Privacy Policy

Last updated: 29 April 2026.

1. Who we are

TechMate (registered as «شركه رفيق التقنية تضامنية», a joint partnership), CR 1661879, Muscat, Sultanate of Oman. Privacy contact: privacy@hatchloop.dev.

2. What we collect

• Account data: agent identity tokens, billing email, company name (if provided).
• Operational metadata: request timestamps, operation names, response codes, latency. Used for billing, abuse prevention, and debugging.
• Location text sent to find_business: the city, postal code or address your agent asks us to search near, and the search area, are sent to public OpenStreetMap services (see section 7) to find businesses. Treat that field as public: do not put a private person’s home address in it.
• Business data passed by your agent: phone numbers and email addresses are never stored in plaintext; we keep only an HMAC-SHA256 hash for compliance audit. Free-text message bodies are retained for 30 days at most, then deleted.

3. What we never collect

• End-user payment card details — Polar holds these on its PCI‑DSS Level 1 infrastructure; we receive only a redacted token.
• Biometric or special-category data.
• Recordings of voice calls (Vapi-side retention is configurable; we do not pull them into our systems).

4. How we use the data

• To deliver the Service you requested.
• To bill you accurately. Every operation returns an itemised receipt showing what was charged and why; call preview_cost (free) to see the price before you commit.
• To show a regulator or recipient, on request, what the compliance gate decided and why.
• To detect abuse and enforce the Terms of Service.

5. Legal bases (GDPR / UK GDPR)

• Contract: processing necessary to deliver the Service you signed up for.
• Legitimate interests: abuse prevention, security logging, service improvement.
• Legal obligation: tax records, regulatory disclosures.

6. International transfers

Our application is hosted in Frankfurt, Germany (EU). Sub-processors may store data in the United States (Twilio, Resend, Polar, Cal.com). Where required, we rely on EU Standard Contractual Clauses and the Data Privacy Framework.

7. Sub-processors

• Render (Frankfurt) — application hosting.
• OpenStreetMap Foundation (Nominatim geocoding, nominatim.openstreetmap.org) and the operator of the public Overpass API (overpass-api.de) — receive the location text and search area from find_business, plus our server’s IP address, to resolve a place and list nearby businesses. Their data is © OpenStreetMap contributors (ODbL).
• Twilio — SMS / voice carrier.
• Vapi — voice AI agent fallback.
• Resend — transactional email delivery.
• Cal.com — calendar API for booking flows.
• Polar — Merchant of Record for billing.

8. Retention

• Operational logs: 90 days.
• Free-text message bodies: 30 days.
• Compliance hashes: 7 years (statute of limitations for TCPA).
• Billing records: 7 years (Omani tax law).

9. Your rights

You may request access, correction, deletion, restriction, or portability of your data. EU/UK residents may also lodge a complaint with their supervisory authority. Email privacy@hatchloop.dev — we respond within 30 days.

10. CCPA notice (California residents)

We do not sell personal information. You may request what we hold about you and ask for deletion at the address above.

11. Children

The Service is not directed at children under 16. We do not knowingly collect data from them.

12. Changes

Material changes to this policy will be announced on this page at least 30 days before they take effect.