Privacy Policy

Last Updated: 10/28/2026

1. Who We Are and What This Policy Covers

Heptabase is operated by Hepta Platforms, Inc. ("Company", "we", "our", "us"), a Delaware corporation with its mailing address at 169 Madison Ave #2203, New York, NY 10016, USA.

This Privacy Policy explains how we collect, use, share, and protect personal information when you use any of the following (together, the "Service"):

  • our website at https://heptabase.com and its related pages;
  • the Heptabase desktop app, web app, and mobile apps;
  • the Heptabase Web Clipper browser extension;
  • the Heptabase MCP server, API, and command-line tools, including the Heptabase app inside third-party AI apps such as ChatGPT and Claude; and
  • AI features in the Service, including AI Chat, the AI Agent, and AI Tutor.

For personal information we process under this Privacy Policy, we are the data controller. This Privacy Policy is part of our Terms of Service. Capitalized terms that are not defined here have the meanings given in the Terms of Service.

2. Information We Collect

Information you give us

  • Account information: your email address and name. If you sign in with Google, we receive your name and email address from Google.
  • Onboarding answers: optional answers you give us during sign-up, such as how you heard about Heptabase.
  • Your Content: everything you create, upload, or import into the Service, including cards, notes, journals, whiteboards, tags, tasks, files (such as PDFs, images, audio, and video), voice notes, transcripts, web pages you clip or save, AI conversations, and AI Tutor goals and lessons.
  • Billing information: your billing address, tax details, and purchase history. Your card details go directly to our payment processor, Stripe; we do not store full card numbers.
  • Communications: messages you send to our support team, survey answers, and feedback. If you choose to submit feedback on an AI conversation, the feedback includes the content of that conversation.

Information we collect automatically

  • Usage information: how you use the Service, such as the features you use, the pages and screens you visit, and when and how often you use them.
  • Device and log information: IP address, browser and device type, operating system, app version, language, and error and diagnostic logs.
  • Cookies and similar technologies: see Section 7.
  • Email engagement: whether you open our emails and click links in them.

Information from third parties

  • Sign-in providers: Google, if you choose to sign in with Google.
  • Services you connect: if you connect Zotero, Readwise, or an AI provider account, we receive the information you choose to bring into the Service from that service.
  • Web pages you save: when you save a web page, we may fetch its content through our web content provider.
  • Referral partners: if you arrive through a partner's referral link, our referral program provider tells us which partner referred you.
  • Payment and tax providers: payment status and tax calculations from Stripe and our tax provider.

3. How We Use Information

We use personal information to:

  1. provide, maintain, and sync the Service across your devices, including AI features you choose to use;
  2. create and manage your account, authenticate you, and keep the Service secure;
  3. process payments, calculate taxes, and manage subscriptions, AI credits, and usage-based charges;
  4. respond to support requests and feedback;
  5. send you service messages, such as sign-in codes, invitations, receipts, and notices about your account, subscription, or changes to our terms;
  6. send you product updates and marketing emails. You can unsubscribe at any time using the link in any marketing email or by emailing us at support@heptabase.com;
  7. understand how the Service is used, fix bugs, run experiments, and improve the Service;
  8. credit referral partners for sign-ups they refer;
  9. detect, prevent, and respond to fraud, abuse, and security incidents; and
  10. comply with law, enforce our terms, and protect the rights and safety of our users and others.

We do not use Your Content to train AI models, and we do not allow the AI providers we use to train their models on it. See Section 4.

Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

  • Performance of a contract to provide the Service you request (purposes 1–5).
  • Legitimate interests in understanding and improving the Service, marketing to our users, crediting referral partners, and keeping the Service secure (purposes 6–9). You can object to processing based on legitimate interests at any time.
  • Legal obligation for billing, tax, and other legal requirements (purposes 3 and 10).
  • Consent where the law requires it. You can withdraw consent at any time.

4. AI Features

When you use an AI feature, we send the content needed for your request (for example, your message, the cards or files you include, or the audio you record) to an AI model, and return the result to you.

  • AI providers we use: AI features that use our accounts are processed by OpenAI, Anthropic, and Google. Audio transcription is processed by OpenAI.
  • Models we host: PDF parsing and AI suggestions run on models we host on infrastructure provided by Runpod, and are not sent to the providers above.
  • Web search: when the AI Agent searches the web, your search query is processed by the AI provider's search tool.
  • Search indexes: to power search and AI features, we keep search indexes of Your Content, including vector embeddings, with our search infrastructure providers.
  • No training: we do not use Your Content to train AI models, and our agreements with the AI providers above prohibit them from training their models on it. These providers may keep inputs and outputs for a limited period to monitor abuse, as set out in their terms.
  • Human review: our team does not review your AI conversations unless you submit them to us as feedback, you ask us for help, or we need to for legal, safety, or security reasons.
  • Your own AI accounts: if you use your own API key (for example, from OpenAI, Anthropic, Google, or OpenRouter) or connect your own ChatGPT or Codex subscription, your content is sent to that provider under your agreement with them. The no-training commitment above does not cover these providers; their terms and your account settings apply.

5. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as follows:

  • Service providers: companies that process information on our behalf, such as hosting, AI, payment, email, support, and analytics providers. They may use it only to provide services to us. See our list of service providers.
  • Referral program: when you create an account, we send your email address and account ID to PartnerStack, which runs our referral program, so it can credit the partner who referred you.
  • People you share with: when you invite collaborators or share a card or whiteboard, the people you share with can see that content and your name and email address. When you publish content, anyone with the link can see it.
  • Services you connect: when you connect a third-party service or authorize a third-party app (for example, an AI app that uses the Heptabase MCP server), we share the information you choose with that service. Its use of your information is governed by its own privacy policy.
  • Legal and safety: when we believe in good faith that the law requires it, or to protect the rights, property, or safety of our users, the public, or us.
  • Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.
  • With your consent or at your direction.

6. Service Providers

We use service providers in these categories. The current list, with each provider's name and purpose, is on our service providers page.

  • Cloud hosting, storage, and authentication
  • AI model providers and model hosting
  • Search infrastructure
  • Web content retrieval
  • Payments and tax calculation
  • Email delivery and customer support
  • Product analytics, experiments, and error monitoring
  • Referral program management

7. Cookies and Similar Technologies

We and our service providers use cookies, local storage, and similar technologies on our website and in the Service:

  • Essential: to sign you in, keep you signed in, remember your preferences, and protect the Service.
  • Analytics: to understand how visitors and users use the website and the Service.
  • Referral: if you visit our website through a partner's referral link, to credit that partner for your sign-up.

We do not use advertising cookies. You can block or delete cookies in your browser settings, but parts of the Service may not work without essential cookies.

Do Not Track and Global Privacy Control: we do not currently respond to Do Not Track signals. Because we do not sell or share personal information for cross-context behavioral advertising, there is nothing for a Global Privacy Control signal to opt you out of.

8. How Long We Keep Information

  • Account information and Your Content: for as long as your account exists. You can delete content at any time, and you can delete your account in Settings > Advanced.
  • When you delete your account: we delete your account information and Your Content from our active databases, file storage, and search indexes. Copies in our backups are deleted when those backups expire on their regular schedule.
  • AI providers: inputs and outputs may be kept by AI providers for a limited period to monitor abuse, as described in Section 4.
  • Billing records: for as long as tax, accounting, and other laws require.
  • Support conversations and analytics data: for as long as we need them for the purposes in Section 3, such as helping you and improving the Service. You can ask us to delete them at any time.
  • Logs: for limited periods set by us and our service providers, after which they are deleted.

We may keep information longer when the law requires it, or to resolve disputes, prevent abuse, or enforce our agreements.

9. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit and access controls that limit who can access personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us at support@heptabase.com.

10. International Data Transfers

We store and process personal information on servers in the United States. Our team works remotely, and team members in other countries, including Taiwan and the United Kingdom, may access personal information from those countries when they need to for their work, under confidentiality obligations and access controls. Some of our service providers also process information in other countries.

When we transfer personal information from the EEA, the United Kingdom, or Switzerland to countries that do not provide an adequate level of protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

11. Your Rights and Choices

  • In the app: you can edit your account information and Your Content, export your data, cancel your subscription, and delete your account.
  • Marketing emails: unsubscribe using the link in any marketing email.
  • Requests: to access, correct, delete, or receive a copy of your personal information, or to exercise any other right described below, email us at support@heptabase.com. We may need to verify your identity before we respond. We will not discriminate against you for exercising your rights.

EEA and UK

You have the right to access, correct, delete, restrict, or receive a portable copy of your personal information, to object to processing based on legitimate interests (including for direct marketing), and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority.

United States

Depending on the state you live in, you may have the right to know what personal information we collect and how we use it, to access, correct, or delete it, to receive a copy of it, and to opt out of the sale of personal information, sharing for cross-context behavioral advertising, or targeted advertising. We do not sell personal information or share it for these purposes. You may use an authorized agent to make a request. If we deny your request, you can appeal by replying to our decision or emailing support@heptabase.com with the subject line "Privacy Appeal".

12. Children's Privacy

You must be at least 13 years old to use the Service, or at least 16 years old if you are in the EEA. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us at support@heptabase.com and we will delete it.

13. Third-Party Services and Links

The Service may link to, or let you connect, websites and services we do not operate. Their privacy practices are governed by their own policies, and we are not responsible for them.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or in the Service before they take effect. We will also update the "Last Updated" date at the top of this page.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us:

  • By email: support@heptabase.com
  • By mail: Hepta Platforms, Inc., 169 Madison Ave #2203, New York, NY 10016, USA