Privacy Notice

Who is responsible

Better Web Design and Development Services, LLC, doing business as BWD.io, operates Huck. We determine how account, website, billing and support information is used for our business operations. For personal data a customer sends to its workspace or collects through its embedded assistant, the customer normally decides the purposes and we process on its instructions. That customer’s own privacy notice also applies.

If you used an assistant on another organization’s website, contact that organization about its records and choices. We can help route a request, but cannot disclose another customer’s data or bypass its authorization. Contact us directly about your Huck account or our own handling of your information.

Information we receive

Account information includes your name, email, password hash, workspace, roles, authentication records and agreement receipts. Billing information includes Stripe customer/subscription references, invoices, payment status, amounts and limited payment-history details. Card collection occurs on Stripe’s hosted pages; do not place complete payment-card numbers in Huck chat or support.

Workspace information can include text or JSON records, record identities and revisions, gate labels and membership information, prompts, questions, answers, citations, conversations, action arguments/results, evaluation cases and captured context. Its personal-data content depends on what the customer supplies. Support requests include the contact details, subject, message and attachments or links you choose to provide where supported.

Our application and infrastructure may record technical information such as IP address, browser/device information, timestamps, request identifiers, authentication events, usage counts and error information. We receive information directly from you, from the organization using Huck and from providers involved in hosting, authentication, payment or delivery. Do not submit sensitive material that is unnecessary for the requested function.

How and why we use information

We process information to operate accounts, authenticate requests, enforce access rules, index and retrieve records, generate answers, run requested evaluations, deliver configured actions, maintain usage limits, handle payments, answer support requests, investigate failures and protect the service. We also keep records needed for accounting, disputes, legal obligations and enforcement of agreements.

Where a law requires a legal basis, these activities may be necessary to perform our contract, comply with legal obligations or pursue legitimate interests in secure and reliable operations, subject to applicable balancing and rights. Where consent is required, we will seek it for that purpose; agreeing to service terms is not blanket consent for unrelated marketing or sensitive-data use. Customer-directed processing uses the customer’s instructions and applicable Data Processing Addendum.

AI processing and model training

To provide AI features, the configured model provider receives the question, applicable instructions, selected authorized source text and relevant conversation or evaluation context. Embedding providers receive source text or query text for indexing and retrieval. Retrieval does not mean that information stays only inside Huck’s database. A configured action endpoint receives the arguments and context required for that action.

Huck does not use private workspace content to train a general-purpose model for other customers. The current OpenAI API integration requests that responses not be stored as retrievable application state. That setting is not a promise of zero retention: provider abuse monitoring, safety processing, caching and legal exceptions can still apply. OpenAI’s published API policy does not use API data for model training unless the customer opts in. We do not offer or claim an approved zero-data-retention arrangement by default. See our Subprocessors page and the provider’s current data controls.

Who receives information

Authorized workspace users receive information according to their access. BWD personnel with an operational need may access information for support, security, legal or service administration; the platform owner has privileged support and operational access. We use the providers described on the Subprocessors page for infrastructure, AI and payments. Customer-selected integrations receive information when the customer enables or invokes them.

We may disclose information where legally required, to protect rights and safety, to professional advisers bound by appropriate duties, or in a business transfer subject to applicable safeguards and notice. We do not sell personal information, share it for cross-context behavioral advertising or place advertising trackers on the Huck marketing site. Customer websites and Stripe-hosted pages have their own practices.

Retention and deletion

Workspace source records and conversations remain available until deleted through supported controls or a verified request, subject to service operation, legal holds and the customer’s instructions. Subscription cancellation is not a deletion request. We do not currently apply a universal automatic expiration to all knowledge, conversations or support requests. Retention depends on the category, ongoing need, instructions and legal requirements, rather than a promise that every record disappears after the same number of days.

Frozen evaluation snapshots have a seven-day application expiry; source changes and privacy erasure can invalidate retained evaluation content sooner. Expired credentials are rejected even when associated security receipts remain for investigation. Account, financial, security and agreement records may remain where needed for legal obligations, fraud prevention or disputes; access is restricted and the retained data is limited to that purpose.

Deletion from the active application does not instantly remove a prior recovery backup, a provider’s safety logs, an upstream source or a completed external action. Routine production database recovery backups currently use a seven-day window. Separately retained recovery snapshots may last longer and are not used for ordinary processing. We review and remove recovery copies when they are no longer needed; if a backup is restored, applicable deletion instructions must be reapplied. Ask us about a specific deletion or retention requirement before sending data that depends on it.

Security and international processing

We use access controls, encrypted connections, restricted infrastructure access and encryption for production storage, together with safeguards specific to sessions, support content and privileged access. No system is immune from every attack or error. Protect your own credentials and test customer-defined gates. Our Data & Trust page explains product controls without representing a security certification.

Huck’s primary production hosting is in the United States. Providers may process information in other locations under their own agreements. We do not promise an EU-only region, a Data Privacy Framework certification or an executed international-transfer mechanism merely because you open a workspace. If your use requires Standard Contractual Clauses, a UK transfer addendum or another arrangement, contact us to complete the applicable documentation before transferring the affected data. The Data Processing Addendum describes this requirement.

Your choices and requests

Depending on your location and applicable law, you may have rights to access, correct, delete or receive a copy of personal information, object to or restrict processing, withdraw consent, opt out of certain uses, or appeal a decision about a request. We do not penalize you for exercising applicable rights. You may also complain to the privacy regulator with jurisdiction over your situation.

Use the contact on this page or the support form to make a privacy request. Tell us the account or website involved and what you need; do not send passwords or unneeded identity documents. We verify identity and authority proportionately before acting and respond within the applicable legal period. An authorized agent may contact us with appropriate proof of authority. If we must retain information or cannot grant a request, we explain the applicable reason and any available appeal route. Customer-controlled records are handled in coordination with that customer.

Because Huck does not sell information or use cross-context advertising, there is no such activity to opt out of on our site. Browser privacy signals do not disable essential security or session functions. If we introduce an optional advertising or analytics use, we will update the notice and implement the choices required before that use begins.

Children, updates and contact

Huck’s workspace service is intended for adults acting for businesses, not for children. Customers must not deploy it as a child-directed service or knowingly submit children’s personal information without a separate approved arrangement and all required safeguards. If you believe a child’s information was submitted improperly, contact us so we can investigate and arrange appropriate removal.

This notice has a dated version. Material changes will be communicated through the service or an appropriate contact channel before materially different processing begins where required. Questions and requests can be sent to the contact or mailing address below. The Cookie Notice, Subprocessors page and Data Processing Addendum provide further details.