Last updated 16 October 2026
This policy explains what information HAITE collects, why, who it goes to, how long it's kept, and what you can do about it.
HAITE is run by Elijah Bailey Budd, ABN 80 812 672 650, of Queensland, Australia. For a copy of your data, a correction, a deletion or a complaint, email hello@haiteai.com.
Your email address, your username, and (if you add them) a display name and a picture. You sign in with a password, a one-time code we email you, or your Google account (Google then tells us your email address and name). Passwords are stored by Supabase, our login provider, in a scrambled form that nobody can read back, including us. We keep these until you delete your account.
If you subscribe, Stripe takes your card details directly. They never touch our servers. We keep a Stripe customer number, which plan you're on and when it renews.
Messages, documents and questions go to an AI provider so HAITE can answer. Our server holds them in memory for up to 30 minutes so the page can collect the reply. If you're signed in, the chat they become is then kept for your other devices, encrypted (see "Your chats, and what HAITE remembers").
So the plan limits work, we count how many messages you send and how many tokens they use, against your account, or your IP address if you're not signed in. Numbers only, never what you wrote. Daily counts reset every day and monthly totals every month. For paid plans we also record roughly what your messages cost us.
Your chat history, saved messages, the short notes HAITE keeps about you, the personality it has worked out for you, your display name and picture are stored in your browser. If you're signed in, a copy is also kept on our server so they're the same on your phone and your computer. That copy is encrypted, only your account can fetch it, and it's deleted when you delete your account. Chats beyond your plan's limit (20 on Free) aren't kept there.
Your settings and any API key of your own stay in your browser only. The notes and settings are sent along with your next message so the answer fits you. Clearing your browser data deletes this device's copy; signing back in brings back the account's copy.
If you add your own API key, it's sent with each message that uses it, passed straight to that provider, and thrown away. We never save or log it. What you spend with that key is between you and the provider.
HAITE only asks for these when you use the feature that needs them, and your browser or phone asks you first: the camera and your photos when you add a picture, your files when you upload a document, and the microphone when you speak instead of type. Nothing is collected in the background. You can turn any of them off in your browser or phone settings; only that feature stops working.
Face ratings are only for accounts that have confirmed they're 18 or over. When you ask for one, your own phone or computer finds your face in the photo and measures it: how even the two sides are, how the parts of your face compare in size, the angle of your eyes. Only those numbers and the photo go to the AI that writes the rating. We don't use any of it to recognise you, we don't make a face template, and we don't keep the points that were found. If you open an old rating, your device finds them again on the saved photo. The rating and a cropped copy of your photo are saved with that chat, like any other message, and they're deleted when you delete the chat.
Sign-in and the contact form use Cloudflare Turnstile to check you're not a bot. It looks at your browser, doesn't track you across sites, and Cloudflare says it isn't used for advertising. Our host also keeps normal server logs (IP address, time, which address was called) for 30 days, for security. They aren't linked to anything you wrote.
Every message is checked for signs that someone might hurt themselves, and for requests for sexual material or instructions to hurt people. Those checks run on our server and send nothing anywhere. When one isn't sure, a short extract of the message and reply goes to a small model at Together AI (listed below) for a second opinion.
We don't keep crisis messages. The server notes that a check fired and what kind it was, never what was said.
HAITE itself sets no advertising or tracking cookies. On the free plan, Google sets its own advertising cookies (see Advertising). Your browser holds:
| What | Why | How long |
|---|---|---|
| Login session (Supabase) | Keeps you signed in. | Until you sign out |
| Your history, settings and notes | So HAITE remembers you. Signed in, a copy is kept for your other devices (above). | Until you clear them |
| Cloudflare Turnstile | Shows you passed the bot check. | Minutes |
| Google AdSense (free plan) | Showing ads, limiting how often you see the same one, and, if you allow it, choosing ads based on your interests. | Set by Google; up to about 13 months |
The first three are needed for the site to work. Google's advertising cookies are not: where the law requires it, you're asked before they're set.
We use Cloudflare Web Analytics to see how many people visit. It sets no cookies, doesn't follow you to other sites and can't identify you. It sees the page you opened, the site you came from and roughly which country you're in. It never sees anything you send HAITE. Any tracker blocker will stop it, and the site works the same without it.
The free plan shows ads from Google AdSense beside your conversations. Paid plans never show ads. Ads never appear on the sign-in screen, Settings, your account or an empty chat.
HAITE doesn't run its own AI model or database. These companies do that work for us:
| Who | What for | Where |
|---|---|---|
| Supabase | Accounts, usernames, plans, usage counts | United States |
| Stripe | Payments and card details | United States, Ireland |
| Together AI | Writing every reply, on every plan, and the second-opinion safety check | United States |
| Groq | Only if you add your own Groq key in Settings | United States |
| Cloudflare | Bot checks and visitor counts | Worldwide |
| Namecheap | Hosting and server logs | United States |
| Wikipedia (Wikimedia Foundation) | Only when HAITE searches the web. It gets the search words, nothing about you. | United States |
| Wikimedia Commons | Finding photos for documents, slide decks and pictures you ask to see, after you say yes. Search words only. Photos shown in a chat load from Wikimedia's servers, like any picture on a website. | United States |
| OpenAlex (OurResearch) | Finding published research, after you say yes. Search words only. | United States |
| Your browser's speech service (Google in Chrome and Edge, Apple in Safari) | Only if you use the microphone in the message box. Your browser turns what you say into text; HAITE only receives the text. | Depends on your browser |
| Tavily, Exa, Brave or Serper | Not used yet. If one is switched on it replaces Wikipedia for web search and gets the same search words. | United States |
| Google AdSense | Ads on the free plan (see Advertising) | United States |
Each provider has its own privacy terms that we can't change. If something is too sensitive for a third party to see, please don't send it.
Nothing you send is used to train any AI, by us or anyone else. There's no setting for it and no plan where it's different. The provider that writes your reply only gets your text to answer it and isn't allowed to train on it. HAITE has no model of its own to train.
The AI check gives a rough estimate of whether a piece of writing reads like AI. It looks at patterns, not at who wrote it. It doesn't decide anything about you: not a grade, not your account, not your price. It isn't proof, and nobody should use it to accuse anyone of anything.
Everyone gets these, wherever you live: to know what we hold, get a copy, correct it, delete it, limit or object to how we use it, take it with you, withdraw any consent you gave, and complain. That includes the rights given by the UK and EU GDPR, California's CCPA, Brazil's LGPD and Turkey's KVKK. Using any of them never changes your price or your plan.
Most of it you can do yourself on the Account page. For anything else, email hello@haiteai.com. We may need to check it's really you first, usually by confirming you control the account's email, and we'll reply within 30 days.
Complaints can go to the Office of the Australian Information Commissioner (oaic.gov.au), the UK's Information Commissioner's Office (ico.org.uk), or your national data protection authority in the EU.
California and other US states: you have the rights above, including to know, delete, correct and opt out of sale or sharing. We never sell your information. Google's personalised ads on the free plan may count as "sharing" for cross-context behavioural advertising under California law; you can opt out in Google's consent message, in Ads Settings, or by emailing us. Anyone under 16 only gets non-personalised ads.
| What | How long |
|---|---|
| What you send, and the reply | Up to 30 minutes, in memory |
| Signed in: your chats, notes, personality, name and picture | Until you delete them or your account |
| Your account, email and username | Until you delete your account |
| Usage counts | Daily counts for a day, monthly totals for a month |
| What your messages cost us | By calendar month |
| Server logs | 30 days |
| Payment records (held by Stripe) | 5 years, because Australian tax law requires it |
Account → Delete account. It removes your login, username, plan and usage counts, cancels any subscription straight away, and clears what HAITE stored in that browser. It happens immediately and can't be undone. Stripe keeps its own record of payments you made, because the law says it has to.
HAITE is run from Australia, but most of the companies above are in the United States. If you're in the UK or EU, your information goes overseas under the European Commission's Standard Contractual Clauses (and the UK Addendum), which those companies include in their own data agreements.
Everything travels over HTTPS. Database rules stop one account reading another's, even if our server were broken into. Secret keys never reach your browser, everything that costs money has rate and spending limits, and every reply is checked before you see it. No system is perfect, which is another reason we don't keep what you send.
If a data breach is likely to cause you serious harm, we'll email you and tell the Office of the Australian Information Commissioner as soon as we can: within 30 days of suspecting it, or 72 hours where UK or EU law applies. We'll say what happened, what was involved and what you should do. We'll never ask for your password or card number by email.
HAITE isn't for anyone under 13. If you think a child under 13 has an account, email us and we'll delete it. If you're 13 to 17, you need a parent or guardian's permission (see the Terms). Anyone known or likely to be under 18 is treated differently: no face or body scores, nothing adult, and only non-personalised ads.
The law there says we have to tell you the legal reason for each thing we do with your data. Here they are:
| What | Legal reason |
|---|---|
| Your account, username and login | Contract: we can't give you an account without them |
| Answering your messages, and using your own API key | Contract: it's what you asked us to do |
| Payments | Contract, and the records tax law requires |
| Usage counts and cost records | Legitimate interests: keeping limits fair and the service affordable |
| Bot checks, server logs and safety checks | Legitimate interests: security and stopping abuse |
| Visitor counts | Legitimate interests: knowing how many people visit, without identifying anyone |
| Ads on the free plan | Your consent, given in Google's consent message, which you can take back at any time |
If this policy changes in a way that affects your data, the date at the top will change and you'll be told in the app before it takes effect.