Privacy Policy
Last updated
Version 2.0 · hoshii.ai/policies/privacy-policy
1. Who we are
Hoshii AG · CHE-360.441.059
Zollikerstrasse 1, 8008 Zurich, Switzerland
Contact: contact@hoshii.ai
Hoshii AG is the controller for the processing described here. This policy is written to satisfy the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the GDPR and UK GDPR.
What this policy does not cover. If you use the Hoshii Platform as an employee of one of our business customers, the business communications processed in the Platform — emails, attachments and order data belonging to your employer — are processed on your employer’s instructions. Your employer is the controller; we are the processor. That processing is governed by the Data Processing Agreement and by your employer’s own privacy notice. Please direct questions about that data to your employer.
This policy covers what we process as controller: our website, your account, our business relationships, and recruitment.
2. EU and UK representatives
Hoshii AG is established in Switzerland. Under Art. 27 GDPR and Art. 27 UK GDPR we have appointed representatives. You may contact them instead of us.
EU — Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland · gdpr@euverify.com
UK — Euverify Ltd (UK), 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom · gdpr@euverify.com
Access requests, deletion requests and other enquiries can be submitted through the representative’s secure portal, which also verifies the appointment: gdpr.euverify.com
3. What we process, and why
Website visitors
Data: IP address, browser and device type, pages viewed, referring page, approximate location from IP, cookies. If you contact us or book a demo: name, business email, company, job title, phone, and your message.
| Purpose | Legal basis |
|---|---|
| Operating and securing the site, detecting abuse | Legitimate interest (Art. 6(1)(f)) |
| Responding to your enquiry or demo request | Pre-contractual steps (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
| Analytics | Consent (Art. 6(1)(a)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
Cookie detail is in our Cookies Policy. Change your choices any time via cookie settings in the footer.
Platform users
Data: name, business email, job title, employer, credentials and authentication data, workspace and permission settings, product usage and session records, technical logs, support correspondence.
| Purpose | Legal basis |
|---|---|
| Providing the Platform, authentication, permissions | Contract with your employer (Art. 6(1)(b)), legitimate interest (Art. 6(1)(f)) |
| Security, abuse prevention, audit logging | Legitimate interest (Art. 6(1)(f)) |
| Support and troubleshooting | Legitimate interest (Art. 6(1)(f)) |
| Billing and account administration | Contract and legal obligation (Art. 6(1)(b), (c)) |
Business contacts
If you work for a customer, prospect, supplier or partner: name, business email, phone, job title, employer, records of our correspondence, and contract and invoice data relating to your employer.
| Purpose | Legal basis |
|---|---|
| Managing the relationship | Contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
| Sales communication with business contacts | Legitimate interest (Art. 6(1)(f)); consent where local law requires |
| Invoicing, accounting, tax | Legal obligation (Art. 6(1)(c)) |
Where we got your data, if not from you directly: your employer, a colleague who introduced us, your employer’s public website, or a business networking platform.
Job applicants
Your application, CV, cover letter, references, interview notes and any work sample, processed to assess your application. Legal basis: pre-contractual steps (Art. 6(1)(b)) and our legitimate interest in filling the role (Art. 6(1)(f)).
4. How we use AI
In the Platform. We use artificial intelligence, including large language models, to classify messages, extract structured data and draft responses.
Internally. We use an enterprise AI assistant connected to our own business systems, including CRM, ticketing, billing and document systems. Your business contact data may be processed by it when our team prepares for a meeting, drafts a reply or answers a question about an account.
In both cases, we do not use your data to train, fine-tune or improve AI models. We engage model providers exclusively under enterprise agreements that contractually exclude this.
The Platform is not designed to take decisions that produce legal effects concerning you, or similarly significantly affect you, on a solely automated basis. Where a customer configures it in a way that produces such effects, that customer is responsible as controller.
5. Who we share data with
We do not sell personal data. We share it with: cloud infrastructure and hosting providers; AI model providers; analytics and marketing tools, subject to your cookie choices; payment and billing providers; business software providers for CRM, ticketing, signature and collaboration; professional advisers; and authorities where required by law or to establish, exercise or defend legal claims.
Sub-processors engaged for the Platform, with the service performed, processing region and applicable transfer safeguards, are published and kept current at trust.hoshii.ai/subprocessors.
6. International transfers
We process personal data in Switzerland and the European Economic Area. Switzerland benefits from an adequacy decision under Art. 45 GDPR, so transfers from the EEA to us require no further safeguards.
Where a provider is established outside Switzerland or the EEA, we transfer data only with appropriate safeguards under Arts. 44 et seq. GDPR — the EU Standard Contractual Clauses with the Swiss amendments where applicable, or a valid adequacy decision or Data Privacy Framework certification. You can request a copy at contact@hoshii.ai; we may redact commercial terms.
7. How long we keep data
| Data | Retention |
|---|---|
| Server and security logs | 12 months |
| Contact and demo enquiries with no relationship formed | 24 months from last contact |
| Newsletter subscription | Until you unsubscribe |
| Platform account and profile data | Term of your employer’s contract, deleted within 30 days of its end |
| Product usage and session records | 12 months |
| Support correspondence | 24 months from closure |
| CRM records, active relationship | Duration of the relationship plus 3 years |
| Prospect records, no relationship formed | 24 months from last contact |
| Contracts and order forms | 10 years from end of contract |
| Invoices and accounting records | 10 years (Art. 958f Swiss Code of Obligations) |
| Job applications | 12 months after the decision, or 18 months with your agreement |
8. Your rights
Subject to the conditions of applicable law, you may: access your data; have it corrected; have it erased; restrict processing; receive it in a portable format; object to processing based on legitimate interest, including direct marketing, which we will stop on request; withdraw consent at any time, without affecting processing before withdrawal; and not be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you.
Write to contact@hoshii.ai or use the representative portal in section 2. We may need to verify your identity first. We respond within one month. Where a request is complex, or where we receive a number of requests from you, we may extend that period by up to two further months and will tell you within the first month if we do.
Complaints. You can lodge a complaint with a supervisory authority: the FDPIC in Switzerland (edoeb.admin.ch), the authority of your EEA member state, or the ICO in the United Kingdom (ico.org.uk). You are not required to contact us first, though we would welcome the chance to resolve it.
9. Security
We maintain an information security programme with continuous, automated compliance monitoring. Measures include role-based access control, multi-factor authentication for remote access, encryption of personal data in transit and at rest, mobile device management, regular backups, monitoring and alerting, and a documented incident response process.
Current details, certifications and attestation status: trust.hoshii.ai
10. Changes
We may update this policy. The current version is always published here with its version date. Where a change is material, we notify Platform users and business contacts by email or through the Platform.
11. Contact
contact@hoshii.ai
Hoshii AG, Zollikerstrasse 1, 8008 Zurich, Switzerland
For EU and UK data subjects, see section 2.