Privacy Controls - GDPR and Data Management

01. Your Privacy Rights

Export Your Data

Download all your memories, collections, and conversations in JSON format

Delete Everything

Request account deletion and exercise supported data-subject controls

Control Access

Manage who can see your collections and memories

Data Encryption

TLS in transit and encrypted production storage and backups at rest

02. Export Your Data

Go to Settings → Privacy
Click "Export Data"
Choose what to include (memories, collections, etc.)
Click "Download" to get a JSON file with everything

03. Delete Your Account

Warning: Permanent Action. Account deletion is permanent and cannot be undone. When you delete your account:

Your account, collections, and memories are soft-deleted immediately and become inaccessible
You have a 90-day grace window to restore the account via POST /v1/gdpr/restore-account
Associated vectors, search indexes, profiles, graph data, and stored objects are removed through durable, retryable cleanup jobs
After 90 days eligible primary data is permanently removed; encrypted backups expire on their retention schedules rather than being edited record by record
Once past the 90-day window, deletion cannot be reversed

Via UI: Settings → Privacy → Delete Account. Via API: POST /v1/gdpr/delete-account.

04. Delete just one collection

Don't need the whole account gone, just one customer / project / agent? Deleting a collection cascades to every memory, document, media record, profile derivative, decision, correction, and coding-agent record inside it. PostgreSQL deletion and the exact external-cleanup set are committed together; vectors, search indexes, graph projections, caches, and stored objects are then removed by durable, retryable workers. A successful delete makes the collection unavailable immediately without pretending that every external store completed inside one HTTP request.

DELETE /v1/collections/{id}: one collection
POST /v1/collections/bulk-delete: several at once
DELETE /v1/collections/all: every collection you own

Privacy controls. Hebbrix exposes self-serve access, export, deletion, and restoration workflows that support privacy-rights requests. Use these endpoints (all require a valid bearer token):

POST /v1/gdpr/export exports your account data (memories, collections, profile facts, webhooks, settings). Response includes the full JSON dump inline for small accounts.
POST /v1/gdpr/delete-account soft-deletes your account and everything in it (90-day grace window before permanent removal).
POST /v1/gdpr/restore-account restores a soft-deleted account during the grace window.

For custom requests, contact contact@hebbrix.com.

05. Training, retention & residency

Hebbrix does not use Customer Content—including memories, embeddings, prompts, outputs, corrections, feedback, content-bearing traces, or support payloads—to train shared or general-purpose AI models or as a silent product-improvement corpus. A future content-use program would require separate explicit opt-in terms and an auditable consent record.
Amazon Bedrock processing is used for memory extraction, and OpenAI API processing is used only for other features that require it. AWS and OpenAI state that customer inputs and outputs are not used to train their shared foundation models by default; Hebbrix does not opt Customer Content into model-improvement sharing.
The hosted service currently runs in AWS US East; customer-selectable residency is not currently offered.
Production application logs are retained up to 90 days, hosted MCP logs 30 days, automated database backups 14 days, service backup exports 35 days, and deleted media object versions one day. Collection data becomes inaccessible at the primary boundary immediately; live vector, graph, profile, cache, integration, and object projections have a 24-hour engineering cleanup objective backed by durable retry records. This is not a contractual maximum on the self-serve service; regulated workloads require a signed deletion SLA and escalation terms before submission.
Current subprocessors are AWS (hosting, storage, databases, backups, networking, email, monitoring, and Bedrock model inference), OpenAI (limited language-model processing for other features that require it), Stripe (billing), Sentry (error and reliability monitoring), Google (OAuth or requested Google integrations), and providers for integrations you explicitly enable.
DPA, BAA, data-residency, compliance-report, and contractual-SLA requirements must be agreed in signed terms before regulated data is submitted.

Privacy & Data Export