Privacy Policy

Effective Date: August 4, 2026

This Privacy Policy describes how Hizura ("we", "us", or "our") collects, uses, and protects your information when you use our platform at hizura.com ("Service"). By using the Service, you agree to the collection and use of information as described in this policy.

1. Information We Collect

1.1 Account Information

When you sign up via Google OAuth, we collect the following from your Google account:

  • Email address
  • Display name
  • Google Account ID

1.2 Usage Data

We automatically collect information about how you use the Service:

  • Queries: The natural language queries you submit, along with status (success/error), error messages, and token consumption.
  • Tables and Results: The structured data tables you create and the extracted results stored within them.
  • Token Usage: The number of AI tokens consumed per request, tracked for billing and quota management.

1.3 Authentication Data

  • JWT Access Tokens: Short-lived tokens (15-minute expiration) stored in your browser's session storage.
  • Refresh Tokens: Stored as secure, HTTP-only cookies with a 7-day expiration. We store only the bcrypt hash of refresh tokens in our database.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Service.
  • Authenticate your identity and manage your account.
  • Process your queries and deliver structured data results.
  • Track token usage and manage your subscription plan.
  • Improve the Service, fix bugs, and develop new features.
  • Communicate with you about your account or the Service.
  • Detect, prevent, and address fraud, abuse, or security issues.

3. Third-Party Data Processing

To operate the Service, your data is processed by the following third-party providers:

3.1 Authentication Providers

We use third-party OAuth providers for account authentication. When you sign in, the provider shares your email, profile name, and account ID with us. Your use of third-party sign-in is governed by the respective provider's privacy policy.

3.2 AI Processing Providers

Your queries are processed by third-party AI services to generate results. These providers may process query text and retrieved web content in accordance with their own data usage policies.

3.3 Web Search Providers

We use third-party search APIs to discover relevant web pages. These services may log search queries per their own privacy policies.

4. Cookies and Local Storage

4.1 Cookies

We use a single essential cookie:

  • refresh_token: An HTTP-only, secure (in production), SameSite=Strict cookie used to maintain your authentication session. Expires after 7 days. This cookie is essential for the Service to function and cannot be opted out of.

4.2 Session Storage

We use your browser's session storage to temporarily store your access token and pending query data during the authentication flow. This data is automatically cleared when you close your browser tab.

4.3 Product Analytics

We measure how the Service is used so we can improve it. This is done entirely on our own infrastructure — usage data is not sent to any third-party analytics provider.

We record page views and in-product actions (such as creating a table or a pipeline), along with the page path and a randomly generated identifier stored in your browser's local storage. That identifier contains nothing about you; it exists so a sequence of actions can be recognised as coming from the same browser. Once you sign in, this activity is associated with your account, including the activity recorded before you signed up. Signing out generates a new identifier.

Acquisition data: when you first arrive, we store in your browser's local storage the campaign parameters in the link you followed (utm_source, utm_medium, utm_campaign, utm_content), the referring website, and the page you landed on. If you create an account, this is saved once to your user record so we can understand which channels bring people to Hizura. It is never updated afterwards and is never shared with advertisers.

We do not use advertising cookies, and we do not sell your data or share it with ad networks.

5. Data Retention

  • Account Data: Retained for as long as your account is active. You may request deletion at any time.
  • Query History: Your submitted queries and associated metadata (status, token usage) are retained to provide the Service and for our operational purposes.
  • Tables and Results: Retained until you delete them or your account is terminated.
  • Refresh Tokens: Automatically expire and are rotated every 7 days. Old tokens are invalidated upon rotation.

6. Data Security

We implement the following security measures to protect your data:

  • Passwords and refresh tokens are hashed using bcrypt before storage.
  • JWT access tokens have a short 15-minute lifespan to minimize exposure.
  • Refresh tokens are rotated on each use and stored as HTTP-only, SameSite=Strict cookies.
  • CORS policies restrict API access to authorized frontend origins.
  • Protected routes require valid authentication before granting access.

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request that we correct inaccurate or incomplete data.
  • Deletion: Request that we delete your personal data and account.
  • Data Portability: Request an export of your data in a machine-readable format.
  • Objection: Object to certain processing of your data.

To exercise any of these rights, please contact us at founders@hizura.com. We will respond to your request within 30 days.

8. Children's Privacy

The Service is not intended for users under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 18, we will take steps to delete that information promptly.

9. International Data Transfers

Your data may be processed and stored in countries other than your own, including the United States, where our third-party service providers operate. By using the Service, you consent to the transfer of your data to these jurisdictions, which may have different data protection laws than your country of residence.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a notice on the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

founders@hizura.com