Hartley Privacy Policy

This is the Privacy Policy for the Hartley application. It explains who we are, how we collect, use and store, your personal data and why we are allowed to do so by law, as well as who has access to your personal data. Importantly, it explains how we protect your personal data and what your rights are. 

1. Who This Privacy Policy Applies To

1.1. This Privacy Policy applies to all users of the Hartley application within the United Kingdom.

2. Who We Are

2.1. We are Hartley Technology Limited incorporated in and subject to the laws of England and Wales, with registration number 16471418. Our registered address is at Davidson House, The Forbury, Reading, Berkshire, RG1 3EU.

Email: info@hellohartley.co.uk

2.2. We are the “controller” of the personal data you provide to us. We take your privacy seriously and use your personal data as further explained in this Privacy Policy. We are committed to:

  • Keeping your personal data accessible only to your individual account;

  • Maintaining secure household boundaries within the Hartley application; and

  • Never selling your data to third parties

2.3. Your uploaded information is only used to improve your personal experience within the application and is not shared outside your household context other than with your consent or as necessary for the performance of our contract and/or to comply with our legal obligations.

3. What Information We Collect and Use and Why

3.1. Personal data is any information which identifies you personally whether directly (for example, your name) or indirectly (for example, information about your use of our Hartley application).

3.2. When you use the Hartley application, we may collect the following information: 

  • Name and contact details

  • Address(es) 

  • Household and account information: property type, ownership status, car registration and related metadata 

  • Uploaded content: any documents related to your household that you choose to upload to the Hartley application such as insurance policies, warranties, utility bills, service receipts, etc. Usage data: app usage patterns, feature engagement, and interaction analytics 

  • Chat data: questions, commands, and responses exchanged with Hartley (the assistant)

3.3. We collect this information in the following ways: 

  • Information you enter directly during account creation or onboarding 

  • Responses you provide in in-application prompts or forms 

  • Documents you upload 

  • Data generated automatically through your use of the application (e.g. creating tasks, browsing features) 

  • Conversations you initiate in the chat interface with Hartley 

  • Public or open APIs  

3.4. We use this information exclusively within your account to:

  • Support your use of the Hartley application

  • Enhance the accuracy and usefulness of features (such as document-based reminders, task suggestions, task tracking, smart document insights and AI-powered answers)

  • Send you service communications, including in relation to changes to our contract terms (such as changes to this Privacy Policy)   

  • Send marketing communications – Hartley does not currently send marketing communications. If we introduce marketing emails or messages in the future, we will ensure: 

    • You can opt out at any time 

    • All emails will include an unsubscribe link 

    • You will retain full control over notification settings within the application

  • Provide and improve user support (for example, where you have questions about our service)

  • Comply with our legal obligations, including (to the extent required) to investigate, detect and/or prevent fraud 

  • Conduct internal training so that our staff have the knowledge and expertise they need to ensure we provide you with the best possible user experience. 

  • Conduct market research and analytics to better understand our user base. We may also invite certain users to be involved in market research. If you accept our invitation, we will use your feedback to improve our products and services

  • Maintain our records and improve data accuracy

4. Lawful Basis for Processing

4.1 Our lawful bases for collecting or using personal information to provide the service to you are: 

  • Consent: You provide consent when signing up and using core features of the Hartley application as we then connect you with the services of choice. 

  • Contract: We have to collect or use the information so we can enter into or carry out a contract with you. 

  • Legitimate interests: We are collecting or using your information because it is necessary and benefits you, our organisation or someone else, without causing an undue risk or harm to anyone.

5. How We Share and Store Your Data

5.1. We do not sell or share your data with third parties for commercial purposes without your consent. However, we may share limited data to our third-parties including our suppliers, services providers and other companies in our group, who perform certain business services for us and act as “sub-processors” of your personal data on our behalf. All third-party processors operate under strict Data Processing Agreements (DPAs) and are required to meet high standards of security and compliance. 

5.2. Our third-parties are: 

  • Yell Limited: This data processor does the following activities for us: Where you choose to connect with a service provider you have searched for via the Hartley application, we may share your contact details (e.g. email, phone number, WhatsApp etc.) with that service provider for that specific purpose.  

  • Amazon Web Services (AWS): Hartley stores your data using secure, cloud-based infrastructure provided by AWS. Our primary hosting environment is located outside of the UK (Ireland region). In specific cases (such as when processing AI queries) we may use AWS AI services based in the United States.

  • LlamaIndex Inc: An AI processing APIs to power intelligent features within the Hartley application.

  • Google Gemini (Google LLC): We use Google’s Gemini AI models to power AI-driven features in the Hartley application, such as understanding queries and analysing uploaded content. Data is processed solely to provide these features and in line with Google’s security and data processing standards.

  • Langfuse (Langfuse GmbH): Langfuse is used to monitor and improve the performance and reliability of our AI features. It processes limited technical data related to AI prompts and responses and does not use this data for its own purposes.

5.3. As this processing means the personal data may be transferred outside of the UK, we and our ‘processors’ ensure that the data is treated securely and is protected against unauthorised access, loss or destruction, unlawful processing and any processing which is inconsistent with the purposes set out in this Policy.

5.4. We also ensure any transfer outside of the UK complies with the UK GDPR with appropriate safeguards in place (including addendum to the EU Standard Contractual Clauses (“SCCs”), the UK-US Data Bridge adequacy decision, and/or the International Data Transfer Agreement (IDTA)).

5.5. In addition, we may disclose your personal data if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to protect the rights, property or safety of our business, our customers or others. This includes, in specific cases, exchanging information with other organisations for the purposes of fraud protection; and to successors in title or replacement operators of all or part of our business.

6. Data Retention

6.1. We retain your personal data only as long as is necessary for the purpose(s) for which it was provided. What this means in practice will vary between different types of data. When determining the relevant retention periods, we take into account factors including:

  • Legal obligation(s) under applicable law to retain data for a certain period of time;

  • Statute of limitations under applicable law;

  • Potential or actual disputes; and

  • Guidelines issued by relevant data protection authorities

6.2. Otherwise, in line with our commitment to privacy and user control, we securely erase your personal data from our systems when it is no longer needed. This includes if you choose to delete your account: 

  • All personal data, documents, tasks, and household information are permanently deleted 

  • We do not retain backups or archived copies after deletion

7. Marketing communications, analytics and advertising measurement

7.1. We may use your contact details (such as your email address) to send you information about the Hartley application, including product updates, new features, service messages, and, where permitted by law, relevant offers or promotions related to household services (marketing communications).

7.2. We will only send marketing communications where we have a lawful basis to do so. This may include your consent or, where applicable, contractual necessity or our legitimate interests in informing users about improvements to the Hartley application. You can opt out of marketing communications at any time by using the unsubscribe link in our messages or by adjusting your preferences within the Hartley application.

7.3. We collect limited usage and event data when you use the Hartley application or our website to understand how the Hartley application is used and to improve our products and services. This information may include usage metrics, technical logs and marketing events. We use this data to:

  • Analyse how users interact with Hartley

  • Improve functionality, usability, and performance

  • Measure the effectiveness of our marketing campaigns

  • Understand which channels, features, or messages are most relevant to users

7.4. We use analytics and measurement technologies such as pixels, SDKs, and similar tools within the Hartley application and on our website. These technologies serve two purposes:

  • Service Improvement & Performance (Statistical Purposes): We collect limited, pseudonymised event data to understand how the Hartley application is performing and to diagnose technical issues. We process this data for statistical purposes to improve our services. You can opt-out of this at any time in your Privacy Settings.

  • Marketing Attribution & Ad Measurement. With your consent, we use technologies to evaluate the performance of our marketing campaigns.
    This involves:

    • Attribution: Understanding which advertisement led you to download the Hartley application

    • Ad Relevance: Ensuring our advertising is shown to people likely to be interested in the Hartley application, and avoiding showing you ads for features you already use

    • Predictive Insights: We may use limited usage data in our AI and Machine Learning models to predict which service updates are most relevant to you

      We may share limited device identifiers (such as IDFA or AAID) and event data with:

  • Attribution & Analytics: Appsflyer, PostHog, Firebase

  • Advertising Platforms: Meta (Facebook), Google, Apple

7.5. Data Safeguards:

  • No Content Sharing: We never share the contents of your uploaded documents, personal notes, or sensitive household data with advertising or analytics platforms

  • Data Minimisation: We use IP-obfuscation and ensure that identifiers are hashed (transformed into unique codes) before transmission

  • Right to Withdraw: You can withdraw your consent for marketing tracking at any time through the app setting.

8. Your Data Protection Rights

8.1. We believe your data should remain under your control. As a Hartley user, you have the following rights (which may be affected by the lawful basis we rely on to process the data): 

  • Right of Access: You have the right to access and request a copy of the personal data we hold about you. This is so you are aware and can check that we are using your personal data in accordance with data protection law.   

  • Right to Rectification: You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.

  • Right to Erasure: You may request that your account and all associated data be permanently deleted. Once your account is deleted, all data (including all documents and tasks) will be erased and cannot be recovered.

  • Right to the Restriction of Processing: You have the right to ask us to limit how we can use your personal information.

  • Right to Object to Processing: You have the right to object to the processing of your personal data. 

  • Right to Data Portability: When we use consent as our lawful basis for processing, you have the right to withdraw your consent at any time.

8.2. You can access, update and/or delete your personal information at any time via the Profile section of the application, including your name, postcode, household details and uploaded documents. If you cannot fully exercise your data protection rights via the Profile section, please email us at info@hellohartley.co.uk. We will respond to your request without undue delay and in any event within one calendar month.

8.3. Data Safeguards:

  • No Content Sharing: We never share the contents of your uploaded documents, personal notes, or sensitive household data with advertising or analytics platforms

  • Data Minimisation: We use IP-obfuscation and ensure that identifiers are hashed (transformed into unique codes) before transmission

  • Right to Withdraw: You can withdraw your consent for marketing tracking at any time through the app setting

8.4. Where required by law, we will ask for your consent before using certain analytics or advertising technologies. You can manage your preferences at any time through: 

  • Your device settings (for example, limiting ad tracking on iOS or Android)

  • Cookie or consent settings on our website

  • In-app privacy and marketing preference controls (where available)

9. Security

9.1. Hartley takes your data security seriously. We use a combination of technical and organisational measures to protect your information, including: 

  • App-level security: Access to your Hartley account is protected by a personal passcode or biometric login (e.g. Face ID) 

  • Encryption: All data is encrypted in transit and at rest 

  • Access control: Internal access to your data is restricted strictly to personnel who need it for operational purposes 

  • Application monitoring: We actively monitor system health and security to detect and respond to threats quickly

9.2. We are committed to maintaining strong safeguards and improving them continuously. Privacy and data security are central to our product, and we treat all data-related requests with care, diligence, and respect.

10. Changes to this Privacy Policy

10.1. This Privacy Policy may be updated from time to time so you may wish to check it each time you provide personal data to us. We won’t alert you to minor changes, but if there are any major changes we will let you know and where appropriate ask for your consent.

11. How to Complain

11.1. If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice. If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. The ICO’s address:  

Last updated: 28th January 2026