Privacy policy

Last updated 11 October 2026

1. Who is responsible

Controller: BrownHawke Engineering, United Kingdom. Owner: Brandon Brown. Address: Unit 12E Cooksland Industrial Estate, Bodmin, Cornwall, PL31 2QB. Email: enquire@brownhawke.engineering. ICO registration number: {{ICO_NUMBER}}.

We do not have a statutory data protection officer. Privacy questions go to the email above.

2. The data we collect

Account

Your name, email address and a salted hash of your password. We never store the password itself. Whether your email is verified, and your sign-in sessions.

Billing

Your plan, billing interval, credit balance, the credit ledger (every grant, purchase and spend), and the customer and subscription references our payment processor gives us. The payment processor holds your card details and billing address. We never see or store your full card number.

Usage

Which agent handled a request, how many credits it cost, which Hawkeye model tier answered, and the time. Routine schedules and run history.

Content

Messages you send to agents and their replies, agent names and instructions, project files, generated images, video and audio, routines, and what your agents write to your projects.

Agent computer contents

On paid plans your account has a cloud computer. Its files, installed tools, browser profile and logins, and the screen your managers use are stored for your account. Worker containers save their working files to object storage when they stop.

Integrations and secrets

When you connect another service, we store the access tokens that service gives us, encrypted. Secrets you give an agent through the masked secret box are stored encrypted and are never shown to the agent or to a model.

Cookies and browser storage

One sign-in cookie and a few first-party browser storage keys. No analytics or advertising cookies. See the Cookie notice.

Logs

The time of a request, the page or API called, the IP address of the connection, and security events such as sign-ins, exports, deletions and failed payments. Logs do not contain your password, cookies, tokens or message bodies.

Support and waitlist

Emails you send us, and the name and email you give if you join a waitlist.

3. Why we use it and our lawful bases

• To provide your account, agents, agent computers, routines, integrations and chat. Contract.
• To meter credits, take payment, send purchase and renewal emails, and keep billing records. Contract, and legal obligation for the records HMRC requires us to keep.
• To send answers through AI model providers and the other processors below. Contract.
• To keep the service secure: the sign-in cookie, rate limits, sign-up checks, the spending pause, abuse detection and logs. Legitimate interests in protecting accounts, other customers and the service. You can object (see your rights).
• To email you about your account: verification, password reset, purchases, price changes, computer deletion warnings and changes to these terms. Contract and legal obligation.
• To tell you when a waitlist place opens, and any marketing email you have agreed to. Consent, which you can withdraw at any time.
• To answer support requests and complaints. Legitimate interests.
• To comply with the law and lawful requests from authorities. Legal obligation.

We do not sell personal data. We do not use your content to train AI models. We do not make decisions about you by automated means that have legal or similarly significant effects.

4. AI processing

Hawkeye does not run its own large language models. When you or a routine sends a request, the prompt, the relevant chat history, the files and project content needed to answer, and any tool results are sent to one or more third-party AI model providers. Which provider answers depends on the task, your plan and the current routing. Agents also call search, image, video and audio providers when a task needs them, sending the query or prompt and any images you supplied.

Providers process this data under their API terms to produce the answer. They may keep it for a short period for abuse monitoring. We send only what the task needs and no card data. The providers are named in section 5 and the countries involved in section 6.

6. International transfers

We are in the United Kingdom. Our database and the Hawkeye app are hosted in the UK and Western Europe. Account computers run in Germany.

Several providers in section 5 are in the United States. Transfers to them rely on [Transfer safeguard — to confirm: UK Addendum to the EU Standard Contractual Clauses, the International Data Transfer Agreement, or the UK-US Data Bridge where the provider is certified].

China. DeepSeek is based in China. When a request is routed to DeepSeek, the prompt, the chat history and the content needed to answer it are processed in China. China does not have a UK adequacy decision. The safeguard for that transfer is [Transfer safeguard for DeepSeek — to confirm]. If you do not want your content processed in China, tell us and we will explain the options available on your plan.

7. How long we keep data

• Account, chats, projects and agent data: for as long as your account is open. You can delete chats, projects and agents at any time.
• Sign-in sessions: 30 days, or until you sign out.
• Account computer after a move to Free: the computer is stopped and kept for 3 days, then its files are backed up to object storage for 30 days, then deleted.
• Worker container state: saved to object storage while the agent exists, and deleted with the agent.
• Generated images, video and audio: kept with your account. Shared links to them expire after 7 days.
• Billing records: for as long as UK accounting and HMRC record-keeping rules require, currently six years after the year they relate to.
• Logs: [Log retention period — to confirm].
• Database backups: [Database backup retention — to confirm]. Deleted data can stay in a backup until that backup is rotated.
• Waitlist and support email: until the request is dealt with and for a reasonable period afterwards.

8. Deleting your account and exporting your data

• You can ask us to delete your account at any time. Deletion removes your login, sessions, chats, files, projects, routines, integration tokens and secrets, and your agents and their computers, and asks the payment processor to delete its customer record. One credit ledger row keeps its amount with your address replaced by the word "erased", so the books still balance without naming you.
• You can ask for a copy of your data. The export includes your profile, billing summary, agents, chats, projects, file lists, routines and connection labels. It never includes decrypted tokens or secrets.
• Email enquire@brownhawke.engineering from the address on your account. We will confirm it is you. We answer within one month.
• Billing records that the law requires us to keep are kept after deletion.

9. Security

• Passwords are stored as salted hashes. The sign-in cookie cannot be read by page scripts and is only sent over HTTPS in production.
• Integration tokens and secrets are encrypted at rest. Agents use secrets through a server-side step and never see the value.
• Each account computer is its own sandbox with its own user, home directory and network namespace. Each manager has its own display, so one agent cannot see another's screen.
• Model calls from your agents go through our metering proxy. Your agents never hold our provider keys.
• Only staff who need access to run the service have it. No online service can promise that data will never be lost or seen. Tell us at once if you think your account has been accessed without permission.

10. Children

Hawkeye is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has an account, email us and we will delete it.

11. Your rights

Under the UK GDPR you can ask us to:

• Access the personal data we hold about you, and get a copy.
• Rectify data that is wrong or incomplete.
• Erase your data, where we no longer need it or you withdraw consent.
• Restrict how we use your data while a question about it is resolved.
• Port data you gave us to you or another service, in a machine-readable form.
• Object to processing based on legitimate interests, and to any marketing.
• Withdraw consent at any time where consent is the basis.

Email enquire@brownhawke.engineering. We may need to confirm your identity. We reply within one month, or tell you if we need longer. These rights are free unless a request is clearly unfounded or excessive.

12. Complaints

You can complain to the Information Commissioner's Office (ICO), the UK regulator for personal data, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would like the chance to put things right first, so please email us before you do.

13. Changes to this policy

The date at the top shows the current version. If we add a sub-processor, start a new kind of processing, or change this policy in a way that affects you, we email account holders before it takes effect.

14. Contact

BrownHawke Engineering, Unit 12E Cooksland Industrial Estate, Bodmin, Cornwall, PL31 2QB. Email enquire@brownhawke.engineering.