Privacy Policy

Last updated: 9 October 2026

Hachly Limited makes apps, websites and online tools. This policy explains what personal data we collect, why we use it, who we share it with, how long we keep it and the rights you have.

In short

We may collect what our products need to work, plus information that helps us run, protect, market and improve them. Many of our apps have no accounts and identify you only by random identifiers.
Some features use artificial intelligence, and the content you give them (such as messages, photos or recordings) may be sent to AI service providers to produce a result.
If you connect Apple Health or Health Connect, we handle that data in line with Apple's and Google's rules for health data.
We may share personal data with service providers and partners, as described below. We don't sell your personal data for money.
Depending on where you live, you may have rights over your personal data, such as getting a copy or asking us to delete it. Email [email protected].

Who we are

Hachly Limited is the controller of the personal data described in this policy, unless we say otherwise. We are a company registered in England and Wales (company number 15234648) with our registered office at 124 City Road, London, EC1V 2NX, United Kingdom. We are registered with the UK Information Commissioner's Office under registration number ZB751885.

Products this policy covers

This policy applies to every app, website, software tool and online service that Hachly Limited provides (our "products"), including products we launch or acquire after the date above and products that aren't named here. A product is ours if Hachly Limited publishes, sells or operates it, for example if it is listed under Hachly Limited in an app store, names Hachly Limited as its developer, seller or operator, or links to this policy.

Our products include, for example, healmeal, Space AI, Recaplio, yPDF, Wrapr, Quote Buddy, True Stoic, F Metrics, KEEP THE PHONE, madOS, Hachly AI and our websites (such as hachlyai.com, healmeal.app, mados.ai, hachly.com, getspaceai.app and last20.ai). This list is not complete and will change over time.

Some products give extra information about how they use data, in the product itself, in its app store listing or in a section below. That information adds to this policy. Where a product has its own separate privacy notice, that notice applies to that product.

Cookies on our websites are explained in our Cookie Policy. The rules for using our products are in our Terms of Service.

What we collect

What we collect depends on the product and the features you use. It may include:

Details you give us, such as your name, email address, profile and preferences, goals, the content you create or upload (for example messages, photos, voice recordings, documents, prompts and website content), feedback and support requests.
Account and payment information. Where a product has accounts, your login details. Payments are handled by app stores and payment providers (such as Apple, Google and Stripe), and we receive purchase and subscription information from them, not your full card details.
Information collected automatically, such as device and app information, identifiers (for example random app identifiers, device identifiers and, where you allow it, advertising identifiers), how you use our products, crash and performance data, your IP address and approximate location worked out from it, and information from cookies and similar technologies.
Information from services you connect, such as Apple Health or Health Connect, app store developer accounts, social media and messaging accounts, and calendars or business tools, when you choose to connect them.
Information from other sources, such as app stores, payment and subscription providers, advertising, marketing and attribution partners, social media platforms, public databases and other publicly available sources.

How we use it

We use personal data to:

provide our products and the features you ask for, including AI features;
personalise your experience, such as your goals, plans and recommendations;
process payments and subscriptions;
provide support and reply to your messages and feedback;
understand how our products are used, fix problems and improve them;
market our products, send you service and marketing messages (you can opt out of marketing at any time), and show and measure advertising, including personalised advertising where you've agreed to it;
keep our products, users and business safe and prevent fraud and abuse;
meet our legal obligations, protect our rights and enforce our terms;
protect someone's vital interests, for example to prevent harm;
for any other purpose we tell you about when we collect the data, or with your consent.

Health data

Some of our products, such as healmeal, can connect to Apple Health on iPhone and Health Connect on Android. This is optional and only happens if you allow it in your device's permission screen. Health data is special category data under data protection law, and we process it only with your explicit consent, which you give by granting access and can withdraw at any time.

What we may read, if you allow it, depends on the product and the permissions you grant. For healmeal this includes data such as steps, weight and weight history, active energy burned, resting heart rate, heart rate variability, sleep, and workouts and exercise sessions. On Android, healmeal may also ask to read data in the background (to keep step widgets up to date) and to read past data (to import your history).

What we may write, if you allow it: for healmeal, data such as your weight, the workouts you log and the nutrition of the food you log.

How we use it. We use health data to provide and improve the features you use, such as your dashboard, goals and progress, widgets and AI coaching. Health data and other information you enter (such as your goals, body measurements and food log) may be processed on your device, sent to our servers and service providers (including AI service providers), and stored as part of your history and our service logs.

Platform rules. We use and share data from Apple Health and Health Connect only as Apple's and Google's rules for health data allow. Our use of information received from Health Connect complies with the Health Connect Permissions policy, including its Limited Use requirements, and our use of Apple HealthKit data complies with Apple's App Store Review Guidelines and HealthKit terms.

Turning access off. On iPhone, go to Settings, then Health, then Data Access & Devices. On Android, open Health Connect settings, then App permissions. Data an app has already written to Apple Health or Health Connect stays there until you delete it in those apps.

AI features

Many of our products use AI to analyse photos, recordings and text, generate images or text, and hold conversations. When you use these features, we send the content and context the feature needs to our AI service providers (such as Google and OpenAI) so they can produce a result. Depending on the product, we may keep your content, the results and related logs to provide the feature, show your history, fix problems and keep the service safe.

AI service providers process this data under their terms with us. We may also use content and usage information to operate, maintain and improve our products, including our AI features, in line with applicable law. Where the law requires your consent for a particular use, we'll ask for it.

If you record or upload content that includes other people, such as a recording of a meeting or a photo, you're responsible for telling them and getting their permission where the law requires it.

Product notes

Apps without accounts. Many of our apps, such as healmeal and Space AI, don't have accounts. They identify you by random identifiers created on your device and by your app store purchases. Because of this, we may ask you to send your request from within the app (for example through its feedback option, which includes those identifiers) or to give details such as the order ID from your app store receipt so we can find your data.

Analytics, subscriptions and advert measurement in our apps. Our apps may use analytics tools (such as PostHog) to understand usage, fix crashes and improve the app, and subscription tools (such as RevenueCat) to manage purchases. This can include usage events, device information, identifiers, approximate location and some details you enter in the app. Some apps measure which of our adverts led to an install using attribution partners (such as Tenjin, Apple's SKAdNetwork and Apple Ads attribution). On iPhone, an app only accesses your advertising identifier if you allow tracking. You can reset or limit your advertising identifier in your device settings at any time.

Adverts in our apps. Some apps, such as the game KEEP THE PHONE, show adverts through advertising partners such as Google AdMob, which may use your device's advertising identifier, IP address, approximate location and app activity to show and measure adverts under its own privacy policy. Where the law requires it, you're asked for consent before personalised adverts are shown.

madOS. madOS is a tool for app developers and their AI agents. We process your account details, billing information (through Stripe), the API keys and tokens you create, and data from the accounts you connect, such as App Store Connect and social media accounts, so madOS can fetch reports and publish content for you. We also process publicly available information about apps and creators, such as app store listings, rankings, reviews (including reviewers' public names) and public social media profiles; if you appear in this data and want us to stop processing it, email us. madOS uses YouTube API Services: if you connect YouTube, the YouTube Terms of Service and Google's Privacy Policy apply, and you can revoke access at any time in madOS or in your Google security settings.

Hachly AI. Hachly AI lets businesses run an AI assistant on their website and messaging channels. For our business customers, we are the controller of their account, billing and usage data. For people who chat with a business's assistant, the business is the controller and we process the data on its behalf as its processor. This data can include the visitor's messages, the page they're on, approximate location, a random visitor identifier stored in the browser, and any contact details the visitor chooses to give, which are passed to the business. If you chatted with an assistant, please read that business's privacy policy and contact the business to use your rights; we'll help it respond. We may also process some of this data for our own purposes, such as preventing abuse and keeping the service secure.

Our websites. Our websites use cookies and similar technologies as described in our Cookie Policy. Optional analytics and advertising cookies are only used with your consent where the law requires it. Some pages embed content from other companies, such as videos and booking calendars, which may collect data under their own policies.

Legal bases

Under UK and EU data protection law, we rely on these legal bases:

Contract: to provide the products and features you ask for and to handle purchases and support.
Consent: for health data, for optional cookies and similar technologies, for tracking across other companies' apps and websites, and for anything else where we ask for it. You can withdraw consent at any time.
Legitimate interests: to understand and improve our products, market them and measure our advertising, keep our products safe and prevent fraud and abuse, and run and grow our business, where these interests aren't overridden by your rights. You can object at any time.
Legal obligation: to keep records and meet our legal and regulatory duties, including cooperating with authorities.
Vital interests: where needed to protect someone's life or safety.

We don't sell your personal data for money. We may share it:

with service providers who run parts of our products for us, under contracts that require them to protect it and use it only to provide their services. These include providers of cloud hosting and storage, databases, AI, analytics, subscriptions and payments, email and messaging, customer support, security and advert measurement, such as Google, Apple, OpenAI, Vercel, Cloudflare, MongoDB, Stripe, RevenueCat, PostHog, Resend, Upstash, Expo, Tenjin, Meta, LinkedIn, HubSpot and Telegram;
with services you connect or ask us to send data to, such as Apple Health, Health Connect, social networks, messaging platforms and a business's own tools;
with app stores and payment providers to handle purchases;
with advertising, marketing and analytics partners, to understand how our products are used, measure our adverts and, in some products, show adverts, as described above;
with companies in our group, if we have any now or in the future, which will handle it in line with this policy;
if required by law, or to protect our rights, users or the public;
as part of a sale, merger, financing or reorganisation of all or part of our business, or during negotiations for one;
with others, with your consent or at your direction.

We can provide a current list of our main service providers on request.

Other companies' websites and services

Our products may link to or work with websites, apps and services run by other companies, such as app stores, social networks, payment providers and embedded content. We aren't responsible for their content or their privacy and security practices, and data you give them is covered by their own policies, not this one.

International transfers

We are based in the UK, and our service providers may process data in the UK, the European Economic Area, the United States or other countries. When personal data is transferred outside the UK or EEA, we use appropriate safeguards, such as adequacy regulations or decisions (including the UK-US data bridge and the EU-US Data Privacy Framework) and standard contractual clauses approved by the UK and EU authorities.

How long we keep data

We keep personal data only for as long as we need it for the purposes described in this policy, then delete or anonymise it. How long depends on the type of data and why we have it, for example:

data stored on your device stays there until you delete it or uninstall the app, and may be included in your own device backups;
account data is kept while your account is open and for a reasonable period after it is closed;
content you create is kept for as long as you use the feature or until you ask us to delete it;
logs and analytics data are kept for a limited period to run and improve our products;
payment, tax and legal records are kept for as long as the law requires.

We may keep data for longer where the law requires or allows it, or where we need it to resolve disputes, prevent fraud or enforce our terms. When we no longer need personal data, we delete or anonymise it; if that isn't immediately possible (for example, because it is in backups), we store it securely and isolate it from further use until it can be deleted.

Security

We use appropriate technical and organisational measures designed to protect personal data. However, no electronic transmission over the internet or storage technology can be guaranteed to be 100% secure, so we can't promise that unauthorised third parties will never be able to defeat our security and access, steal or change your information. You use our products, and send data to and from them, at your own risk. If a breach affects you, we'll tell you and the regulator where the law requires it.

Your rights

Under UK and EU data protection law you have the right to:

get a copy of your personal data;
correct data that's wrong;
have your data deleted;
restrict or object to how we use it;
receive your data in a portable format;
withdraw consent at any time, without affecting anything we did before.

To use these rights, email [email protected] or use the options in the product. We'll consider and respond to your request in line with applicable data protection law, normally within one month. We may need to confirm it's you and ask for details that help us find your data. These rights aren't absolute: we may decline or limit a request where the law allows, and we may keep some information where needed, for example to prevent fraud, resolve disputes, enforce our terms or meet legal obligations.

If you're unhappy with how we handle your data, please contact us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or the data protection authority where you live.

We don't currently make decisions about you based solely on automated processing that have legal or similarly significant effects.

Do-Not-Track. There is no agreed standard for responding to browser "Do-Not-Track" signals, so we don't currently respond to them. You can manage cookies through our cookie settings.

United States residents. Depending on the state you live in, you may have rights to know what personal information we collect, access it, correct it, delete it, and opt out of targeted advertising, the "sale" or "sharing" of personal information (as those terms are defined by state law) and certain profiling. Some of our websites and apps use advertising cookies or identifiers, which some state laws may treat as "sharing" or targeted advertising; you can opt out through our cookie settings and your device's advertising settings, or by emailing us. To use these rights, email [email protected]. We may need to verify your request, you can use an authorised agent, and if we decline your request you can appeal by replying to our decision. We won't discriminate against you for using your rights.

Children

Our products are not directed at children under 13, and we don't knowingly collect their personal data. Some products have a higher minimum age, which we say in the product or in our Terms of Service (for example, healmeal is for people aged 16 or over, and our business products are for adults). If you think a child has given us personal data, email us and we'll delete it.

Changes to this policy

We may update this policy from time to time, including when we launch new products or change how we use data. The updated policy takes effect when we post it, and we'll change the date at the top. If we make material changes, we may also tell you in the product or by email. Please check this policy from time to time.

Contact

Hachly Limited, 124 City Road, London, EC1V 2NX, United Kingdom. Email: [email protected]. ICO registration number: ZB751885.