.

6. International transfers

Some processors are outside your country (for example, US-based). Where EU or UK data is involved we rely on appropriate safeguards (adequacy decisions, Standard Contractual Clauses, or the EU-US Data Privacy Framework) and record them.

7. Retention

We keep account and learning data while your account is active, and delete or anonymize it after closure except where we must retain records (for example, tax records for payments). Reach-line message content is short-lived; broadcast subscriptions are kept until you opt out (then only a suppression record). We delete data earlier on a valid erasure request.

8. Your rights

Subject to local law you can request access, correction, deletion, restriction and portability, object to certain processing, and withdraw consent (including for community updates) at any time. Contact us at info@hyractech.com. You may also complain to your local data-protection authority.

9. Children

HyracHub is intended for general audiences; some communities serve young learners. Where a community enrolls minors it is responsible for obtaining any required parental consent. We do not knowingly collect data from children below the applicable age of consent without it; contact us to remove such data.

10. Security

We use encryption in transit, access controls, secrets kept out of source control, and least-privilege practices. No system is perfectly secure; we notify affected users and authorities of a breach as required by law.

11. Changes and contact

We will post changes here and, for material changes, notify you. Questions or requests: info@hyractech.com (interim, until privacy@hyracbox.com is provisioned).