Who operates Hashmedo
Hashmedo is operated by HASHMEDO INC. This notice covers our hosted application, website and support services. Contact [email protected] with privacy questions or requests. Organizations operating their own installation control that installation separately.
Information we use and why
- Account and access information: your email, login identity, organization memberships, roles and invitations let us authenticate you and provide the access your organization authorizes.
- Organization content: systems, models, components, configuration, readiness evidence and other information you submit let us provide the platform and preserve your organization’s operational record.
- Beta launch notifications: if you submit your email on the website, we store it with the signup time, website origin, and a record of your notification request so we can email you when the beta starts. This does not create a Hashmedo account or subscribe you to a general newsletter. You can ask support to remove your address at any time.
- Support information: messages, replies and any diagnostics you choose to attach help us investigate your request.
- Service records: authentication, security, operational and audit events help protect the service, investigate failures and record consequential changes. Historical audit events can contain an email address even after an account is deleted.
Other authorized members can access organization content according to their permissions. Organization administrators control membership and access. Authorized Hashmedo operators administer the service and provide support.
Services that process information
We use DigitalOcean for hosting, AWS S3 for encrypted recovery backups, Postmark for transactional and operational email, and an email service provider to handle support messages. Better Stack checks public service availability. Website analytics run on a self-hosted Umami installation.
These services receive information needed for their respective functions; for example, email delivery requires a recipient address and message content. Hosting and backup providers process stored service data. Processing can occur outside your country. This policy does not promise that information stays in one country.
Website analytics and sign-in
The production website records page visits, referring pages, visit times, browser and device characteristics, language, and approximate location such as country, region and city. The analytics service processes connection information, including IP addresses, to derive location and distinguish visits. Our integration excludes URL search parameters and fragments, honors the browser’s Do Not Track setting and restricts tracking to the production website domains. It is separate from application sign-in and organization records. We do not include the production tracker in the staging website build.
The application uses browser session information to keep you signed in and protect authentication flows. Disabling necessary browser storage or cookies can prevent sign-in from working.
Optional integrations
Recording a model or component in Hashmedo is not itself permission to send its content to an external AI service. Review the destination and data involved before enabling an integration or submitting information to an external provider. Your organization’s choices and the relevant provider’s terms govern those external services. Do not include passwords or unnecessary personal information in ordinary text fields or support messages.
Payments
Starter and free Pro beta require no payment card or subscription. Production paid plans are currently unavailable. If you later choose a paid plan, checkout will identify the payment provider and applicable terms before you purchase. For purchases processed by Paddle, Paddle handles payment information under its privacy notice. Hashmedo uses subscription and transaction references to manage plan access and support.
Retention and your choices
See Data Deletion and Retention for active records, retained audit evidence, support diagnostics and protected backups. Deleting a personal account and deleting an organization’s data are different operations.
Contact us to request access, correction or deletion, or to raise a privacy concern. We verify your identity and authority before releasing information or changing organization records. Where you act through an employer or another organization, we may need to coordinate the request with its administrator. We will explain any information we must retain or any limits on the requested action.
Changes
This notice is effective October 8, 2026, version 2026-10-08.1. Material changes to data handling will be communicated before the changed policy applies.