1. Who we are
Hakim is operated from the United Arab Emirates. For data-protection purposes, Hakim is the data controller for account-holder information (your name, billing contact, usage logs) and the data processor for customer content (the audio and text you send through the API). For questions about this policy, write to privacy@tryhakim.ai, a privacy-trained engineer responds within two business days.
2. What we collect
- Account data
- Email address, full name, workspace/organization name, billing address, and the password hash Auth.js issues when you sign up with email. We also keep a hashed record of the API keys you create so we can authorise requests without storing the plaintext secret.
- Customer content
- The audio bytes you send to Hakim Arab v2 for transcription and the text you send to Hakim Fast v1.3 for speech synthesis. We also keep the resulting transcripts and the generated audio for the retention window below, this is what powers the "replay last 10 requests" feature in the dashboard.
- Telemetry
- Request metadata: timestamp, model ID, region ID, latency, byte count, HTTP status, client IP hash, and the workspace the request belongs to. This is what appears on your usage dashboard and powers quota enforcement. We do not log request bodies or response bodies as part of telemetry.
3. Why we collect it
Account data authenticates you, lets us bill you, and lets us email you about incidents you care about. Customer content is processed exclusively to fulfil the API call you made. Telemetry drives rate limiting, anomaly detection, and the health indicators on the status page. We do not train any model on your traffic, our training corpus is contractually licensed separately, as documented in our DPA.
4. Where your data lives
You pick a region at workspace creation time. Today we operate four live regions: UAE, KSA, Qatar, and EU-Frankfurt (eu-central-1). Every request you make, audio in, transcript/audio out, is processed entirely inside that region. We do not silently route cross-region. The only exception is account-level data (your email, billing address) which sits in GCC-UAE for all customers because that's where our billing system is homed; we disclose this up-front rather than claim a blanket-residency promise we can't keep.
5. How long we keep it
Customer content has a default 30-day retention window so replay and debugging work. Enterprise contracts can override this to zero-retention or a fixed window up to 180 days. Telemetry and account data are retained for the lifetime of your account plus 12 months for tax and dispute resolution. When you delete your workspace we purge customer content within 72 hours and scrub telemetry within 30 days, both operations are recorded on your deletion receipt.
7. How we secure it
TLS 1.3 on the wire, AES-256-GCM at rest on both S3 and RDS, SOC 2 Type II audit engagement in progress, and quarterly third-party penetration tests against the API and dashboard. All production access is logged, reviewed weekly by the on-call engineer, and gated behind FIDO2 hardware keys. Incident response has a 24-hour notification commitment for any confirmed customer-content breach.
8. Your rights
If you're in the UAE, KSA, EU, or another jurisdiction with similar privacy laws you have a legal right to access, correct, port, or delete the personal data we hold about you, and to object to specific processing. The dashboard exposes self-serve export and delete actions for account-holder data; customer content is removed by the workspace deletion flow. If either of these doesn't cover you, for example you're a former contractor asking about old records, write to privacy@tryhakim.ai and we respond within 30 days.
10. Changes to this policy
Material changes are announced 30 days in advance by email to every workspace owner and in the changelog under the `privacy` tag. Continued use after the effective date constitutes acceptance. Non-material changes (typos, clarifications, subprocessor additions with equivalent commitments) ship immediately but are still listed in the changelog.
11. Contact
Privacy questions: privacy@tryhakim.ai. Security reports: security@tryhakim.ai. Compliance questionnaires: compliance@tryhakim.ai. For postal correspondence, email legal@tryhakim.ai and we'll share the registered address for the United Arab Emirates entity.