Privacy Policy
Last updated: July 4, 2026
The short version
- We collect what we need to run Hespia: your account details and the goals, check-ins, and notes your team creates.
- We never sell your data, and we do not use your content to train AI models.
- Nova, the AI coach, sends relevant workspace content to trusted AI providers to generate digests and coaching. Those providers process it to serve you and nothing else.
- You can export or delete your data at any time. Email us and it is gone within 30 days.
What we collect
Account information. Your name, email address, and workspace name when you sign up.
Workspace content. The objectives, key results, check-ins, comments, notes, and settings your team creates in Hespia. This is your data; we store and process it only to provide the service.
Usage data. On this marketing site we use Cloudflare Web Analytics, a privacy-first tool that uses no cookies and does not track you across sites. Inside the app we keep basic logs (sign-ins, errors) to keep the service reliable and secure.
How we use your data
We use your data to run Hespia: syncing your workspace, sending the weekly digests you enable, and powering Nova's coaching. When Nova drafts a digest, flags a slipping goal, or writes a retrospective, the relevant goal data is processed by third-party AI model providers under agreements that prohibit them from using it for anything other than serving your request.
We do not sell your data, show ads, or share your content with advertisers. We do not use your workspace content to train our own or anyone else's AI models.
Where your data lives
Workspace data is stored in Google Firebase (Firestore) on Google Cloud infrastructure, encrypted in transit and at rest. This marketing site is served by Cloudflare.
Who we share it with
We share data only with the subprocessors needed to run the service:
- Google Cloud / Firebase for storage, authentication, and hosting
- Cloudflare for serving this website and its analytics
- AI model providers for Nova's coaching features, as described above
Beyond that, we disclose data only if the law requires it.
Retention and deletion
We keep your data for as long as your workspace is active. If you delete your workspace or email us a deletion request, we remove your data from live systems within 30 days; encrypted backups age out shortly after.
Your rights
You can access, export, correct, or delete your data at any time. Email privacy@hespia.com and we will handle it, usually within a few days. If you are in a region with specific privacy rights (such as the EU or California), those rights apply and we honor them.
Beta status and changes
Hespia is in beta, so the product and this policy will evolve. If we make a material change to how we handle your data, we will email every workspace owner before it takes effect.
Contact
Questions about privacy? Email privacy@hespia.com.