Hammersmith Privacy Notice
Version: 2026-09-19 · Effective date: 2026-09-19
This Privacy Notice explains how Hammersmith Enterprises, LLC, a Georgia limited liability company ("Hammersmith," "we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with ai-Manager, Hammertime Cloud, Hammertime Work, Hammertime GTM, Hammertime Meetings, related APIs and partner workspaces, and our websites and support channels (collectively, the "Services").
1. Scope and our role
This Notice applies when we determine the purposes and means of processing personal information, such as for account registration, billing, security, product analytics, communications, and website operation.
For Customer Content processed on behalf of a business customer, the customer generally determines the purposes of processing and Hammersmith acts as a service provider or processor. The customer's instructions, agreement, and Data Processing Addendum control that processing. Individuals should first direct requests about Customer Content to the customer that provided or controls it.
This Notice does not govern third-party services, websites, or integrations that have their own practices.
2. Information we collect
Account and identity information: name, business email, username, team and company affiliation, role, authentication and verification status, account identifiers, and administrator or partner relationships.
Customer Content: prompts, instructions, documents, workspaces, projects, deals, contacts, meeting records, files, agent configurations, outputs, feedback, and other content that users or connected systems submit. Customer Content may contain personal information chosen by Customer.
Commercial information: subscription, product, seat, trial, credit, usage, invoice, tax, billing-contact, payment-status, refund, dispute, and entitlement records. Payment-card details are collected and processed by our payment provider and are not stored in our application database.
Legal acceptance records: the documents and versions you accepted, the time of acceptance, the address and browser that submitted it, and the source of the submission. We keep these records as evidence of agreement and do not alter them.
Integration information: identifiers, configuration, scopes, connection status, and data retrieved from services that Customer authorizes, such as cloud platforms, calendars, email, CRM, storage, collaboration, model, or partner systems. Users should not place third-party passwords or raw long-lived secrets into ordinary prompts.
Meeting information: where Customer enables Hammertime Meetings, call audio, transcripts, summaries, participant details, and related metadata, including from connected sources such as Krisp and Microsoft Graph. Customer is responsible for notice and consent, as described in the Terms of Service.
Device, usage, and security information: IP address, browser and device information, pages and features used, timestamps, referral and session information, diagnostics, API and event metadata, authentication and authorization events, error logs, audit trails, and abuse or security signals.
Communications and support: messages, support requests, product feedback, survey responses, call or meeting details, and records of consent or marketing preferences.
3. Sources of information
We receive information directly from users and account administrators; from customer-configured integrations and external partners; automatically from browsers, devices, APIs, and service activity; from payment, authentication, infrastructure, communications, and security providers; and from lawful public or commercial sources used for customer-requested research.
4. How we use information
We use personal information to provide and administer accounts and Services; authenticate users; process subscriptions and entitlements; execute customer instructions and managed-agent tasks; enable approved partner workspaces; deliver support; communicate service, security, billing, and product information; personalize authorized settings; maintain reliability; meter usage; prevent fraud and abuse; investigate incidents; enforce agreements; comply with law; establish or defend claims; and improve the Services.
We send product and go-to-market marketing email only to people who have asked for it. You can withdraw that request at any time using the link in the message or by contacting us, and withdrawing it does not affect service, security, or billing messages.
We may create aggregated or de-identified information that is not reasonably linkable to a person and use it for analytics, security, capacity planning, and product improvement. We will not attempt to re-identify properly de-identified information except to test whether de-identification remains effective or as permitted by law.
5. AI processing and model providers
When a user invokes an AI feature, relevant prompts, Customer Content, instructions, configuration, and context may be transmitted to model and tool providers needed to perform the request. Outputs and operational metadata may be returned to and stored by the Services, subject to Customer settings, the agreement, and retention controls.
We do not use Customer Content to train a general-purpose model for other customers without the customer's separate affirmative authorization.
AI outputs can contain personal information inferred from inputs or sources. Customers are responsible for lawful inputs, human review, correction, appropriate notices, and avoiding solely automated high-impact decisions unless legally sufficient safeguards are in place.
6. Legal bases for EEA and UK processing
Where the GDPR or UK GDPR applies and we act as controller, we process personal information as needed to perform a contract; based on legitimate interests in providing, securing, supporting, and improving business Services; to comply with legal obligations; to protect vital interests in emergencies; or with consent where required. Individuals may object to processing based on legitimate interests, and may withdraw consent without affecting earlier lawful processing.
7. How we disclose information
Service providers and subprocessors: cloud hosting, databases, model and tool providers, payment processing, authentication, email and communications, logging, analytics, security, customer support, and professional advisers, under contracts appropriate to their roles. Our current subprocessors are listed in Section 8.
Customer-directed recipients: account administrators, team members, authorized external partners, integrations, and third parties to whom Customer directs us to send data or actions.
Legal, safety, and rights: authorities or other parties when reasonably necessary to comply with law or valid process, protect rights and safety, investigate fraud or security issues, enforce agreements, or establish and defend claims.
Business transactions: prospective or completed financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and lawful notice requirements.
We do not sell personal information for money and do not share personal information for cross-context behavioral advertising. If our practices change, we will provide required notice and choice before the change applies.
8. Subprocessors
We use the following subprocessors to provide the Services:
- Google Cloud, including Cloud SQL and Cloud Storage — hosting, database, and file storage
- Mailgun — transactional and notification email
- Stripe — payment processing, billing, and tax calculation
- Google reCAPTCHA Enterprise — abuse prevention on public forms
- Google Analytics — marketing website measurement only, not the authenticated Services
- Microsoft Graph — where Customer connects Microsoft mail, calendar, or Teams
- Krisp — where Customer enables it for meeting capture
- ai-Manager, together with the model providers it routes requests to — agent execution and AI features
We will give notice of a new subprocessor as required by the Data Processing Addendum.
9. Cookies and similar technologies
We use cookies and similar technologies for authentication, security, session continuity, preferences, service operation, and limited analytics. We do not use the authenticated Services to serve third-party behavioral advertising. Browser controls may block some technologies, but blocking necessary cookies can prevent authentication or core functionality.
10. Data retention
We retain personal information only as long as reasonably necessary for the purposes described in this Notice, including to provide the Services, honor Customer settings and contractual retention periods, maintain security and audit records, comply with legal and accounting obligations, resolve disputes, and enforce agreements. Retention varies by data type, sensitivity, account status, product configuration, backup cycle, and legal requirements.
Trial data follows the schedule in the Terms of Service: read-only for fourteen days after a trial ends, then deleted ninety days after the trial ends unless the organization converts. Legal acceptance records are retained for the life of the account relationship and afterwards as evidence of agreement.
When retention is no longer necessary, we delete, anonymize, or securely isolate information, subject to backup rotation and legal holds.
11. Security
We use administrative, technical, and organizational safeguards designed to protect personal information, including identity and access controls, environment separation, encryption in transit, managed secret storage, logging and monitoring, least-privilege service identities, backup and recovery controls, and secure software-development practices. No method of transmission or storage is completely secure. Customers must protect their accounts, endpoints, credentials, integrations, and authorized-user lists and promptly report suspected compromise.
12. International transfers
We and our providers may process information in the United States and other countries where we or they operate. Where required, we will use recognized transfer mechanisms and supplementary safeguards, such as standard contractual clauses, and will describe applicable mechanisms in the Data Processing Addendum. Laws in a destination country may differ from those where information was collected.
13. Privacy rights and choices
Depending on location and applicable law, individuals may have rights to know or access personal information, correct inaccurate information, delete information, obtain a portable copy, restrict or object to processing, withdraw consent, opt out of certain profiling or targeted advertising, limit use of sensitive personal information, and appeal a denied request. Individuals may also complain to an applicable regulator.
Hammersmith does not sell personal information or share it for cross-context behavioral advertising. We will honor legally required browser-based opt-out signals for activities to which they apply.
To submit a request, email hammer@ai-manager.io with the subject "Privacy Request." We may verify identity and authority, ask for information reasonably necessary to locate records, and deny or limit a request where permitted by law. Authorized agents must provide proof of authority. We will not discriminate against anyone for exercising a privacy right. Requests about data controlled by a business customer may be referred to that customer.
14. California and other U.S. state disclosures
If an applicable U.S. state privacy law covers our processing, the categories collected may include identifiers; customer records; commercial information; internet or network activity; geolocation at the approximate IP-derived level; professional or employment information; audio, visual, or meeting information submitted by users; inferences generated for customer-requested work; and sensitive information only when submitted or needed for authorized security or account functions.
We collect and disclose these categories for the business purposes described in Sections 4 and 7. We do not sell them or share them for cross-context behavioral advertising. This voluntary description does not concede that any particular threshold-based state law applies to Hammersmith.
15. Children
The Services are designed for business users aged 18 or older and are not directed to children under 13. We do not knowingly collect personal information directly from children under 13. If we learn that we collected such information without legally sufficient authorization, we will take appropriate steps to delete it. Contact us at hammer@ai-manager.io with a specific concern.
16. Changes to this Notice
We may update this Notice to reflect legal, operational, security, or product changes. We will publish a new version and effective date and provide additional notice when required or when changes materially affect how we use personal information. We will not apply a materially different use to previously collected information without required notice or consent.
17. Contact
Privacy questions and requests may be sent to hammer@ai-manager.io with the subject "Privacy Request." Hammersmith Enterprises, LLC is organized in Georgia, United States. Written privacy requests may also be sent to Hammersmith Enterprises, LLC, 3985 Haven Ter, Milton, GA 30004, United States. Where applicable law requires a data-protection contact or an EU or UK representative, we will publish that contact before offering the affected Services in that jurisdiction.