Privacy Policy

1. Introduction

Hawiyat (we, our, or us) operates hawiyat.org and provides AI infrastructure services including the Hawiyat AI Composer execution layer, container-based app hosting, and managed hosting. We are based in Algiers, Algeria.

This Privacy Policy explains what personal data we collect, how we process it, and what rights you have over your data. It covers our website, API services, and any related platforms we operate. By using our services or visiting our website, you acknowledge the practices described in this policy.

We aim to process your data in a manner consistent with the principles of Algerian Law No. 18-07 on the protection of natural persons in the processing of personal data (as amended by Law No. 25-11 of July 2025), and where applicable, the EU General Data Protection Regulation (GDPR). We are working toward full compliance and registration with the ANPDP (Autorite Nationale de Protection des Donnees a Caractere Personnel). If anything below is unclear, contact us at privacy@hawiyat.org and we will respond within seven days.

2. Data Protection Officer

Law No. 25-11 of July 24, 2025 requires the appointment of a Data Protection Officer (DPO). Hawiyat is in the process of appointing a DPO, with appointment expected by Q4 2026, who will be responsible for overseeing our compliance with Law 18-07 and Law 25-11, advising on Data Protection Impact Assessments, and serving as the contact point for the ANPDP and for data subjects. In the interim, privacy inquiries may be directed to:

• Email: privacy@hawiyat.org
• Mail: Hawiyat, Legal Department, Algiers, Algeria

Once appointed, the DPO's contact details will be communicated to the ANPDP in accordance with ANPDP Decision No. 01 of December 24, 2025.

3. What We Collect

We collect only the data needed to operate and improve our services. Data is collected directly from you (when you sign up, contact us, or use our services) and automatically through our systems (such as IP addresses and usage logs).

Account Information

• Name, company name, and username
• Email address and phone number
• Account credentials and authentication data

Usage and Service Data

• API request metadata (timestamps, model IDs, token counts, latency, HTTP status codes)
• Container deployment and configuration metadata
• Support ticket content and diagnostic information

We do not log API prompt or completion content. Users are prohibited from submitting special categories of personal data (sensitive data) through the Hawiyat AI Composer execution layer or any of our services.

Payment Information

• Billing details and invoices in Algerian Dinar (DZD)
• Payment processor references (Stripe transaction IDs)

Full payment card details are handled by our payment processor (Stripe) and never reach our servers. We only store a reference to the payment method.

Technical Data

• IP address, browser type, device information, and referring URL
• Session activity logs and error reports

We do not process special categories of personal data (sensitive data such as health information, political opinions, religious beliefs, or biometric data) as defined under Article 18 of Law 18-07. If you provide such data to us inadvertently, contact us and we will delete it where required by law.

4. How We Use It

We use your personal data for the following purposes:

• Provide and Operate Services. Provision managed containers, route API requests through Hawiyat AI Composer, manage your account, and maintain platform availability.
• Billing and Account Management. Process payments in Algerian Dinar, generate invoices, prevent fraud, and enforce our Terms of Service.
• Security and Abuse Prevention. Monitor for unauthorized access, detect abuse, enforce rate limits, and protect the integrity of our infrastructure.
• Analytics and Improvement. Analyze usage patterns to improve our products, optimize performance, and plan infrastructure. Analytics data is aggregated where possible.
• Communications. Send service notifications, security alerts, billing reminders, and waitlist updates. No marketing communications are sent.
• Legal Compliance. Comply with legal obligations we are subject to, including tax and accounting record-keeping requirements under Algerian law.

5. Legal Basis for Processing

Under Algerian Law 18-07, processing of personal data requires a valid legal basis. Our primary basis is your express consent. Where consent is not the applicable basis, we rely on one of the following exceptions permitted by law:

• Express Consent (Article 7, Law 18-07). You have given clear, specific, and informed consent to the processing. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Contract Performance. Processing necessary to provide the services you signed up for, handle billing, and manage your account.
• Legal Obligation. Processing required to comply with legal obligations, including tax and accounting record-keeping under Algerian law.
• Legitimate Interest. Fraud prevention, network security, and service analytics, where our interest does not override your fundamental rights and freedoms.

6. Data Retention

We keep your personal data only as long as necessary for the purposes described in this policy, or as required by law. After the retention period ends, data is deleted or anonymized.

• API Request Payloads (prompts and completions). Not stored. Discarded immediately after the response is sent.
• Request Metadata. Kept for 7 days, then deleted. Aggregated token totals are retained for billing and statistics.
• Account and Billing Records. Kept for the lifetime of your account plus the period required by Algerian tax and commercial law (up to 10 years for accounting records).
• Support Logs and Diagnostics. Kept for up to 2 years after the issue is resolved.
• Backup Copies. Limited in retention and deleted as soon as feasible, typically within 90 days.

7. Data Sharing

We do not sell your personal data. We share data only with trusted third parties necessary to operate our services, and only under written contracts that require them to process data solely on our instructions, maintain confidentiality, and implement appropriate security measures.

Sub-processors

• Cloud infrastructure and hosting providers
• Payment processors (Stripe) for billing transactions
• Email delivery services for notifications and support
• Monitoring and error tracking services

Legal and Safety Disclosures

We may disclose personal data when required by law, to respond to valid legal requests from public authorities, to prevent fraud or imminent harm, or to protect our rights and property.

Upstream AI Providers

When you use Hawiyat AI Composer to call an AI model, your request is forwarded to the provider you selected (OpenAI, Anthropic, Google, or others). Each provider has its own privacy policy that applies once the request leaves our infrastructure. Where available, we negotiate zero-retention terms with these providers.

8. International Transfers

Our sub-processors and the AI model providers you use may be located outside Algeria, including in the United States and the European Union. Where transfers of personal data to a foreign state occur, Algerian law requires an adequate level of protection and, where applicable, authorization from the ANPDP.

We are engaging with the ANPDP regarding the authorization framework for our international data transfers. In the interim, we apply the following safeguards to all cross-border data transfers:

• Contractual safeguards with sub-processors requiring adequate data protection measures
• Data minimization and encryption for data in transit (TLS 1.3)
• Where appropriate, reliance on statutory exceptions under Law 18-07 such as contract performance or your explicit consent

We do not transfer personal data to any jurisdiction where such transfer would endanger public security or the vital interests of the state.

9. Security

We implement technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, guided by the requirements of Article 38 of Law 18-07 and Article 45 bis 8 of Law 25-11.

• Encryption in transit (TLS 1.3) for all data transmitted to and from our services
• Encryption at rest (AES-256) for stored data where applicable
• Role-based access controls, multi-factor authentication, and audit logging for production systems
• Regular security assessments, vulnerability scanning, and incident response procedures
• Data Protection Impact Assessments (DPIAs) for high-risk processing as required by Law 25-11

In the event of a personal data breach, we will notify the competent supervisory authority without undue delay and within the timeframe recommended by Law 25-11. If the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, describing the nature of the breach, the likely consequences, and the measures we have taken or propose to take. If you suspect a breach, contact us immediately at privacy@hawiyat.org.

10. Automated Decision-Making

Law 25-11 introduced provisions on profiling and automated decision-making. Hawiyat does not make decisions based solely on automated processing of personal data that produce legal effects concerning you or similarly significantly affect you. Where we use automated systems for fraud detection or rate limiting, these are subject to human oversight and do not constitute solely automated decisions with legal effect.

11. Your Rights

Under Law 18-07 and where applicable the GDPR, you have the following rights regarding your personal data:

• Right of Information (Article 32). To be informed, before data is collected, of the identity of the controller, the purposes of processing, the recipients of the data, your rights, and whether data will be transferred abroad.
• Right of Access (Articles 33-34). To obtain confirmation of whether we process your data, and to receive a copy of the personal data we hold about you, along with information on the purposes, categories of data, and recipients.
• Right to Rectification. To request correction of inaccurate or incomplete data. We will respond to rectification requests within a reasonable timeframe (within 10 days as recommended under Algerian law).
• Right to Object. To object to the processing of your data for direct marketing purposes, or on grounds relating to your particular situation for other processing.
• Right to Withdraw Consent. To withdraw your consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to Erasure. To request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where processing is based on consent and you withdraw that consent, subject to our legal obligations (such as tax and accounting retention requirements).

To exercise any of these rights, email us at privacy@hawiyat.org. We may ask you to verify your identity before processing your request. We will respond within a reasonable timeframe. You also have the right to lodge a complaint with the ANPDP (Autorite Nationale de Protection des Donnees a Caractere Personnel) or your local data protection authority.

12. Cookies

Our website uses a limited set of cookies. Algerian law requires express, specific, and informed consent before placing non-essential cookies. We apply the following categories:

• Strictly Necessary Cookies. Required for authentication, session management, and load balancing. These are exempt from consent requirements as they are essential for the functioning of the website.
• Analytics Cookies. Privacy-focused analytics to understand how our website is used. These are placed only after we obtain your express, granular consent through a cookie consent banner. You may withdraw consent at any time.

We do not use third-party advertising cookies. You can control cookies through your browser settings or through the consent banner on our website. Disabling strictly necessary cookies will break core functionality such as signing in to your account.

13. Children

Our services are not directed to minors. Under Algerian law, processing of a child's personal data requires the consent of their legal representative. We do not knowingly process personal data of minors without such consent. If you believe a child has provided personal information to us without appropriate consent, contact us at privacy@hawiyat.org and we will delete it.

14. Changes to This Policy

When we make material changes to this policy, we will post the updated version here and notify active users by email. Your continued use of our services after the change takes effect means you accept the updated policy. We encourage you to review this page periodically.