Privacy Policy

Introduction

HiFriendbot ("we," "our," or "us"), operated by Name Brand Management, LLC, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use any of our services at hifriendbot.com, including our Ai companion service, Cognitive Memory (Memory as a Service), AgentWallet, the CAT browser extension, and Website Companion (an embeddable Ai widget for websites operated by our business customers) (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

Information We Collect

Information You Provide

We collect information you voluntarily provide when using our Service:

• Account Information: Email address, display name, and password when you create an account
• Conversation Data: Messages you send to and receive from your Ai companions or Cognitive Memory chat
• Memory Data: Information extracted from your conversations that your companion remembers (such as names, preferences, and life events you share)
• Payment Information: Billing details processed through our payment provider, Stripe (we do not store your full credit card number)
• Cognitive Memory Data: If you use Cognitive Memory (our Memory as a Service product), we collect your API keys (encrypted at rest), provider preferences, personality settings, and usage statistics. API keys you provide are protected with quantum-safe encryption before storage and are never stored in plaintext.
• AgentWallet Data: If you use AgentWallet, we collect wallet addresses, transaction history (chain, recipient, status, fees), and billing data. Private keys are generated server-side, protected with quantum-safe encryption at rest, and are never exposed or transmitted in plaintext.

Information Collected Automatically

When you access our Service, we automatically collect:

• Device information (browser type, operating system)
• IP address
• Usage data (pages visited, time spent, features used)
• Cookies and similar tracking technologies

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service across all products
• Enable your Ai companion to remember details about you and provide personalized responses
• Process transactions and manage your subscriptions and billing
• Send you service-related communications (task reminders, daily digests, billing notifications)
• Respond to your inquiries and provide customer support
• Monitor and analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues or security breaches
• Generate numerical representations of your memories to enable intelligent search and retrieval
• Sign and broadcast blockchain transactions on your behalf through AgentWallet
• Route your Cognitive Memory chat messages through your chosen Ai provider using your encrypted API key

Data Storage & Security

We take the security of your data seriously:

• All data is encrypted in transit using HTTPS (TLS 1.2+) — the same standard used by banks and financial institutions
• All memory content (conversations, extracted facts, and knowledge snippets) is protected with quantum-safe encryption at rest. Your data is encrypted before being written to the database and decrypted only when you request it through authenticated API calls
• Sensitive credentials (CogmemAi API keys, AgentWallet private keys) are protected with quantum-safe encryption at rest
• AgentWallet private keys are decrypted only during transaction signing and zeroed from memory immediately after
• We use industry-standard security measures to protect against unauthorized access
• Access to personal data is limited to employees who need it to perform their job functions
• We maintain a bug bounty program for responsible disclosure of security vulnerabilities

While we implement safeguards to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Data Retention

We retain your personal data for as long as necessary to provide you with our Service and as described below:

• Active Accounts: We retain your account information, conversation history, and memory data for as long as your account remains active.
• Cancelled Subscriptions: If you cancel your paid subscription, your account and data remain accessible on the free tier unless you request deletion.
• Account Deletion: If you request account deletion, we will delete your personal data within 30 days, except for data we are required to retain for legal, regulatory, or security purposes.
• Memory Data: You can delete individual memories at any time through your My Memories page. Deleted memories are removed immediately and permanently.
• Backup Retention: Deleted data may persist in encrypted backups for up to 90 days before being permanently purged.
• Cognitive Memory Data: Your encrypted API keys and personality settings are retained while your account is active. You can disconnect a provider and delete your API key at any time from your Cognitive Memory dashboard.
• AgentWallet Data: Wallet data and transaction history are retained while your account is active. Deleted wallets are soft-deleted (marked inactive) and their encrypted private keys are retained for audit purposes. Transaction records are retained indefinitely for billing and compliance purposes.

Information Sharing

We do not sell your personal information.

We may share your information only in the following circumstances:

• Service Providers: With third-party vendors who assist in providing our Service (such as hosting providers and payment processors), under strict confidentiality agreements
• Legal Requirements: If required by law or in response to valid legal requests from public authorities
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice provided to you
• With Your Consent: For any other purpose with your explicit consent

Important: We do not use your conversation data, memory data, or API keys to train Ai models. Your conversations remain private and are only used to provide you with the Service. Your AgentWallet private keys never leave our server and are never shared with any third party.

Third-Party Services

We use the following third-party service providers to operate our Service:

• Anthropic: Provides the Ai technology that powers our companions and Cognitive Memory. Your conversation messages are sent to Anthropic's API to generate responses. Anthropic does not use API data to train their models. See Anthropic's Privacy Policy.
• OpenAI: Provides Ai technology for our semantic memory search feature, and serves as a provider option for Cognitive Memory. Memory content is processed via OpenAI's API. OpenAI does not use API data to train their models. See OpenAI's Privacy Policy.
• Google: Serves as a provider option for Cognitive Memory (Gemini models). If you choose Google as your provider, your messages are sent to Google's Gemini API. See Google's Privacy Policy.
• Stripe: Processes payment transactions for subscriptions and AgentWallet billing. We do not store your full credit card number; Stripe handles all payment data securely. See Stripe's Privacy Policy.
• Blockchain Networks: AgentWallet broadcasts transactions to public blockchain networks (Ethereum, Base, Polygon, BSC, PulseChain, and others). Blockchain transactions are public and permanent. Wallet addresses and transaction data are visible to anyone on the respective blockchain.
• Web Hosting: Our Service is hosted on secure servers in the United States.

These providers are contractually obligated to protect your data and may only use it to provide services to us. Blockchain networks are decentralized and not subject to contractual obligations.

Cognitive Memory — Your API Keys

If you use Cognitive Memory with your own API key (BYOK), your key is used solely to route your chat requests through your chosen Ai provider. We encrypt your key at rest and decrypt it only during the request. We do not log, share, or use your API key for any purpose other than sending your messages to your chosen provider.

Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Export: Request a portable copy of your data
• Objection: Object to certain processing of your personal data

Self-Service Data Controls

We believe you should have direct control over your data. The following options are available to you at any time without needing to contact us:

• Delete Memories: Visit your My Memories page to view and instantly delete any memories your companion has about you. Deletions are immediate and permanent.
• Cancel Subscription: Manage or cancel your subscription from your My Account page at any time.

For other requests (full account deletion, data export, etc.), please contact us at [email protected].

California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

We do not sell your personal information. We have not sold personal information in the preceding 12 months and do not have plans to do so.

To exercise your California privacy rights, please contact us at [email protected]. We will verify your identity before processing your request.

Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users via email within 72 hours of discovering the breach
• Provide information about what data was affected
• Describe the steps we are taking to address the breach
• Offer guidance on steps you can take to protect yourself
• Report the breach to relevant authorities as required by law

CogmemAi Developer Memory Service

CogmemAi provides persistent cognitive memory for any Ai system — coding assistants, autonomous systems, defense platforms, and more — via an MCP (Model Context Protocol) server and REST API. This section describes how data is handled.

What We Collect

• Extracted Facts: Short, factual sentences extracted from your coding conversations (e.g., "Uses PostgreSQL for the user database," "Prefers tabs over spaces"). We store facts, never raw source code or file contents.
• Search Queries: Natural language queries you make when recalling memories (e.g., "What database does this project use?").
• Project Identifiers: Derived from your repository, used to scope memories to specific projects. We do not store file paths or directory structures.
• API Keys: Stored as irreversible cryptographic hashes. We never store your full API key after initial generation.
• Usage Metrics: Memory count, extraction count, recall count, and project count for billing and rate limiting.

What We Do NOT Collect

• Source code, file contents, or code snippets
• File paths or directory structures
• Environment variables, secrets, or credentials
• Full conversation transcripts (only extracted facts)
• Any data from your local filesystem

How Developer Data Is Processed

• Memory Extraction: Conversation excerpts are sent to our server where Ai processes them to extract factual statements. The original conversation text is not stored — only the extracted facts.
• Semantic Search: Extracted facts are converted to numerical representations that enable meaning-based search and are stored alongside your memories.
• Encryption: All data is transmitted over HTTPS. API keys are cryptographically hashed (irreversible). All memory content is encrypted at rest — your memories are encrypted before being written to the database and decrypted only when you request them through authenticated API calls.

Data Scoping

Memories have two scopes:

• Global: Preferences and identity facts that apply across all your projects.
• Project: Architecture decisions, tech stack details, and patterns specific to a single project. Project memories are identified by a project ID derived from your repository.

Your memories are never shared with or visible to other users.

Third-Party Processing

• Anthropic: Processes conversation excerpts for memory extraction. Subject to Anthropic's Privacy Policy.
• OpenAI: Processes extracted facts for semantic search. Subject to OpenAI's Privacy Policy. OpenAI does not use API data for training.
• Stripe: Processes subscription payments. Subject to Stripe's Privacy Policy.

Data Retention & Deletion

Your memories are retained as long as your account is active. You can delete individual memories at any time using the delete_memory MCP tool or the developer dashboard. You can also request complete deletion of all your developer data by contacting us at [email protected].

No Model Training

Your developer data is never used to train Ai models. Memories are used solely to provide you with persistent context across coding sessions.

CAT Browser Extension

CAT (CogmemAi Memory) is a Chrome browser extension that allows you to save and recall knowledge from any web page or email. This section describes how the CAT extension handles your data.

How CAT Works

CAT provides four actions, all initiated exclusively by you:

• Save: When you click the Save button, CAT reads the text content and URL of the current web page or email and sends them securely over HTTPS to CogmemAi servers (hifriendbot.com). Our Ai extracts only the key ideas — short, meaningful knowledge snippets — and stores them in your encrypted personal memory. The raw page content is not stored; only the distilled facts are retained. This includes emails (e.g., from Gmail or Outlook), articles, documentation, and any webpage you choose to save.
• Ask: When you click the Ask button, CAT sends your query to CogmemAi servers to perform a semantic search of your previously saved memories. No page content is stored during an Ask.
• Add: You can manually add notes, ideas, to-dos, contacts, or decisions. This text is sent to CogmemAi servers for storage in your personal memory.
• Remind: You can set reminders in plain language. CAT sends the reminder text to CogmemAi servers, which schedule an email and browser notification at the specified time.

What CAT Collects

• Page and email content: The text content of the current web page or email, only when you click Save. This includes email body text, sender, and subject when saving emails from services like Gmail or Outlook. Content is processed by Ai to extract knowledge snippets and then discarded — the raw text is not retained.
• Page title and URL: Used to provide context for your saved memories and to enable source attribution when recalling knowledge. URLs of pages you save are stored alongside extracted memories.
• Authentication token: An authentication token is stored locally in your browser (via Chrome's storage API or localStorage) to keep you signed in. This token does not contain your password and is cleared when you sign out.
• Notes and reminders: Text you manually enter through the Add and Remind features is sent to and stored on CogmemAi servers.

What CAT Does NOT Collect

• CAT does not read any page or email content unless you explicitly click a button. It never runs automatically or in the background.
• CAT does not track your browsing history, bookmarks, or browsing activity. Only the URLs of pages you explicitly choose to save are stored.
• CAT does not access cookies, passwords, form data, or other sensitive browser data.
• CAT does not inject advertisements or modify web pages in any way.
• CAT does not collect data from pages you do not explicitly choose to save.
• CAT does not scan or read your email inbox. It can only read the content of a single email that is currently open and visible when you click Save.

Browser Permissions

CAT requests the following Chrome permissions:

• activeTab: Grants CAT temporary access to read the current tab's content when you click the extension button.
• tabs: Allows CAT to display the current page's title and URL in the side panel and to detect page navigation.
• sidePanel: Allows CAT to display its interface in Chrome's side panel.
• storage: Stores your authentication token, theme preference, and consent status locally on your device.
• scripting: Allows CAT to inject a content script to read page text when you click Save.
• contextMenus: Provides a right-click menu option to quickly save content without opening the side panel.
• notifications: Displays browser notifications when your reminders are due.
• alarms: Schedules periodic checks for due reminders.
• Host permissions (all URLs): Required so that CAT can read page content from any website you choose to save, including web-based email clients like Gmail and Outlook. CAT only accesses a page when you explicitly click Save — no pages are read automatically or in the background.

Encryption & Security

• In transit: All data sent between the CAT extension and CogmemAi servers is encrypted using HTTPS (TLS 1.2+) — the same encryption standard used by banks and financial institutions.
• At rest: All saved knowledge snippets are protected with quantum-safe encryption on our servers. Your stored memories cannot be read by anyone, including HiFriendbot staff.
• On your device: Your authentication token is stored in Chrome's built-in storage, not in plaintext files.

Data Retention & Deletion

Knowledge snippets saved through CAT are retained in your CogmemAi memory as long as your account is active. You can delete individual memories at any time through the CogmemAi developer dashboard or by contacting us. Uninstalling the CAT extension removes all locally stored data (authentication token and preferences) from your device.

Third-Party Processing

Page and email content submitted through CAT's Save function is processed by Anthropic's Ai to extract knowledge snippets. This processing is subject to Anthropic's Privacy Policy. Anthropic does not use API data to train their models.

Chrome Web Store Compliance

CAT's use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Blockchain & Public Data

If you use AgentWallet, please be aware of the following regarding blockchain data:

• Public by Nature: Blockchain transactions are recorded on public, decentralized ledgers. Your wallet addresses and transaction details (amounts, recipients, timestamps) are permanently visible to anyone.
• Irreversible: Once a transaction is broadcast and confirmed, it cannot be deleted, modified, or reversed by us or anyone else.
• No Right to Deletion: We cannot delete blockchain data. While we can delete your account and wallet records from our servers, on-chain transaction history will persist indefinitely on the respective blockchain networks.
• Pseudonymous: Blockchain addresses are pseudonymous but not anonymous. Transaction patterns and on-chain analysis may be used by third parties to associate addresses with identities.

Website Companion

Website Companion is a B2B service: our customers ("Operators") embed our Ai chat widget on their own websites to answer questions from their visitors ("Visitors"). This section describes how data flows when Website Companion is involved, distinguishing between Operator data (what we collect from the customer who buys the product) and Visitor data (what flows through the widget on a customer's site).

Sub-Processor Relationship

For data generated by Visitors interacting with the widget, the Operator is the data controller and we act as a data processor (or sub-processor) on the Operator's behalf. Visitors should refer to the privacy policy of the website on which the widget is embedded for the controller's privacy practices. We process Visitor data solely to deliver the widget functionality the Operator has subscribed to.

Operator Data We Collect

• Account & Billing Information: Email, account name, subscription tier, billing data via Stripe.
• Allowed Origins: The website domain(s) the Operator authorizes for widget rendering.
• Source URLs & Customer Content: URLs the Operator submits for crawling, plus the text content we crawl from those URLs to build the widget's knowledge base.
• Configuration: Widget appearance, persona, system prompt, and similar settings.
• Usage Metrics: Message counts, top-up balances, crawl counts, and similar aggregates used for billing and quota enforcement.

Visitor Data Flowing Through the Widget

• Conversation Messages: Visitor messages and Ai-generated responses are processed by our servers and our Ai sub-processors to produce answers grounded in the Operator's Customer Content. Conversation transcripts may be retained for quality, abuse prevention, and Operator-facing analytics, subject to the Operator's instructions and applicable law.
• Technical Metadata: Origin domain, browser user-agent, IP address (for rate limiting and abuse prevention), and timestamps.
• No Cookies for Tracking: The widget does not set cross-site advertising cookies. Local storage may be used for short-term session continuity within a single browser tab.

Customer Content (Crawled Pages)

When an Operator submits URLs, we fetch and store text content from those pages to build the widget's knowledge base. Operators warrant that they have the right to ingest this content (see our Terms of Service). We do not use Customer Content to train Ai models, and we do not share it with other Operators.

Data Retention

Operator account, subscription, source URLs, and Customer Content are retained while the subscription is active. On cancellation, the widget is suspended and data is retained in a soft-suspended state for a reasonable period to allow reactivation, after which it is deleted on request or per our standard purge schedule. Visitor conversation transcripts are retained per the Operator's settings and our default retention period (90 days unless modified).

Sub-Processors for Website Companion

In addition to the third parties listed above, Website Companion uses the following sub-processors:

• Anthropic / OpenAI: Generate Ai responses to Visitor questions and may extract knowledge from crawled pages. Subject to their respective privacy policies. Neither uses API data for model training.
• Crawl Infrastructure: We crawl Operator-submitted URLs from servers hosted in the United States. We respect robots.txt on third-party domains.
• Stripe: Processes Operator subscription billing.
• PromoteKit (or successor): Tracks affiliate referrals for Operators participating in the affiliate program.

No Sale of Visitor Data

We do not sell Visitor data, and we do not enable Operators to use Visitor conversations for purposes other than operating the widget (e.g., we do not sync Visitor messages to an Operator's marketing CRM unless the Operator implements that integration themselves through documented hooks).

Data Processing Addendum (DPA)

A Data Processing Addendum is available on request to Operators who require one for GDPR, UK GDPR, or similar regulatory compliance. Contact [email protected].

LSAT Companion

The following describes how we collect, use, and protect data specific to LSAT Companion, our LSAT test-preparation service. This section supplements (and does not replace) the rest of this Privacy Policy.

LSAC Affiliation Disclaimer

"LSAT" is a registered trademark of the Law School Admission Council, Inc. ("LSAC"). LSAC is not affiliated with, has not endorsed, and has not sponsored this Service. We do not exchange, share, or sync any user data with LSAC, and we have no contractual or technical relationship with LSAC. Any references to LSAC in our materials are descriptive only.

What We Collect

When you use LSAT Companion, we collect and store, in addition to the general information described above:

• Drill performance data: every question you attempt, the answer you selected, whether it was correct, the time you spent, your confidence rating, and (for incorrect answers) the trap pattern your selected choice was tagged with.
• Lesson and curriculum progress: which lessons you started, completed, and your reading position within each.
• Aggregate metrics derived from the above: overall accuracy, accuracy by question type, accuracy by flaw category, predicted LSAT score (Pro tier only), mastered types, recurring trap patterns.
• Sage tutor exchanges: the messages you send to and receive from our LSAT-mode Sage Ai tutor, plus the page context (e.g., "drill" or "dashboard") in which each exchange occurred. These are stored in the wp_hfb_lsat_tutor_messages table and surfaced to you when you open the tutor panel.
• Score-guarantee claim data: if you submit a Score Guarantee claim, we store your declared baseline score, declared post-program score, the URLs of any score-report evidence you provide, and our eligibility determination.
• Subscription metadata: your current LSAT tier (Free, Standard, or Pro), Stripe subscription identifier, and renewal/cancellation status, stored in WordPress user meta and the user_profiles table.

How We Use This Data

• Power the adaptive drill-queue engine that selects which questions to serve you next, based on your weakest move types and recurring trap patterns.
• Compute your dashboard statistics, score prediction (Pro tier), and coaching signals.
• Provide Sage tutor responses grounded in your live performance data.
• Verify Score Guarantee eligibility (curriculum completion percentage, drill attempt count) when you file a claim.
• Improve the product in aggregate (e.g., calibrating which trap patterns are over- or under-represented in our drill bank). We do not use individual identifiable data for marketing or third-party advertising.

Sub-Processors for LSAT Companion

• Anthropic: generates Sage Ai tutor responses via the Claude API. Sage exchanges are sent to Anthropic to produce replies; Anthropic does not use API data for model training. Subject to Anthropic's privacy policy.
• Stripe: processes LSAT Companion subscription billing.
• CogmemAi: our internal memory infrastructure logs anonymized event metadata (e.g., "user X attempted question Y, fell for trap Z") to power per-user adaptive coaching across sessions. Drill content is not exfiltrated; only event metadata.

Data Retention (LSAT Companion)

Your drill attempts, lesson progress, aggregates, coaching signals, and Sage tutor messages are retained for the lifetime of your account. If you delete your account, this data is deleted within thirty (30) days, except for: (a) Score Guarantee claim records, which we retain for at least four (4) years for legal/accounting purposes; and (b) anonymized aggregate statistics that no longer identify you.

Your Rights (LSAT Companion)

In addition to the general rights described above, you may at any time: (a) export your drill history and tutor messages by emailing [email protected]; (b) clear your Sage tutor history from the tutor panel; (c) request deletion of all LSAT Companion data while keeping your HiFriendbot account active.

HiHiredBot Job-Search Email

HiHiredBot is our Ai job-search assistant. It helps you apply to jobs, follow up with recruiters, and reply to the responses you receive. So that this outreach genuinely comes from you and reaches recruiters reliably, HiHiredBot sends email through your own email account, which you connect using Google or Microsoft. This section explains exactly what access we request and how that data is handled.

Connecting Your Email Account

You connect your mailbox through the official, secure sign-in screen provided by Google or Microsoft. We never see or store your email password. We receive only a revocable access token, which we store encrypted at rest and which you can revoke at any time from your Google or Microsoft account security settings or from within HiHiredBot.

What Access We Request (Send Only)

HiHiredBot requests permission only to send email on your behalf:

• Google (Gmail): the gmail.send permission. This permission allows sending only. It does not grant the ability to read, search, delete, or otherwise access the messages already in your inbox.
• Microsoft (Outlook): the equivalent send-only permission (Mail.Send). It likewise does not grant the ability to read your existing mail.

We deliberately do not request read access to your mailbox, which means HiHiredBot cannot see your personal email.

How We Use This Access

• Sending messages you approve: HiHiredBot sends job applications, follow-up notes, and replies that you review and approve. You stay in control of every message that goes out under your name.
• Tracking recruiter replies without reading your inbox: every message we send on your behalf carries a dedicated reply address at hihiredbot.com. When a recruiter responds, that reply is routed to HiHiredBot through this address so we can attach it to the correct application and help you draft an answer. Because replies reach us through this dedicated address, we neither need nor request permission to read your mailbox.

Data Handling and Limited Use

• We use the send permission solely to provide the HiHiredBot features described above.
• We do not sell data obtained through this access, we do not use it for advertising, and we do not use it to train Ai models.
• Access tokens are encrypted at rest and are used only to send the messages you approve.
• You can disconnect your email account at any time, which immediately stops all sending and revokes our access.

HiHiredBot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

HiHiredBot's use of information received through Microsoft Graph adheres to the applicable Microsoft API terms and is limited to the send-on-your-behalf functionality described above.

Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete such information.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. For significant changes, we will provide additional notice via email.

We encourage you to review this Privacy Policy periodically for any changes.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

• Email: [email protected]
• General inquiries: [email protected]