Privacy Controls - GDPR and Data Management

01. Your Privacy Rights

Export Your Data

Export supported account-profile, collection and memory sections in JSON format

Delete Everything

Request account deletion and exercise supported data-subject controls

Control Access

Manage who can see your collections and memories

Data Encryption

TLS in transit and encrypted production storage and backups at rest

02. Export Your Data

Use an authenticated account session to send POST /v1/gdpr/export.
Send {"format":"json","include":["profile","collections","memories"]} to explicitly select the supported sections.
Save the returned JSON attachment securely. Optional trajectories and API-key metadata require explicit inclusion; secrets are not exported.
The dashboard Usage export contains request statistics, not an account-data export. There is no Settings → Privacy export button. Contact support if you need assistance or other data categories.

03. Delete Your Account

Account access stops immediately. Deletion starts a 90-day restoration window, followed by permanent removal:

Your account, collections, and memories are soft-deleted immediately and become inaccessible
You have a 90-day grace window to restore the account via POST /v1/gdpr/restore-account
Associated vectors, search indexes, profiles, graph data, and stored objects are removed through durable, retryable cleanup jobs
After 90 days eligible primary data is permanently removed; encrypted backups expire on their retention schedules rather than being edited record by record
Once past the 90-day window, deletion cannot be reversed

Via UI: Settings → Danger Zone → Delete Account. Via API: POST /v1/gdpr/delete-account. To request restoration within 90 days, use POST /v1/gdpr/restore-account with your email and password, or contact support if you cannot use password authentication. External data restoration depends on retained primary records and rebuilding projections; it is not an instant rollback.

04. Delete just one collection

Don't need the whole account gone, just one customer / project / agent? Deleting a collection cascades to every memory, document, media record, profile derivative, decision, correction, and coding-agent record inside it. PostgreSQL deletion and the exact external-cleanup set are committed together; vectors, search indexes, graph projections, caches, and stored objects are then removed by durable, retryable workers. A successful delete makes the collection unavailable immediately without pretending that every external store completed inside one HTTP request.

DELETE /v1/collections/{id}: one collection
POST /v1/collections/bulk-delete: several at once
DELETE /v1/collections/all: every collection you own

Privacy controls. Hebbrix exposes self-serve access, export, deletion, and restoration workflows that support privacy-rights requests. Use these endpoints. Export and deletion require an authenticated account session; restoration accepts eligible restoration credentials as described above:

POST /v1/gdpr/export returns a downloadable JSON attachment containing only the requested supported sections: account profile, collections, memories, and explicitly requested trajectory or API-key metadata. Webhooks, settings, documents and media are not sections of this export; contact support for data categories not covered by the endpoint.
POST /v1/gdpr/delete-account soft-deletes your account and everything in it (90-day grace window before permanent removal).
POST /v1/gdpr/restore-account restores a soft-deleted account during the grace window.

For custom requests, contact contact@hebbrix.com.

05. Training, retention & residency

Hebbrix does not use Customer Content—including memories, embeddings, prompts, outputs, corrections, feedback, content-bearing traces, or support payloads—to train shared or general-purpose AI models or as a silent product-improvement corpus. A future content-use program would require separate explicit opt-in terms and an auditable consent record.
Amazon Bedrock processing is used for memory extraction, and OpenAI API processing is used only for other features that require it. AWS and OpenAI state that customer inputs and outputs are not used to train their shared foundation models by default; Hebbrix does not opt Customer Content into model-improvement sharing.
The hosted service currently runs in AWS US East; customer-selectable residency is not currently offered.
Production application logs are retained up to 90 days, hosted MCP logs 30 days, automated database backups 14 days, service backup exports 35 days, and deleted media object versions one day. Collection data becomes inaccessible at the primary boundary immediately; live vector, graph, profile, cache, integration, and object projections have a 24-hour engineering cleanup objective backed by durable retry records. This is not a contractual maximum on the self-serve service; regulated workloads require a signed deletion SLA and escalation terms before submission.
Current subprocessors are AWS (hosting, storage, databases, backups, networking, email, monitoring, and Bedrock model inference), OpenAI (limited language-model processing for other features that require it), Stripe (billing), Sentry (error and reliability monitoring), Google (OAuth or requested Google integrations), and providers for integrations you explicitly enable.
DPA, BAA, data-residency, compliance-report, and contractual-SLA requirements must be agreed in signed terms before regulated data is submitted.

Privacy & Data Export