Effective July 1, 2026 · Last updated October 29, 2026
Hardtack is the customer-facing brand of Hardtack AI Inc. (“Hardtack,” “we,” “us”), a company based in West Jordan, Utah, USA. Hardtack is an AI-native operations platform for field-service businesses, beginning with waste haulers and portable sanitation operators. This policy explains what personal information we handle, why, how long we keep it, and the choices you have. It covers our website, the operator dashboard, the customer and municipal portals, the driver app, and the AI voice agent. It also serves as our California notice at collection.
We handle two different kinds of data in two different roles:
If you are an operator’s customer, direct privacy requests to that operator first; we will support their response.
We collect the following categories of personal information: some directly from you (when you request a demo, sign in, or use the platform), some from the operator you work with, and some automatically from your device as you use the service:
We use personal information to:
Where recording applies, the voice agent discloses that the call is being recorded at the start of the call, before any substantive conversation. Operators configure the recording notice and remain responsible for any additional consent their jurisdiction requires. Recordings and transcripts are kept for a short operational period (currently up to 30 days) and then deleted automatically. We do not use call recordings to create voiceprints or to identify callers by their voice.
The platform uses AI models from third-party providers to power the voice agent and other features. Some actions run automatically within the settings the operator chooses: answering calls, booking jobs and quoting the operator’s configured prices. Other actions are held for the operator’s approval.
We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under California law. Because we do not sell or share, we do not offer a “Do Not Sell or Share My Personal Information” link. We disclose information only to service providers (sub-processors) who help us run the service (hosting and databases, payment processing, telephony and email, AI model providers, mapping, and monitoring) each bound to handle it only on our instructions. Our current list of sub-processors is published at app.hardtack.ai/sub-processors. We may also disclose information to comply with law or to protect rights and safety.
Hardtack and the operators who use our platform send service-related text messages. Mobile information is not shared with third parties or affiliates for marketing or promotional purposes. How consent is collected, and how to opt out, is described on our SMS program page.
We keep personal information for as long as needed to provide the service to you, and afterwards only for as long as legal, tax, accounting or security obligations require. The criteria we use are whether the account is active; whether a law requires the record to be kept (financial records and waste-disposal manifests, for example, have statutory retention periods); and whether the record is needed to secure the service or resolve a dispute. Operational data with no such requirement (call recordings and transcripts, driver location) is deleted automatically after a short period.
Records of how operator accounts access and operate the platform are kept for up to two years to secure the service and to establish, exercise, or defend legal claims, and longer only where they are subject to a legal hold. They are kept even after a trial account is deleted.
Data is permanently erased when you complete an account-deletion or erasure request or its retention period ends. Not everything goes. Records the law requires us to keep are retained for their statutory period, and deleted data may remain in encrypted backups for a limited time before those copies age out.
Depending on where you live, you may have the right to know what personal information we hold, to access or export it, to correct or delete it, to opt out of sale or sharing (which we do not do), and to limit the use of sensitive personal information. We honor these California (CCPA/CPRA) rights.
To exercise a right, write to support@hardtack.ai. We will verify your request and respond within 45 days (extendable by another 45 where the law allows); you may appeal a denial, and we will not discriminate against you for exercising a right. If you are an operator’s customer, contact that operator (the controller) first; we will support their response.
To ask us to delete an account and the data held with it, see Delete your account, which explains what to send and what happens next.
Hardtack is a US company serving US-based operators on US-hosted infrastructure; our services are not directed to individuals in the EEA or UK. We use administrative, technical and physical safeguards appropriate to the data we hold. If a security incident affects your data, we will notify you as required by law and by our agreement with you; where we act as a processor, we notify the operator, who decides how to inform their own customers. More on our Security page.
We use the cookies needed to run the site and keep you signed in, a bot-defense check on our forms, and (in the operator application) a first-party analytics cookie. We use a third-party analytics service in two places. In the operator application, it shows us how the application is used: the pages and features used by signed-in operator users, identified by an internal account identifier rather than by name. On our website, it counts visits and shows us which pages are viewed and whether our demo and contact forms are opened and submitted, including the site that referred you and any campaign tags in the link you followed; it never records what you type into a form, and we do not link website visits to your name or an account. We do not use advertising or cross-site tracking cookies, and we do not sell or share personal information for cross-context behavioral advertising. Our analytics do not load when your browser sends a “Do Not Track” signal; we do not otherwise respond to Do Not Track signals, because no common standard for them exists. In the operator application we may also record how the interface is operated (such as the timing of pointer movements and clicks, never what you type) to tell people from automated agents and to protect the service.
We may combine de-identified operational data from the businesses that use Hardtack into aggregate industry figures (never including prices, margins, wages, customer-specific volumes, or anything that identifies a business, a customer or a job) and make those figures available to third parties. We will not attempt to re-identify de-identified data, and we require anyone we share it with to commit to the same. You can opt out at any time in your account settings.
Hardtack is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16, or from children under 13 as defined by COPPA.
We will post any updates here with a new “last updated” date and flag material changes. Questions about privacy or this policy go to support@hardtack.ai, or by mail to Hardtack AI Inc., West Jordan, Utah, USA. Security concerns go to security@hardtack.ai.