Hift: Privacy Policy

Last updated: May, 2026

This Privacy Policy explains what personal data Hift collects, why, who we share it with and what rights you have. In short: we collect only what we need to run Hift, we never sell your data, and your questions are not used to train AI models.

1. Who We Are

   
   

[Company legal name], registered in [country] under registration number [number], with its registered address at [address] ("Hift", "we", "us" or "our"), is the controller of your personal data under the EU General Data Protection Regulation (GDPR).

You can contact us about anything in this policy at privacy@hift.io.

2. What This Policy Covers

   
   

This policy applies to the Hift website at hift.io, the Hift app at hift.app, any Hift websites that redirect to them (such as hift.eu and hift.markets), and our emails, support and recruitment (together, the "Service"). "Inputs" and "Outputs" have the meaning given in our Terms of Service: your questions, and the research Hift generates for you.

It does not cover third-party websites or platforms linked from or mentioned in the Service, such as exchanges or prediction market platforms, which have their own privacy policies.

3. Personal Data We Collect

   
   

Account data. Your name, email address and password (stored in encrypted form) and, if you use it, sign-in through [Google]. You give us this when you sign up, including your confirmation that you are 18 or older.

Payment and billing data. Your billing name and address, card type and last four digits, purchase and subscription history, and invoices. This comes from you and from Stripe. Your full card details go straight to Stripe and we never see them.

Credit and usage data. Your credit balance, credits bought and spent, the research types you use, your plan and any add-ons. This is created as you use the Service.

Inputs and Outputs. Your questions and any text you submit, and the research generated for you, including saved reports.

Support data. Messages you send us through the contact form or by email, including reports of scams or security issues, and our replies.

Technical and location data. Your IP address, the approximate country it indicates, browser and device type, pages visited, error logs and time of access. This comes from your device.

Cookie and analytics data. Collected only with your consent. See our Cookie Policy.

Job application data. If you apply for a job, your name, contact details, CV, cover letter, links you send us, and our notes from the hiring process.

Please don't put more personal information in your questions than you need. In particular, avoid entering health, political or religious information, inside information, or personal details about other people. If you mention your own holdings or finances, we treat that information as part of your Inputs.

We never ask for ID documents, bank account numbers, wallet seed phrases, private keys or passwords to other services.

4. How We Use Your Data and Our Legal Bases

   
   

We use your data only for the purposes below. For each one, we show the data used and our legal basis under the GDPR.

Create and manage your account and check that you are 18 or older. Data used: account data. Legal basis: performing our contract with you.

Generate research and save your reports. Data used: Inputs and Outputs, credit and usage data. Legal basis: performing our contract with you.

Sell credits, plans and add-ons, take payments and prevent payment fraud. Data used: payment, billing, credit and usage data. Legal basis: our contract with you, and our legitimate interest in preventing fraud.

Keep accounting and tax records. Data used: payment and billing data. Legal basis: legal obligation.

Restrict features by country and comply with sanctions. Data used: technical and location data, account data. Legal basis: legal obligation, and our legitimate interest in only offering features, such as prediction market research, where they can be lawfully provided.

Answer support requests, complaints and scam reports. Data used: support and account data. Legal basis: our contract with you, and our legitimate interest in helping users and protecting them from fraud.

Keep the Service secure, prevent abuse and enforce our Terms. Data used: technical and usage data, and Inputs where needed. Legal basis: our legitimate interest in protecting the Service and its users.

Fix errors and improve the Service. Data used: technical and usage data, combined and anonymised where possible. Legal basis: our legitimate interest in running a working product.

Send service emails, such as receipts, credit reminders and notice of changes. Data used: account data. Legal basis: our contract with you, and legal obligation.

Send product news and offers. Data used: account data. Legal basis: your consent or, for existing customers, our legitimate interest. You can opt out at any time.

Run analytics cookies. Data used: cookie and analytics data. Legal basis: your consent.

Review job applications. Data used: job application data. Legal basis: taking steps at your request before entering into a contract, and our legitimate interest in hiring the right people.

Comply with the law and defend legal claims. Data used: any relevant data. Legal basis: legal obligation, and our legitimate interest.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (Section 10).

5. How Hift's AI Handles Your Data

   
   

5.1 To generate your research, we send your Inputs to Anthropic, the company that provides the Claude AI models Hift runs on. Anthropic processes them only on our behalf, under a data processing agreement. We do not send your name, email address or payment details with your Inputs.

5.2 Under Anthropic's commercial terms, Anthropic may not use your Inputs or Outputs to train its AI models. Anthropic deletes them within 30 days, unless it must keep them longer to enforce its usage policy or to comply with the law.

5.3 To find current information, Hift may send search terms based on your question to market data, news, prediction market and search providers. These requests do not include your name, email address or account details.

5.4 We do not use your Inputs or Outputs to train AI models ourselves.

5.5 Hift's AI produces research about markets, assets and events. It does not make decisions about you that have legal or similarly significant effects, such as approving or refusing a service. Country restrictions on features are based on fixed rules, not on an assessment of you.

6. Who We Share Data With

   
   

We never sell your personal data. We share it only with the providers below, who process it on our behalf and only for the purposes in this policy.

Anthropic runs the Claude AI models behind Hift's research. It receives your Inputs and Outputs, and is based in the United States.

Supabase provides our database, sign-in and storage. It holds your account, credit, usage and saved research data, in [an EU region].

[Hosting provider] hosts the Hift website and app and receives technical data. Location: [location].

Stripe processes payments and subscriptions. It receives your payment and billing data, in the EU and the United States.

[Email provider] runs our email accounts and sends our service and support emails. It receives your name, email address and message content, including job applications sent by email. Location: [location].

[Analytics provider] runs website analytics, only with your consent. It receives cookie and analytics data. Location: [location].

Market data, news, prediction market and search providers supply current market information. They receive search terms based on your question, never your account details.

Stripe also acts as an independent controller for some purposes, such as preventing fraud and meeting financial regulations, under its own privacy policy.

We may also share personal data with professional advisers such as lawyers and accountants, who are bound by confidentiality; with public authorities where the law requires it, for example to report suspected fraud or market abuse; and with a buyer or successor if Hift is sold or merged, in which case we will tell you first.

7. International Transfers

   
   

Some providers process data outside the European Economic Area, mainly in the United States. When that happens, we make sure your data stays protected by one of these safeguards:

an EU adequacy decision, such as the EU-US Data Privacy Framework for certified US companies; or

the European Commission's Standard Contractual Clauses, built into our agreement with the provider.

You can ask for a copy of the safeguards that apply at privacy@hift.io.

8. How Long We Keep Data

   
   

We keep personal data only as long as we need it:

Account, credit and usage data. Kept while your account is open, then deleted within [30 days] of closing it, except what we must keep as billing records.

Inputs, Outputs and saved reports. Kept until you delete them or close your account, then deleted within [30 days]. Anthropic deletes its copies within 30 days of processing (Section 5).

Payment and billing records. Kept as long as accounting and tax law requires, currently [7 years].

Support messages and scam reports. Kept for [2 years] after the matter is closed.

Technical logs. Kept for [90 days], or longer only while investigating a security incident.

Job applications. Kept for [6 months] after the hiring process ends, unless you agree that we can keep them longer for future roles.

Cookie and analytics data. Kept as set out in our Cookie Policy.

Data needed for a legal claim. Kept until the claim is resolved.

Deleted data can remain in encrypted backups for up to [30 days] before it is overwritten.

9. Security

   
   

We protect your data with:

encryption when data travels between your device and our servers, and when it is stored;

database rules that let each user see only their own account, Inputs and reports;

access to personal data limited to the people who need it to run the Service;

payments handled entirely by Stripe, so we never store card details;

security checks before launch and after major changes.

No online service can be completely secure. If a breach puts your data at risk, we will inform you and the data protection authority as the law requires.

We will never ask for your password, seed phrase or private keys by email or message. We only send email from addresses ending in @hift.io. If you receive a suspicious message claiming to be from Hift, please report it to security@hift.io.

10. Your Rights

    
    

Under the GDPR, you have the right to:

access the personal data we hold about you and get a copy;

correct data that is wrong or incomplete;

delete your data, where we have no legal reason to keep it;

restrict how we use your data while a concern is being looked into;

move your data, receiving it in a common format to take elsewhere;

object to uses based on our legitimate interests, and to marketing at any time;

withdraw consent at any time, where we rely on it, without affecting earlier use.

To use any of these rights, email privacy@hift.io or use your account settings. We may ask you to confirm your identity first. We will reply within one month, or tell you within that month if a complex request needs up to two more. There is no charge.

11. Marketing Emails

    
    

We send product news and offers only if you have agreed to receive them, or if you are a customer and we are telling you about similar Hift services and you have not opted out. Every marketing email has an unsubscribe link.

Service emails, such as receipts, credit reminders and notice of changes to our terms, are not marketing and will still be sent while you have an account.

12. Cookies

    
    

We use necessary cookies to run the Service, and analytics or marketing cookies only if you accept them. Our Cookie Policy explains each type. You can change your choice at any time through Cookie Settings at the bottom of every page.

13. Children

    
    

Hift is only for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it and close the account.

14. Changes to this Policy

    
    

We may update this policy when the Service, our providers or the law change. If a change is significant, we will tell you by email or in the Service before it takes effect. The "Last updated" date at the top shows when the policy last changed.

15. Contact and Complaints

    
    

For any question or request about your personal data, contact us at privacy@hift.io, or write to [Company legal name], [registered address], [country].

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the data protection authority in the EU country where you live or work, or to our lead authority, [name of data protection authority, for example the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)].