Our commitment to privacy

Welcome

As an open-source data company, at HASH we understand the value that’s contained within your personal and business information. That’s why we take every possible measure to secure and encrypt your information, and are mindful whenever we collect it. On this page you’ll find a transparent overview of who we are, what data we collect, and why.

HASH is a company that provides:

• the Block Protocol, a registry and standard for interoperable frontend components and types;
• HASH, an open-source super app for working with data, types, and models;
• HASH IDE, an in-browser environment for developing, testing, and running simulation models and experiments;
• HASH Engine, the fair-source computational engine that powers the IDE, and which is available for local use;
• a cloud compute service for running large, complex HASH simulations, data transformation flows, and event-driven jobs with zero technical setup or maintenance;
• related products, tools, services, training, and account management functionality.

You can find out more about these on our Platform Overview page (hash.ai/platform).

Why does HASH store user data?

We collect data for a number of reasons.

1. Functionality: first and foremost, we can’t provide users with a service if we’re unable to authenticate their identity. Information like usernames, email addresses and passwords enable us to do this. It’s also not much good being able to log in if your personal projects and files aren’t available, so we store user-uploaded information including datasets, models and algorithms on users’ behalves as well.
2. Account servicing, personalization and targeting: we collect usage metrics about how our platform is used so we can improve our product, identify and onboard new users effectively, and provide individuals with a personalized experience. We may also use contact information to make users aware of news and updates relating to HASH.
3. Support and security: we save certain key account information such as the date a user last logged in, and the IP address used to change a password or reset an API key. We do this in order to protect, secure, and effectively service user accounts.

We comply globally with the strictest standards of data protection, going above and beyond measures set out in specific local and national regulations such as the California Consumer Privacy Act (CCPA), and EU’s General Data Protection Regulations (GDPR).

What data is collected?

Users may submit information on the HASH platform via form fields, checkboxes, radio buttons or other interactive inputs, or through integrations with third party providers (for example when using Google, GitHub, Twitter, or LinkedIn to log in to a HASH account, where accounts from these providers may have been associated).

Certain user-submitted Public Information such as name and profile photo will be visible by anybody with an internet connection who visits your HASH profile page. This information can be edited or removed at any time by logging in.

Users may also store Private Information within HASH for processing. This includes contact details which users have not elected to make public, as well as HASH project files, which are private by default. To access a private file, you must either be its creator, or have been invited by an existing user with sharing permissions. As a file creator, you can choose to share your work with individual users and organizations, or alternatively make it publicly accessible to anybody with a link.

How is my data stored?

We store and process data both internally and on cloud servers provided by a number of external providers.

The cost of storing and processing data may differ by region, but your Private Information will always be stored in an encrypted form.

1. Standard encryption: enabled by default, your data is stored and transmitted in an encrypted format. If you ever need to reset your password, you can use the ‘forgotten password’ function to recover your account. This option has the fastest performance.
2. End-to-end (E2E) encryption: If you are at high risk of attack, you may consider enabling E2E encryption. With this enhanced level of security, your data is wholly encrypted on our platform at all points in time, including at rest, in transit, and even whilst operations are being performed on it. Operations may take longer and be more computationally expensive, and we can’t help you recover your account should you ever lose access.

For most ordinary users we believe that standard encryption is sufficient, however especially politically or commercially sensitive clients may wish to take advantage of the greater level of protection afforded by E2E encryption. Contact us to enquire about switching your storage region or enabling E2E encryption for your account.

How can I delete my data?

You can modify or delete your data at any time by logging into your account and overwriting field data, or by using the ‘delete’ buttons found adjacent to many files or elements in HASH. You can also remove all search history and personalised suggestions by clearing your account history.

You can also delete your account completely at any time by contacting us and requesting account deletion. Please note: once an account is deleted, it may be impossible to recover. If your account is part of a HASH organisation, you may need to wait for administrator approval before any data linked to that organisation which may also be associated with your account is deleted.

If somebody else has uploaded information about you which may pose a risk to your health or safety, you can apply to have this removed under our Sensitive Data Removal Policy. Our Sensitive Data Removal Policy also outlines how you can get in touch in cases where there is no immediate risk to health and safety, but where personally-identifiable information may have still been posted about you, without your consent.

What other third-party service providers does HASH rely on?

Not only do we avoid sharing user Private Information with third-parties, we put in place careful measures to limit our own access to it. We do however still utilize a number of third-party software products and data processors when analyzing platform data, and for the purposes of communicating with users. For the sake of transparency, these are outlined below.

Before using any third-party provider, we consider the nature of the information being processed on their platform, and the strength of the security policies and practices they have in place. The history of the company, the competency of its team, and the criticality of the user data we ask them to process all weigh on our decision whether or not to use a given third-party provider. No decision is taken lightly, and we regularly review the data processors we work with to protect our userbase’s interests. We welcome feedback from the community on what standards we should expect of our partners, as well as any concerns or feedback that might relate to existing ones.

The providers that host HASH and process our user’s sensitive data maintain a multitude of certifications, including (where relevant) ISO 27001, ISO 27017, ISO 27018 and PCI DSS certifications. They are also subject to regular SOC reporting. If you are interested in finding out more about certification and compliance within our supply chain please contact us.