Effective July 1, 2026 · Last updated September 2026
Hardtack is the customer-facing brand of Hardtack AI Inc. (“Hardtack,” “we,” “us”), a company based in West Jordan, Utah, USA. Hardtack is an AI-native operations platform for waste haulers and portable sanitation operators. This policy explains what personal information we handle, why, how long we keep it, and the choices you have. It covers our website, the operator dashboard, the customer and municipal portals, the driver app, and the AI voice agent. It also serves as our California notice at collection.
We handle two different kinds of data in two different roles:
If you are an operator’s customer, direct privacy requests to that operator first; we will support their response.
We collect the following categories of personal information — some directly from you (when you request a demo, sign in, or use the platform), some from the operator you work with, and some automatically from your device as you use the service:
We use personal information to:
Where recording applies, the voice agent discloses that the call is being recorded at the start of the call, before any substantive conversation. Operators configure the recording notice and remain responsible for any additional consent their jurisdiction requires. Recordings and transcripts are kept for a short operational period and then deleted automatically.
The platform uses AI models from third-party providers to power the voice agent and other features. The AI proposes actions and surfaces information; a human operator reviews and approves anything irreversible or high-value.
We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under California law. Because we do not sell or share, we do not offer a “Do Not Sell or Share My Personal Information” link. We disclose information only to service providers (sub-processors) who help us run the service — hosting and databases, payment processing, telephony and email, AI model providers, mapping, and monitoring — each bound to handle it only on our instructions. Our current list of sub-processors is published at app.hardtack.ai/sub-processors. We may also disclose information to comply with law or to protect rights and safety.
Hardtack and the operators who use our platform send service-related text messages. Mobile information is not shared with third parties or affiliates for marketing or promotional purposes. How consent is collected, and how to opt out, is described on our SMS program page.
We keep personal information for as long as needed to provide the service to you, and afterwards only for as long as legal, tax, accounting or security obligations require. The criteria we use are whether the account is active; whether a law requires the record to be kept (financial records and waste-disposal manifests, for example, have statutory retention periods); and whether the record is needed to secure the service or resolve a dispute. Operational data with no such requirement — call recordings and transcripts, driver location — is deleted automatically after a short period.
Data is permanently erased when you complete an account-deletion or erasure request or its retention period ends. Not everything goes. Records the law requires us to keep are retained for their statutory period, and deleted data may remain in encrypted backups for a limited time before those copies age out.
Depending on where you live, you may have the right to know what personal information we hold, to access or export it, to correct or delete it, to opt out of sale or sharing (which we do not do), and to limit the use of sensitive personal information. We honor these California (CCPA/CPRA) rights.
To exercise a right, write to support@hardtack.ai. We will verify your request and respond within 45 days (extendable by another 45 where the law allows); you may appeal a denial, and we will not discriminate against you for exercising a right. If you are an operator’s customer, contact that operator (the controller) first; we will support their response.
Hardtack is a US company serving US-based operators on US-hosted infrastructure; our services are not directed to individuals in the EEA or UK. We use administrative, technical and physical safeguards appropriate to the data we hold. If a security incident affects your data, we will notify you as required by law and by our agreement with you; where we act as a processor, we notify the operator, who decides how to inform their own customers. More on our Security page.
We use the cookies needed to run the site and keep you signed in, a bot-defense check on our forms, and — in the operator application — a first-party analytics cookie. We use a third-party analytics service to understand how the operator application is used: the pages and features used by signed-in operator users, identified by an internal account identifier rather than by name. We do not use advertising or cross-site tracking cookies, and we do not sell or share personal information for cross-context behavioral advertising. We do not respond to browser “Do Not Track” signals, because no common standard for them exists.
We may combine de-identified operational data from the businesses that use Hardtack into aggregate industry figures — never including prices or anything that identifies a customer or a job — and make those figures available to third parties. You can opt out at any time in your account settings.
Hardtack is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16, or from children under 13 as defined by COPPA.
We will post any updates here with a new “last updated” date and flag material changes. Questions about privacy or this policy go to support@hardtack.ai, or by mail to Hardtack AI Inc., West Jordan, Utah, USA. Security concerns go to security@hardtack.ai.