Privacy Policy

Key Definitions

• HostFabric™HostFabric, Inc. ("HostFabric," "we," or "us"), the data controller and operator of the HostFabric platform.
• ServiceThe marketing site, control panel, overlays, chat bots, APIs, and automations provided by HostFabric, Inc. or its contractors.
• Personal DataAny information that identifies or relates to an identifiable individual or organization.

Information We Collect

We only process details required to run HostFabric and safeguard your workspace. Depending on the features you enable, we may collect the following:

1. Account & workspace detailsEmail addresses, display names, organizations, and billing contacts provided during onboarding or Supabase authentication.
2. Streaming & prompt contentPrompts, chat submissions, synthesized transcripts, and queue state needed to render overlays and coordinate multi-agent sessions.
3. Configuration & credentialsAPI keys for LLM or TTS providers, Twitch/YouTube OAuth tokens, and Supabase configuration that you store in encrypted form via `.env` files or the secure control panel.
4. Product analytics & diagnosticsDevice type, browser version, performance counters, and structured logs that help us triage issues. Sensitive strings are redacted automatically and MondAI-era test artifacts are rejected before logging.
5. Support communicationsMessages sent to maintainers via GitHub, email, or concierge channels so we can assist you.

How We Use Data

• Operate the HostFabric services, including speech synthesis, moderation, debate pacing, and overlay distribution.
• Personalize avatars, scenes, and notification preferences per workspace.
• Troubleshoot bugs, measure load, and improve agent response latency.
• Comply with legal obligations and enforce acceptable-use policies.

How We Share Data

We do not sell your information. We only disclose what is required to operate HostFabric:

Aggregated or de-identified metrics may be produced for roadmap planning and reliability tracking.

• Hosting & storageVercel for application hosting/CDN and Supabase for database/auth.
• AI & voice providersOpenAI, Anthropic, Google, xAI, Google Cloud Text-to-Speech, ElevenLabs, and any additional providers you explicitly enable.
• Streaming integrationsTwitch, YouTube, Streamlabs, or similar platforms once you connect their APIs.
• Vendors & advisorsAuditors, legal advisors, or contractors bound by confidentiality agreements when assistance is required.

Legal Bases (EEA/UK/Swiss Users)

Where required by law we process data under the following legal bases:

• Contractual necessityProvide, maintain, and secure the Service.
• Legitimate interestsImprove reliability, prevent abuse, and protect platform integrity (balanced against your rights).
• ConsentOptional analytics, beta features, and marketing communications.
• Legal obligationsRespond to lawful requests and comply with recordkeeping duties.

Subprocessors

We vet every infrastructure or analytics vendor for security posture and confidentiality. Core subprocessors include Vercel, Supabase, PostHog (if enabled), and the AI/TTS providers you configure. We will update this list if the roster changes materially.

Retention & Control

• Workspace metadata remains in Supabase until you request deletion or an account is inactive for 12 months.
• Session prompts, queue logs, and audio-timing data expire after 30 days unless you opt into longer retention for analytics.
• You may request export or deletion of personal data by emailing [email protected].
• API keys stored client-side can be revoked any time in their respective provider dashboards.

Your Rights

Depending on where you live you may have the right to access, correct, delete, or port your Personal Data, object to certain processing, or withdraw consent (without affecting prior lawful processing).

• Submit requests via [email protected] and we will respond within 30 days unless law requires a different timeline.
• We may need to verify your identity before acting on a request and may deny requests that conflict with legal obligations.
• You may also lodge a complaint with your local data protection authority.

Security & Incident Response

We follow least-privilege access, encrypt secrets at rest, and use TLS for data in transit. Production access is guarded by hardware-backed MFA and every build is scanned for accidental key leakage.

MondAI-derived prompts or fixtures are scrubbed before release, automation blocks those artifacts in CI, and any detected incident is triaged through a formal response plan. If we discover a breach affecting Personal Data we will notify affected users and regulators as required, including remediation steps.

International Transfers

HostFabric, Inc. operates primarily in the United States but may process data using global infrastructure provided by Vercel or Supabase. By using the platform you consent to cross-border transfers subject to appropriate safeguards such as Standard Contractual Clauses when applicable.

Children

HostFabric is not intended for anyone under 13. Do not submit personal information for children, and contact us if you believe a child has provided information so we can delete it.

Changes

We post updates to this policy and adjust the effective date whenever material changes occur. Significant changes are also announced in the repository changelog.

Trademarks & Ownership

HostFabric™ and the HostFabric logo are trademarks of HostFabric, Inc. You agree not to use our marks without prior written permission. All other product names, logos, and brands referenced in the Service belong to their respective owners.

Contact

Questions about privacy? Email [email protected] or open a GitHub issue titled “Privacy”. We aim to respond within 14 days.