Last updated: 25th May, 2026
Plain-English summary. This summary is for convenience only — the full policy below is authoritative.
- Who we are: Hessian Inc., a US company providing forward deployed engineering services for AI agent automation, currently on an invite-only basis.
- What we collect: account, contact, technical, usage, and marketing information when you interact with our site or services, plus payment details if you're a paying customer.
- Why: to deliver our services, run our business, communicate with you (with consent where required), and keep our systems secure.
- Who we share with: service providers we use to operate (e.g. AWS, Stripe, PostHog), our professional advisors, and authorities when legally required. We don't sell your personal information.
- How long: for as long as needed for the purpose. After your account ends, we keep your data for 90 days to let you export it, then delete or anonymize it.
- Your rights: access, correction, deletion, objection, and portability — email privacy@hessian.sh.
- Cookies: we use them for authentication, analytics, and B2B visitor identification. EU/UK visitors get a consent banner.
This policy describes how Hessian Inc. ("Hessian", "we", "us") collects, uses, and shares personal information when you use our services, visit https://hessian.sh (the "Site"), or otherwise interact with us. It applies whether you're acting on your own behalf or on behalf of an organization.
Hessian is a Delaware corporation with its principal place of business at 251 Little Falls Drive, Wilmington, DE 19808. For the purposes of the EU and UK General Data Protection Regulation, we are the data controller of the personal information we hold about you in connection with the Site and our marketing. Where we process personal information on behalf of our customers as part of providing the Hessian Service, we act as a data processor; those terms are in our Data Processing Addendum.
Questions about this policy? Email privacy@hessian.sh.
Depending on how you interact with us, we may collect:
We collect this when you sign up for or use our services, when you communicate with us, when your organization provides your details, or automatically when you visit the Site. We may also obtain information from publicly accessible sources (such as company registries or professional networks) or from authentication providers (such as GitHub or Google) where you've authorized them to share it with us.
We use your personal information to:
Where required by GDPR, we rely on the following legal bases: performance of a contract, our legitimate interests, your consent (e.g. for non-essential cookies and marketing where required), and compliance with legal obligations.
We don't sell your personal information. Our use of certain analytics and B2B-identification cookies may constitute "sharing" under the CCPA; you can opt out via the cookie banner.
We use encryption in transit and at rest, access controls, logging, and internal policies and procedures. Where third parties process personal information on our behalf, we take reasonable steps to ensure they have appropriate security measures. No system is fully secure, and we cannot guarantee absolute security.
Hessian is established in the United States. Your personal information may be transferred to, stored in, and processed in the United States and other countries where our service providers operate. For transfers from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable). Contact legal@hessian.sh for a copy of the safeguards.
We keep personal information only as long as necessary for the purposes described above, taking into account our legal obligations and legitimate business interests. After your account ends, we keep your personal information and customer data for 90 days to allow you to export it, then delete or anonymize it, except where retention is required by law or to establish, exercise, or defend legal claims. We may retain de-identified, anonymized, and aggregated data indefinitely.
Depending on where you live, you may have rights to access, correct, delete, restrict, port, or object to our processing of your personal information, and to withdraw consent at any time (without affecting prior processing). California residents have the right to know, delete, correct, opt out of "sale" or "sharing", and not be discriminated against for exercising rights.
To exercise your rights, email privacy@hessian.sh. You may also be able to update some information directly by logging into your account. These rights may be subject to exceptions under applicable law.
If you're in the EEA or the UK, you have the right to lodge a complaint with your local supervisory authority. In the UK, that is the Information Commissioner's Office.
We use cookies and similar tracking technologies to recognize you, remember your preferences, run analytics, identify visiting organizations, and measure our marketing. Categories include strictly necessary, session, persistent, performance/analytics, and marketing/targeting cookies. We currently use cookies from Hessian (authentication and session management), PostHog (product analytics), and Apollo (B2B visitor identification), each retained for up to one year.
We may include pixels or web beacons in marketing emails to detect opens and clicks. You can opt out of marketing emails at any time via the unsubscribe link in any message.
If you're in the EEA or the UK, we'll ask for your consent before placing non-essential cookies. You can change your preferences at any time via the cookie banner. You can also configure your browser to refuse cookies; doing so may affect site functionality.
Children. The Site and our services are not directed to children under 18, and we do not knowingly collect personal information from children.
Third-party links. The Site may link to third-party sites; we are not responsible for their privacy practices.
Changes. We may update this policy from time to time. The "Last updated" date above reflects the most recent revision; where appropriate, we'll provide additional notice (for example, by email or by a notice on the Site).