Privacy Policy

Last Updated: 16 September 2026

Hiasynth AB (Org.nr 559538-3703, VAT SE559538370301) operates the Hiasynth service, which provides access to Humanity, our synthetic population model, via MCP server and API together with a web application for account management. We are committed to transparency and compliance with the EU General Data Protection Regulation (GDPR), Swedish data protection law, and other applicable privacy laws.

This Privacy Policy explains how Hiasynth collects, uses, shares, and protects personal information when you use our website, web application, API, and MCP server (collectively, our "Services"). By using our Services, you acknowledge this Policy. This Policy incorporates our Terms of Service by reference. If you do not agree with these terms, please discontinue use of our Services.

What We Mean by Personal Data

For purposes of this Policy, "personal data" means any information relating to an identified or identifiable natural person, as defined under the GDPR and Swedish data protection law.

The population data we provide is not personal data. Humanity is a synthetic population: it is generated, not collected. It is fit to published statistics, meaning official statistical-agency tables and survey aggregates, and contains no individual-level source records. No record in the dataset corresponds to a real person, household, or address, and nobody in it can be identified, contacted, or matched back to a living individual. The Services never return individual records; every answer is an aggregate, such as a count, share, distribution, or comparison. Personas and example people in the product are statistical composites of a group, not records and not people. A minimum group size of 100 people is enforced on the server: smaller groups are withheld or rolled up to a larger area, and this cannot be switched off by any customer, client application, or AI assistant. Attributes touching special categories under Article 9 GDPR, such as religion, health, political opinion, sexual orientation, or ethnic and migration origin, are additionally never broken down at fine geographic detail.

The personal data this Policy is about is yours: your account, billing, and usage of the Services.

Hiasynth does not intentionally collect sensitive personal data such as health information, biometric identifiers, or precise geolocation. We instruct users not to include such information in their communications with us.

Information We Collect

Information You Provide Directly. When you create an account you give us either an email address and a password, or a sign-in through GitHub, Google, or Discord, from which we receive your user ID with that provider, your email address, username, and avatar URL. Passwords are stored only as a salted hash and cannot be read back by us. The verification link we email you on sign-up expires after 24 hours, and password reset links are single-use. When you subscribe, Stripe collects your payment details together with the billing address and, if you enter one, the VAT number needed to charge the right tax; we never receive or store your card number. We also keep any correspondence you send us. API keys you generate are stored only as SHA-256 hashes, together with a label and the first characters of the key so you can tell them apart. We cannot recover a key, and a lost key must be replaced.

Connected AI Clients. When you connect an AI assistant to our MCP server, it signs in with OAuth. We record which client you approved, the scope you granted and when, and a hashed refresh token that lets the client stay connected. Every connected client is listed on your connector page, and disconnecting it there revokes its tokens immediately. A client that registers itself with us dynamically leaves a registration record of its name, redirect addresses, and logo. The short-lived access token a client presents on each request is verified and discarded; it is not stored by the query service.

Information Collected Automatically. To operate billing, we keep a usage log with one row per query: your account identifier, the tool called, a timestamp, the credits charged, and whether the call came through an API key or a connected client. We also record the timestamp of last use per API key so you can see which keys are live. Separately, we collect technical telemetry for capacity planning and performance work: which tool was called, which attribute names and operators were filtered on, response size, and timings. This telemetry contains no account identifier and no filter values. It records the shape of a query, not its content.

What We Do Not Store. We do not store the content of your queries: not the question asked, not the values filtered on, not the results returned. We do not receive or store any conversation content from the AI assistant you connect to us; we only ever receive the structured parameters of an individual tool call. Your end users are never identified to us. We do not sell customer data, and we do not use customer usage data to train models.

We do not use third-party analytics services, tracking pixels, or advertising networks. We do not perform behavioral tracking or marketing profiling. Our hosting providers, Cloudflare and Fly.io, keep their own platform request logs, which include IP addresses, for about seven days; we do not send these logs anywhere else. The fonts on our website are currently served by Google Fonts, so your browser sends its IP address to Google when a page loads. We receive nothing from that request.

Children's Data. Our Services are business tools intended for users aged 18 and older. We do not knowingly collect personal data from anyone under 18. If we discover we have inadvertently collected such information, we will delete it promptly. If you believe we may have collected data from a minor, please contact us at support@hiasynth.co.

How We Use Your Information

Hiasynth processes your personal data only where we have a valid legal basis under applicable privacy law. We rely on the following legal grounds:

Performance of a Contract. We process your data to provide, maintain, and support the Services you have requested under our Terms of Service, including authenticating you, serving your queries, maintaining your credit balance, managing your subscription, processing payments through Stripe, sending service notices such as low-credit alerts, and delivering customer support.

Legitimate Interests. We use personal data to secure our platform, detect fraud and abuse, protect the service from overload, prevent unauthorized access, and plan capacity and performance through the technical telemetry described above. These interests are balanced against your privacy rights and do not override your fundamental freedoms.

Consent. For any processing that requires your explicit consent under applicable law, such as certain marketing communications or optional features, we obtain your opt-in consent before proceeding. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

Legal Obligations. We retain and process information as necessary to comply with bookkeeping requirements, tax laws, court orders, law enforcement requests, export control and sanctions regulations, and other legal duties imposed by jurisdictions where we operate.

Automated Processing. Model outputs are synthetic aggregates about hypothetical groups. This processing does not evaluate or profile you or any identifiable real person, and Hiasynth does not engage in automated decision-making that produces legal or similarly significant effects on individuals under GDPR Article 22.

Data Storage and Security

Your account and usage data, and the population dataset itself, are hosted on Cloudflare's infrastructure in the European Union. The query engine runs on Fly.io in Frankfurt, Germany. It holds no data between requests, and every data request to it must carry an internal secret that only our own servers know. Your browser keeps you signed in with a session cookie, described under Cookies and Local Storage below.

Payment processing is handled entirely by Stripe, a PCI DSS Level 1 certified service provider. We never store your full credit card number or CVV code. Stripe's data practices are governed by their privacy policy at stripe.com/privacy.

Transactional emails, such as service notices, are sent through Resend. Resend processes your email address solely to deliver these messages on our behalf.

We implement industry-standard security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. All traffic is encrypted in transit using TLS, and data is encrypted at rest within our infrastructure. Every request requires a valid credential, and credentials are scoped to read-only population access and nothing else. Customers never send us database queries or code: the Services accept only a fixed set of structured parameters, which the server validates against an allow-list before use. Privacy thresholds on the population data are enforced server-side and cannot be overridden. You can revoke an API key or disconnect a client at any time on your connector page, with immediate effect; if you believe a key or your account has been compromised, revoke the key and contact us at support@hiasynth.co.

How We Share Your Information

Hiasynth does not sell, rent, or trade your personal data. We share your information only in the following limited circumstances:

Service Providers. We engage trusted third parties to help us operate the Services: Cloudflare (application hosting, the account and usage database, and storage of the population dataset, all within the European Union), Fly.io (the query engine, in Frankfurt, Germany), Stripe (payments), and Resend (transactional email). Each service provider is contractually required to protect your data and use it only for the specific services they provide to us. We maintain Data Processing Agreements with all service providers that handle personal data on our behalf.

Identity Providers. GitHub, Google, and Discord act as independent controllers when you sign in with them. Their handling of your data on their own platforms is governed by their respective privacy policies.

Your AI Platform. When you connect our MCP server to an AI assistant or agent of your choice, that platform processes your prompts and our responses under its own terms and privacy policy. We receive from it only the structured parameters of individual tool calls, and we are not responsible for its privacy practices.

Legal Requirements. We may disclose your information if required to do so by law or in response to valid requests by public authorities, such as to comply with a court order or similar legal process. Where legally permitted, we will notify affected users before producing data in response to government requests. We may also disclose information when we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a lawful request.

Business Transfers. If Hiasynth is involved in a merger, acquisition, asset sale, or bankruptcy proceeding, your personal data may be transferred as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

International Data Transfers

Hiasynth AB is based in Sweden. All personal data we hold at rest is stored within the European Union: our account and usage database is confined to Cloudflare's EU jurisdiction, and the query engine in Frankfurt, Germany holds nothing between requests. Our application layer runs on Cloudflare's global network, so an individual request may be processed at a location close to you before it reaches the EU database; no personal data is stored outside the EU. Some of our service providers operate globally, which means your personal data may be transferred to and processed in countries outside the European Economic Area, including the United States, where data protection laws may differ from those in the EU. This includes Stripe.

We safeguard these transfers through legally recognized mechanisms under Chapter V of the GDPR, including the EU Standard Contractual Clauses (Commission Decision 2021/914) and, where the provider is certified, the EU–US Data Privacy Framework. You may request a copy of the safeguards we have in place by contacting us at support@hiasynth.co.

Contact Information

Data Controller:

Hiasynth AB
Org.nr 559538-3703
VAT SE559538370301
Registered in Stockholm, Sweden

Email Contacts:

Privacy inquiries: support@hiasynth.co
General inquiries: hello@hiasynth.co

Supervisory Authority:

If you are located in the European Union, you have the right to lodge a complaint with your local data protection authority if you believe we have not handled your personal data in accordance with applicable law. For users in Sweden, the relevant authority is:

Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY)
Website: imy.se
Email: imy@imy.se

Data Protection Officer (DPO).

Hiasynth AB is not currently required to appoint a formal Data Protection Officer under Article 37 GDPR. However, all privacy inquiries may be directed to support@hiasynth.co, where our privacy team will respond promptly.

Data Retention

We retain your personal data only as long as necessary to fulfill the purposes described in this Policy or as required by law. Active account data, including your email, linked OAuth accounts, and API keys, is retained for the duration of your account's active status. Usage logs are kept for no longer than 24 months, and technical telemetry for no longer than 12 months. Payment and subscription records are retained for seven years from the date of the transaction in accordance with Swedish accounting law (Bokföringslagen).

When you close your account, we will permanently erase your personal data within 30 days, apart from what we must keep by law. Our database keeps a built-in restore history for 30 days that cannot be switched off, so deleted records can remain recoverable for up to 30 days after deletion before they are gone for good.

To close your account or request deletion of your data, email us at support@hiasynth.co from the address on the account. We will process your request in accordance with applicable law.

Cookies and Local Storage

Hiasynth sets one cookie. When you sign in, your browser receives a session cookie that keeps you signed in for up to seven days. It is marked httpOnly so scripts on the page cannot read it, and it is sent only to hiasynth.co. Signing out removes it. There are no tracking, analytics, or advertising cookies, and no third party sets cookies on our site.

Your browser's localStorage holds a few conveniences: which sign-in method you used last, a cached copy of your basic profile such as your username and avatar URL, and your display preferences such as dark mode. None of this leaves your browser.

The session cookie and this local storage are strictly necessary to provide the Services you asked for, under Article 6(1)(b) GDPR (performance of contract), and do not require separate consent, which is why we show no cookie banner. You can clear them at any time through your browser settings; doing so signs you out and resets your preferences.

Your Privacy Rights

Depending on your location, you have certain rights regarding your personal data. We respect these rights and will respond to verified requests in accordance with applicable law.

Right of Access. You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how we use it. You can request access by contacting us at support@hiasynth.co.

Right to Rectification. If your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it. You can change some details directly in the web application; for anything else, email us at support@hiasynth.co.

Right to Erasure. You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when you object to processing based on legitimate interests. You can close your account by contacting us at support@hiasynth.co. Note that we may retain certain information where required by law or for legitimate business purposes such as fraud prevention.

Right to Restriction of Processing. You have the right to request that we limit how we use your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing based on legitimate interests. During the period we assess your request, we will restrict processing of the data in question.

Right to Data Portability. You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller. We will provide your data in JSON format upon request.

Right to Object. You have the right to object to processing of your personal data based on our legitimate interests. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests or we need the data for legal claims.

Right to Withdraw Consent. Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

Right to Lodge a Complaint. If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or the supervisory authority in your EU Member State. Contact information is provided in the Contact Information section above.

To exercise any of these rights, please contact us at support@hiasynth.co. We will verify your identity before processing your request and respond within 30 days as required by applicable law. In some cases, we may need to extend this period, in which case we will notify you of the delay and the reason for it.

Links to Other Services

Our Services integrate with third-party platforms including GitHub, Google, Discord, Stripe, and the AI platforms through which you may access our MCP server. When you use these integrations, you are also subject to the privacy policies of those platforms. We encourage you to review their policies to understand how they handle your information. We are not responsible for the privacy practices of these third parties. Any data you provide directly to them is governed by their respective privacy policies.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Services themselves. When we make changes, we will update the "Last Updated" date at the top of this document and post the revised Policy at hiasynth.co/privacy.

For material changes that significantly affect your rights or how we process your data, we will provide advance notice by email to your registered email address or through a prominent notice in the web application. We encourage you to review this Policy periodically to stay informed about how we protect your information.

Your continued use of the Services after the revised Policy takes effect constitutes your acceptance of the changes. If you do not agree with any changes, you may delete your account as described in this Policy. This Policy and any disputes arising from it are governed by the laws of Sweden.

Questions and Contact

If you have questions about this Privacy Policy or how we handle your personal data, please contact us at support@hiasynth.co or hello@hiasynth.co. We aim to respond to all inquiries within a reasonable timeframe and will work with you to resolve any concerns.