HappySeeds Privacy Policy

Last Updated: September 29, 2026

1. Introduction

Welcome to HappySeeds. HappySeeds ("HappySeeds," "we," "us," or "our") provides an AI-powered application creation, agent creation, deployment and hosting platform available at HappySeeds.ai and related websites, applications, features and services (collectively, the "Service").

1.1 Legal Framework. Your access to and use of the Service is also governed by our separate Terms of Service, which set out the contractual terms applicable to your account, subscriptions, credits, acceptable use, user content, AI-generated output, user applications, limitations of liability, dispute resolution and other matters. This Privacy Policy should be read together with the Terms of Service, Cookie Policy and any other policies or notices we make available through the Service. This Privacy Policy explains how we collect, use, disclose, transfer, retain and protect personal information when you access or use the Service. It also explains how we handle certain data that you submit, upload, generate or otherwise process through the Service to build applications, agents, projects, workflows, code and other software artifacts.

1.2 Our Services. HappySeeds currently operates as a self-service platform for individual creators, developers and consumers. We do not currently offer dedicated enterprise, B2B, private deployment or custom consulting services. If we later offer enterprise services, we may provide a separate data processing addendum, enterprise privacy terms or additional contractual commitments.

1.3 Supported Regions. The Service is currently intended to be offered only to users located in the European Union, the United States and Hong Kong ("Supported Regions"). By accessing or continuing to use the Service, you represent and warrant that you are located in one of the Supported Regions, or that you are accessing and using the Service as if you were located in one of the Supported Regions and agree that your use of the Service will be governed by the privacy, data protection, consumer protection and other applicable laws and requirements of the Supported Regions, as further described in this Privacy Policy and our Terms of Service. If you are located outside the Supported Regions, you acknowledge that the Service is not specifically directed to your jurisdiction and that we may not provide jurisdiction-specific disclosures, rights mechanisms, tax treatment, consumer protections or regulatory filings for your location. You are responsible for determining whether your access to and use of the Service is lawful in your jurisdiction. Nothing in this Privacy Policy is intended to exclude or limit any mandatory rights or protections that cannot be waived under applicable law.

1.4 Regional Supplemental Terms. Certain sections of this Privacy Policy apply only to users located in particular jurisdictions or where specific laws apply. If a regional section conflicts with another section of this Privacy Policy, the regional section will apply to the extent required by applicable law for users in that jurisdiction. If applicable law provides you with privacy rights or protections that cannot be waived by contract, nothing in this Privacy Policy is intended to limit those rights or protections.

2. Roles: User Data, User Content and End-User Data

2.1 General Role of You and HappySeeds. In general, HappySeeds acts as the controller or equivalent responsible party for Account and Service Data that we collect for our own platform operations. For User Content, projects and End-User Data processed through user-created applications, HappySeeds may act as a hosting, infrastructure, platform or technical-service provider, while you remain responsible for determining the purposes, lawful basis, notices and compliance obligations for your own applications and End Users.

2.1.1 Account and Service Data. For personal information that we collect directly to create and manage your HappySeeds account, process payments, provide customer support, communicate with you, secure the Service, prevent abuse, maintain logs, comply with legal obligations and improve our own platform, HappySeeds generally acts as the controller, business or equivalent responsible party under applicable privacy laws.

2.1.2 User Content and Projects. For content that you submit, upload, generate or otherwise use through the Service ("User Content", as further described in Section 3), HappySeeds generally processes such data to provide the Service at your direction, including generating, hosting, securing, storing, transmitting, debugging and maintaining your projects and applications. You are responsible for ensuring that you have all necessary rights, permissions, lawful bases, consents, notices and safeguards before submitting or processing User Content through the Service, and that your User Content does not unlawfully include third-party personal information, confidential information, regulated data or third-party intellectual property.

2.1.3 Community Templates and Remix Features. If you designate a project as a Community Template or enable Remix, HappySeeds processes the project content, contributor display information, publication settings, Project Source Notices and Remix relationships needed to display, attribute, discover, copy and operate those features under the Terms of Service. The applicable license and redistribution restrictions are governed by the Terms of Service, not this Privacy Policy.

2.1.4 End-User Data of User Applications. If you create, deploy, embed or make publicly available an application, workflow or AI agent through HappySeeds, that application or agent may collect information from its own visitors, users, customers or other individuals ("End Users"). For such End-User Data, you are responsible for determining what data your application collects, why it is collected, how it is used, how long it is retained, whether it is disclosed to others and what notices, choices and rights are provided to End Users. HappySeeds may process End-User Data as a hosting, infrastructure, platform or technical-service provider to support the operation, security, availability and maintenance of your application or agent.

2.2 Additional Obligation of Yours:

2.2.1 Your Notices, Consents and Legal Bases. You must provide your own privacy notice, cookie notice, AI-interaction notice, terms of service and any other legally required disclosures for any application, workflow or AI agent that you publish, embed or operate for End Users. You must also obtain any required consents, permissions or other lawful bases from End Users before collecting, using, disclosing or otherwise processing their personal information through your application, workflow or AI agent.

2.2.2 Prohibited Uses and High-Risk Use Cases. You must not use the Service to create, deploy or operate applications, workflows or AI agents that unlawfully collect, infer, process or disclose sensitive personal information, children's information, health information, financial information, biometric information, precise location information, government identifiers or other regulated data. You must not use HappySeeds to build applications, workflows or AI agents for high-risk or regulated use cases, including medical diagnosis, financial eligibility, credit scoring, insurance underwriting, employment decisions, education admission or scoring, legal advice or similarly significant decisions, unless you have all required legal authorizations, safeguards, human review mechanisms, professional oversight and disclosures required by applicable law.

2.2.3 AI Outputs Involving Personal Information. If you use the Service to generate, process, classify, summarize or analyze personal information, you are responsible for reviewing the output for accuracy, fairness and appropriateness before using it or making it available to others. You should not rely on AI-generated outputs as the sole basis for decisions that may significantly affect an individual's rights, interests, opportunities or access to services. Where required by law, you must provide human review, correction mechanisms and appropriate explanations to affected individuals.

3. Personal Information We Collect

We collect personal information in the following categories, depending on how you access or use the Service, what features you use, and how you configure any applications, workflows or AI agents that you create through HappySeeds.

3.1 Information You Provide Directly

3.1.1 Account Information. We collect account information such as your name, email address, login credentials, authentication information and, where applicable, information associated with third-party login providers such as Google OAuth or other supported sign-in methods.

3.1.2 Payment and Subscription Information. We collect payment and subscription-related information such as your plan, credits, billing status, transaction status, subscription status, invoice records, payment identifiers and related purchase history. Payments are processed by Stripe or other payment processors we may use from time to time. We do not store full credit-card numbers or full banking details on our own servers.

3.1.3 User Content. We process content that you submit, upload, generate or otherwise use through the Service, including prompts, text, uploaded documents, images, videos, datasets, generated code, AI outputs, agent configurations, project files, database schemas, environment variables, user-supplied API keys, application settings and similar materials ("User Content"). AI Output and generated code are treated consistently as User Content for the purposes described in this Privacy Policy, including the No Training commitment in Sections 5 and 6.

3.1.4 Community and Remix Data. If you publish a Community Template or create a Remixed Project, we may collect and process your contributor name or handle, project title, description, thumbnail or preview, publication and visibility settings, source-attribution and license information, template identifiers, Remix lineage and related activity or technical metadata.

3.1.5 Communications and Support Information. We collect communication information such as messages you send to us through email, Intercom, support channels, feedback forms, community channels or other communication tools, including the content of your messages and related contact information.

3.1.6 Feedback and Quality Information. We collect feedback and quality-related information such as bug reports, feature requests, ratings, survey responses, comments and other information you voluntarily provide to help us evaluate, maintain and improve the Service.

3.2 Information Collected Automatically

3.2.1 Log and Device Data. When you access or use the Service, we may automatically collect log and device data such as IP address, timestamps, browser type, operating system, device type, language settings, pages or features accessed, referring URLs, error logs, diagnostic information, security logs and other technical information.

3.2.2 Usage, Metering and Operational Data. We may collect usage, metering and operational data such as credits consumed, projects created, features used, model usage, application deployment status, API or model-routing events, generation requests, system performance information and other information needed to operate, secure, debug, maintain, improve and bill for the Service.

3.2.3 Approximate Location. We may derive your approximate country or region from your IP address. We use this information for security, compliance, fraud prevention, localization, analytics, service availability and enforcement of regional eligibility or legal requirements.

3.3 Information from Your Applications and End Users

3.3.1 If you create, deploy, embed or make publicly available an application, workflow or AI agent using HappySeeds, that application, workflow or AI agent may collect information from End Users. Depending on how you configure the application, such information may include form submissions, account information, usage logs, messages, uploaded content, transaction-related information, contact details or other information ("End-User Data").

3.3.2 HappySeeds may host, store, transmit or otherwise process End-User Data to provide deployment, hosting, database, authentication, logging, security, debugging, availability and other technical functions of the Service. However, you are responsible for determining what End-User Data your application collects, why it is collected, how it is used, how long it is retained, whether it is disclosed to others and what notices, choices and rights are provided to End Users.

3.3.3 You are responsible for configuring your application, workflow or AI agent lawfully and for providing any required privacy notices, cookie notices, AI-interaction notices, terms of service, consent mechanisms and rights-response mechanisms to End Users. HappySeeds does not determine the purposes for which your application collects or uses End-User Data, except where HappySeeds independently processes such data for its own security, fraud prevention, legal compliance or platform-protection purposes.

3.4 Cookies and Similar Technologies

3.4.1 We and our service providers may use cookies, local storage, pixels, tags, SDKs and similar technologies to operate, secure and improve the Service and, where enabled and lawful, for analytics, advertising measurement and attribution. For information about their purposes, duration, providers and your choices, please see our Cookie Policy.

3.5 Information from Integrations and App Connectors

If you enable an integration or App Connector, HappySeeds may receive and access information made available by the connected third-party service in accordance with the permissions you grant. We may also process authentication status, connector configuration and usage information as necessary to provide, secure and maintain the integration.

For integrations using Google APIs, HappySeeds uses information received from Google only to provide or improve the user-facing connector features that you enable.

HappySeeds’ use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements.

HappySeeds does not use information received from Google APIs for advertising or to train generalized artificial intelligence or machine-learning models.

4. Information We Do Not Intentionally Collect

4.1 HappySeeds does not intentionally require you to provide sensitive personal information in order to use the ordinary features of the Service. As part of ordinary account registration and platform operation, we do not intentionally request or directly collect the following categories of sensitive personal information:

precise geolocation data;
genetic data or biometric identifiers;
health or medical information;
racial or ethnic origin, religious or philosophical beliefs, political opinions or union membership;
sexual orientation or gender identity;
full financial account credentials, credit card numbers or bank account numbers; or
personal information of children under the age of 13.

4.1.1 Identity Verification Exception. Certain applicable laws may require identity-related verification. Such verification is processed by third-party providers, mobile carriers or other service providers. HappySeeds does not directly store the underlying sensitive identity data used for verification, such as government identification numbers or carrier registration records. We retain only the information necessary to confirm verification status and maintain account security.

4.1.2 Sensitive Information in User Content. Because the Service allows you to submit prompts, upload files, generate code, configure agents and deploy applications, you may choose to include personal information or sensitive data in User Content or in applications you create. HappySeeds does not screen User Content for sensitive information before it is submitted or processed. You should also be aware that AI-generated outputs may reference real individuals or produce content resembling personal information, and you are responsible for reviewing such outputs before making them available to others. You are responsible for ensuring you have all necessary rights, lawful bases, consents, notices and safeguards before submitting or processing any sensitive information through the Service. Your responsibilities with respect to User Content are further described in Section 2.

4.1.3 Prohibited Uses. You must not use the Service to unlawfully collect, process, store or disclose sensitive personal information, children's personal information, health information, financial information, biometric information, precise location information, government identifiers or other regulated data, or to create applications, workflows or AI agents that do so in violation of applicable law or our Terms of Service. If we become aware of such use, we may restrict, suspend or remove access to the relevant content, application or account and take any additional steps required by applicable law.

4.1.4 Platform Design Scope. The Service is a general-purpose application and AI agent creation platform. It is not designed, reviewed or certified for regulated or high-risk sectors such as healthcare, financial services, insurance, employment screening, legal services or services directed to children. HappySeeds does not provide professional advice through the Service and does not represent that user-created applications comply with sector-specific legal requirements. If you intend to use the Service for regulated or high-risk use cases, you must independently assess your legal obligations and implement all required safeguards. Applicable restrictions are set out in Sections 6 and 7 of our Terms of Service.

5. How We Use Personal Information and Legal Bases

5.1 How We Use Personal Information. We use personal information for the following purposes, depending on how you access or use the Service and how you configure your applications, workflows or AI agents:

5.1.1 To provide, operate and maintain the Service. We use personal information to create and manage accounts, authenticate users, maintain user sessions, provide project creation tools, route model requests, generate outputs, deploy applications, provide hosting, database, logging and related technical functions, and otherwise make the Service available to you.

5.1.2 To process payments and manage subscriptions. We use payment and subscription-related information to process payments, manage subscriptions, allocate and track credits, issue invoices, verify account status, detect payment abuse and administer billing through Stripe and related payment systems.

5.1.3 To generate, deliver and maintain your projects. We use User Content to generate, debug, update, improve, host, deploy and deliver your applications, agents, workflows, code, outputs, databases, project files and related software artifacts according to your instructions.

5.1.4 To route requests to AI model providers and technical suppliers. We may transmit User Content and related technical information to third-party AI model providers and model-routing suppliers to process your requests and generate outputs. For details of current providers and our data-use commitments, see Section 6.

5.1.5 To host and serve user-created applications. We use personal information and technical data as necessary to store, deploy, host, secure and serve applications, workflows and AI agents that you create through the Service, including applications published on HappySeeds-provided domains, custom domains or embedded in third-party websites.

5.1.6 To operate Community Template and Remix features. We use Community and Remix Data to publish and display templates, generate previews, preserve Project Source Notices, identify contributors, maintain Remix lineage, enable permitted copying and modification, prevent unauthorized redistribution, and enforce the Terms of Service. To identify your contribution, we may display the contributor name associated with your account and may also use that name in HappySeeds marketing materials and channels, as described in the Terms of Service. You may ask us not to use your attribution, or to change or remove it from future marketing materials, by contacting [email protected].

5.1.7 To operate published applications, custom domains and third-party domain deployments. If you publish, deploy, embed or make available a web application, mobile application, workflow or AI agent created through HappySeeds, we may process personal information, End-User Data and related technical information as necessary to operate and support that published application. This may include processing information to configure deployment environments, connect domains, route traffic, maintain DNS or domain-related settings, provide hosting and database services, enable authentication, store uploaded files, serve application content, maintain logs, monitor performance, debug errors, prevent abuse and secure the application.

5.1.8 To communicate with you. We use personal information to send account messages, support responses, security alerts, payment notices, subscription updates, product updates, legal notices, policy updates and other service-related communications.

5.1.9 To protect the Service and enforce our terms. We use personal information to monitor, prevent, investigate and respond to abuse, fraud, spam, unauthorized access, security incidents, intellectual-property complaints, illegal content, misuse of credits, violations of our Terms of Service and other harmful or unlawful activity.

5.1.10 To analyze, maintain and improve the Service. We use limited usage, diagnostic, operational and aggregated or de-identified information to understand how the Service performs, identify errors, measure feature usage, improve reliability, enhance product functionality and develop service improvements. Where required by applicable law, we will obtain your consent before using non-essential cookies or similar technologies for analytics or marketing measurement.

5.1.11 To comply with law and protect rights. We use personal information to comply with applicable legal obligations, respond to lawful requests, enforce our agreements, resolve disputes, maintain records, and protect the rights, safety and property of HappySeeds, users, End Users, third parties and the public.

5.2 No Training on User Content. We do not use User Content submitted through HappySeeds to train, fine-tune or evaluate AI models unless you have explicitly opted in through a clear setting or separate written agreement. Our approach to third-party model providers and user-supplied API keys is described in Section 6.

5.3 European Union Legal Bases. Where the EU General Data Protection Regulation ("GDPR") applies, we rely on one or more of the following legal bases to process personal data:

5.3.1 Performance of a contract: to create and manage your account, provide the Service, process subscriptions and credits, generate outputs, host projects and applications, provide support and enforce our Terms of Service.

5.3.2 Legitimate interests: to secure the Service, prevent fraud and abuse, maintain logs, improve reliability, analyze service performance, respond to support requests, protect our rights and maintain business operations, where those interests are not overridden by your rights and interests.

5.3.3 Consent: where we ask for your consent, including for certain cookies, marketing communications, optional product settings, or processing activities that legally require consent.

5.3.4 Legal obligations: to comply with laws, tax and accounting rules, lawful requests, regulatory obligations, sanctions, export-control requirements and dispute-resolution obligations.

5.3.5 Where we rely on consent, you may withdraw your consent at any time, without affecting processing that occurred before withdrawal.

5.4 Hong Kong Processing Principles. Where the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") applies, we collect personal data for lawful purposes directly related to our functions and activities, limit collection to data that is necessary and not excessive, and use personal data for the original collection purpose or a directly related purpose. Where required, we will obtain prescribed consent before using personal data for a new purpose or for direct marketing.

5.5 United States Processing Purposes. For users in the United States, we process personal information for the business and commercial purposes disclosed in this Privacy Policy, with consent where required, and otherwise as permitted or required by applicable federal and state privacy laws.

6. AI Model Providers and Model-Routing Suppliers

6.1 Overview of AI Providers. The Service may use third-party AI model providers, model-routing suppliers and related technical service providers to generate, modify, analyze, debug or improve applications, agents, workflows, code and other outputs requested by you. These may include providers of large language models, code-generation models, image-generation models, multimodal models, embedding models and related AI services. Current or potential providers include, from time to time, Anthropic/Claude, OpenAI/GPT, Google/Gemini and other mainstream domestic or international AI models or model-routing services, selected based on capability, reliability, availability, safety, performance and cost. The specific providers used may change as we improve the Service, add features, optimize performance or respond to technical, legal, commercial or security requirements.

6.2 Transmission of User Content to Providers. When you submit a prompt, file, instruction, project context or other User Content to generate, modify, analyze or deploy an application, workflow or AI agent, the relevant User Content and related technical information may be transmitted to one or more AI model providers, model-routing suppliers or infrastructure providers to process your request and return code, text, images, configurations, analysis, debugging suggestions or other AI-generated outputs.

6.3 No Training Commitment and Provider Selection. We do not use User Content submitted through HappySeeds to train, fine-tune or evaluate AI models unless you have explicitly opted in through a clear setting or separate written agreement. Where commercially available and reasonably practicable, we select AI model providers and model-routing suppliers whose applicable terms restrict the use of user-submitted content for training their models.

6.4 User-Supplied API Keys and Independent Configurations. If you choose to use your own API key, connect your own third-party AI provider, or configure a third-party model or service independently, your use of that provider or service is governed by your separate agreement with that provider. In that case, the provider's own terms, privacy policy, retention policy, security practices, data-use practices and model-training practices may apply. HappySeeds is not responsible for the privacy, security, retention, training, logging, content review or other data practices of third-party services that you independently configure or use through your own credentials.

7. Human Review, Safety Review and Abuse Monitoring

7.1 Scope of Review. We may review User Content, user-created applications, deployment activity, public applications, application metadata, logs, support requests, feedback, abuse reports, intellectual-property complaints or reported content when reasonably necessary to provide support, investigate bugs, debug errors, maintain service availability, review applications submitted for public templates or featured examples, enforce our Terms of Service, respond to legal requests, protect the Service, prevent abuse, or address security, safety, legal or operational risks.

7.2 Review Methods. HappySeeds may use technical signals, system-generated indicators, and manual review to identify or investigate security risks, illegal content, spam, malware, phishing, credential abuse, intellectual-property infringement, non-consensual or unlawful content, unsafe applications, abnormal usage patterns, misuse of credits, attempts to evade usage limits, or other violations of our Terms of Service.

7.3 Access Controls. Reviews may include limited access to relevant User Content, deployment information, logs, account information and technical metadata where necessary for the relevant review purpose. Access by HappySeeds personnel to User Content, End-User Data, logs and other non-public information is limited by internal access controls, authorization requirements and business need. Personnel access is used only for support, safety, security, legal, compliance, abuse-prevention, debugging, application-review or service-operation purposes.

7.4 Limitations on Use of Review Data. We do not use User Content or account activity to profile users for marketing purposes. We do not make account decisions based on AI scoring of sensitive characteristics or personal attributes such as race, ethnicity, religion, political views, health status, biometric characteristics or children's status.

7.5 Enforcement and Right to Request Review. Where appropriate, we may restrict, suspend, remove or disable access to accounts, projects, applications, workflows, AI agents or content that appear to violate our Terms of Service or applicable law, based on abnormal logs, abuse indicators, safety review, legal complaints or other violations. If your account, project or application is restricted as a result of abuse monitoring or safety review, you may contact us through the support channels identified in this Privacy Policy or our Terms of Service to request review, unless we are legally prohibited from responding or doing so would compromise security, abuse prevention or an ongoing investigation.

8. How We Disclose Personal Information

We disclose personal information only as described in this Privacy Policy, as needed to provide and protect the Service, as directed by you, or as otherwise permitted or required by applicable law.

8.1 Service Providers and Subprocessors. We disclose personal information to vendors, service providers, contractors and subprocessors that help us operate, secure, maintain, support and improve the Service. These may include providers of hosting, cloud infrastructure, CDN, database, storage, backup, security, monitoring, analytics, payment processing, subscription management, customer support, email, communications, AI model, model-routing, logging, debugging and related services. Current categories may include AWS, Cloudflare, Stripe, Intercom, AI model providers, Google services and other vendors needed to operate the Service.

8.2 AI Providers and Model-Routing Suppliers. We may disclose User Content, prompts, files, project context, model requests and related technical information to third-party AI model providers, model-routing suppliers, infrastructure providers or related technical service providers as necessary to process your requests, generate outputs, debug errors, route model calls or provide AI-powered features.

8.3 User-Configured Third Parties and Integrations. We may disclose information to third-party services when you instruct us to do so, connect an integration, use a user-supplied API key, configure an external model provider, connect a domain, enable a payment provider, embed a third-party service or otherwise authorize the disclosure. Your use of those third-party services may be governed by their own terms, privacy policies and data-use practices.

8.4 End Users, Visitors and the Public. If you publish, deploy, embed or make publicly available an application, workflow or AI agent through HappySeeds, your application, content, output, interface, public deployment URL, custom domain, application metadata and any information you choose to display may be visible to End Users, visitors or the public depending on your settings and how you configure the application. End Users may also submit information directly through your application, and that information may be processed to operate, host, secure and maintain the application. Changing visibility settings, deleting an application or deleting your account may not remove copies, screenshots, search-engine caches, third-party archives or information that has already been accessed or stored by third parties outside our control. You are responsible for reviewing your project files, outputs, prompts, environment variables, API keys and database content before publication, and should not publish confidential information, sensitive personal data, secrets, credentials or information you do not have the right to disclose.

8.5 Community Templates, Attribution and Remix Lineage. If you publish a Community Template or enable Remix, the project content and the contributor, project, preview, source-attribution, license, and Remix-lineage information associated with it may be displayed to other users or the public, including through HappySeeds marketing materials and channels as described in Section 5 and the Terms of Service, and may be copied into lawfully created Remixed Projects. Disabling Remix, removing a Community Template or deleting your account does not retroactively remove copies or source information incorporated into Remixed Projects created before removal, subject to the Terms of Service and any action required for infringement, illegality, security or other legal reasons.

8.6 Legal, Safety and Enforcement Purposes. We may disclose personal information where we reasonably believe disclosure is necessary to comply with applicable law, legal process, court orders, regulatory requests, law-enforcement requests or government inquiries; enforce our Terms of Service or other agreements; protect the rights, safety and property of HappySeeds, users, End Users, third parties or the public; investigate fraud, abuse, spam, malware, security incidents or unlawful activity; respond to intellectual-property complaints; or prevent harm to the Service.

8.7 Business Transfers. If HappySeeds is involved in a merger, acquisition, financing, investment, corporate restructuring, bankruptcy, dissolution, sale of assets or similar transaction, personal information may be disclosed, transferred or otherwise processed as part of that transaction, subject to appropriate confidentiality, security and notice measures where required by law.

8.8 With Your Consent or Direction. We may disclose personal information when you consent to the disclosure, direct us to disclose it, or otherwise authorize the disclosure through your settings, account actions, integrations, deployments, API keys or other use of the Service.

8.9 No Monetary Sale of Personal Information; Advertising and Opt-Out Rights. We do not sell personal information for money as further described in Section 13. If we use technologies or disclose information in a way that is legally considered a sale, sharing or targeted advertising, we will provide required notices and choices, including opt-out mechanisms and recognition of applicable opt-out preference signals where required by law and technically supported.

9. Subprocessors and Third-Party Service Providers

We use third-party service providers, vendors, contractors and subprocessors to operate, secure, maintain, support and improve the Service. These providers may process personal information only as necessary to provide services to HappySeeds, or as otherwise permitted by applicable law and their agreements with us. We expect these providers to process information subject to contractual, technical and organizational safeguards appropriate to the nature of the processing.

The specific providers we use may change from time to time as the Service evolves, as we add or remove features, improve performance, optimize costs, respond to legal or security requirements, or replace suppliers. We may maintain a current subprocessor or third-party service provider list on our website, in our Cookie Policy, or make it available upon request.

A non-exhaustive list of current key service categories and representative providers is set out below:

Category	Provider	Purpose	Potential data involved
Cloud infrastructure	Amazon Web Services (AWS, US-East / Virginia)	Hosting, storage, compute, databases, logs, backups, deployment infrastructure and related technical operations	Account data, User Content, project data, application data, End-User Data, logs, technical metadata
CDN, DNS and security	Cloudflare	Content delivery, DNS, traffic routing, network security, DDoS protection, caching, website and application performance	IP address, request logs, website and application traffic metadata, security event data
Payment and subscription management	Stripe	Payment processing, subscription management, billing, invoices, payment authentication, fraud prevention and tax-related payment records	Payment identifiers, transaction records, subscription status, billing data, invoice data, limited account information
Customer support and communications	Intercom; email and communication tools	Customer support, feedback collection, support communications, user messaging, issue tracking and service updates	Contact information, support messages, account context, diagnostic information voluntarily provided by you
AI models and model routing	Anthropic/Claude; OpenAI/GPT; Google/Gemini; other AI model providers or model-routing suppliers	AI generation, code generation, image generation, multimodal processing, model responses, model routing and related AI features	Prompts, files, project context, model requests, generated outputs and related technical metadata as needed to process your request
Analytics, measurement and marketing technologies	Google Search Console, Google Analytics, Google Tag Manager, Google Ads, Reddit Pixel and similar tools, Umami, CookieYes, where enabled	Website analytics, search performance, service measurement, performance diagnostics, campaign measurement, advertising attribution, conversion measurement or marketing optimization where enabled and lawful	Cookie identifiers, IP address, device and browser data, event data, usage data, referral information and marketing measurement data
Authentication and login	Google OAuth; other supported login providers	Account login, authentication, account security and identity verification	Email address, authentication token or identifier, account profile information provided by the login provider
Domain, deployment and integration services	Domain, DNS, hosting, database, API, payment, AI model or other third-party services configured by you	Operation of user-created applications, custom domains, embedded deployments and third-party integrations	Data depends on your configuration, including application metadata, End-User Data, API requests, domain metadata and integration-related information

If you choose to connect your own third-party service, use your own API key, configure an external AI model provider, connect a domain, enable a third-party payment provider, embed a third-party tool, or otherwise direct the Service to transmit information to a third party, that third party may process information under its own terms, privacy policy and data-use practices. You are responsible for reviewing and complying with those third-party terms and for providing any required notices, consents or choices to your End Users.

Where required by applicable law, including applicable laws in the European Union, the United States and Hong Kong, we will provide appropriate notice of material changes to our subprocessors or third-party service providers and implement appropriate contractual, security, subprocessing and international-transfer safeguards.

10. International Data Transfers

10.1 Overview. HappySeeds operates the Service using cloud infrastructure, AI model providers, model-routing suppliers, payment processors, analytics tools, support tools and other service providers that may be located in different countries or regions. Our primary hosting environment currently uses Amazon Web Services (AWS) in the United States, including the US-East region in Virginia. We may also use service providers located in the United States, the European Union, Hong Kong or other countries or regions.

As a result, personal information, User Content, End-User Data, logs, technical metadata and related information may be transferred to, stored in, accessed from or otherwise processed in countries or regions other than where you live or where the information is originally collected. These countries or regions may have privacy and data-protection laws that differ from, and may not provide the same level of protection as, the laws of your country or region.

10.2 European Union. If you are located in the European Union and your personal data is transferred to a country or region that has not been recognized as providing an adequate level of protection, we will rely on appropriate transfer mechanisms where required by applicable law. These may include adequacy decisions, the European Commission's Standard Contractual Clauses, contractual safeguards with service providers, transfer impact assessments and supplementary technical and organizational measures such as encryption, access controls, logging, vendor due diligence and data minimization.

10.3 Hong Kong. If you are located in Hong Kong, your personal data may be transferred to, stored in, accessed from or otherwise processed outside Hong Kong, including in the United States, the European Union, or other jurisdictions where HappySeeds, its affiliates or its service providers operate. We will use reasonable contractual, technical and organizational safeguards designed to protect personal data transferred outside Hong Kong, taking into account the PDPO, applicable Data Protection Principles and guidance issued by the Hong Kong Privacy Commissioner for Personal Data.

10.4 User-Configured Third-Party Transfers. If you configure your own third-party service, use your own API key, connect an external AI model provider, connect a custom domain, embed a third-party tool or otherwise direct HappySeeds to transfer information to a third party, the transfer and processing of that information may be governed by your separate relationship with that third party. You are responsible for reviewing the third party's terms, privacy policy, data location, retention practices and transfer mechanisms, and for providing any required notices or obtaining any required consents from your End Users.

11. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law. Retention periods may vary depending on the type of data, your account status, the features you use, whether you have published applications or agents, legal and accounting obligations, security needs, dispute-resolution needs, abuse-prevention requirements and product functionality.

The table below provides indicative retention periods. Actual retention may vary where deletion is technically required to occur through backup rotation, where retention is necessary for legal compliance, security, fraud prevention, abuse investigation, dispute resolution or enforcement of our Terms of Service, or where you have configured integrations or third-party services that retain information separately.

Data category	Indicative retention period	Notes
Account data	For the life of your account; deleted, deactivated, anonymized or otherwise made unavailable after account deletion, unless retention is required or permitted by law	Account deletion may first result in deactivation or soft deletion from active systems before final deletion from all systems and backups.
Projects, generated applications and User Content	For the life of the account, project or application; deleted when you delete the relevant account, project or application, subject to backup cycles and legal retention	If you delete the relevant data or account, published applications associated with that account or project may be taken offline and deleted or made unavailable.
End-User Data in user-created applications	For as long as needed to operate the relevant user-created application, workflow or AI agent, or until the app creator deletes the relevant application or data, subject to backup cycles and legal retention	The app creator is generally responsible for determining the retention period for End-User Data and responding to End-User rights requests, unless HappySeeds separately processes the data for its own purposes.
Payment and subscription records	As long as required or permitted for tax, accounting, billing, chargeback, fraud-prevention, audit and legal compliance purposes	Payments are processed primarily through Stripe or other payment processors. HappySeeds may retain transaction identifiers, subscription status, invoice records and related billing metadata.
Support communications	As long as reasonably necessary for customer support, quality assurance, dispute resolution, legal compliance, service improvement and recordkeeping	Support data may be processed through Intercom, email tools or other support systems, and may be retained according to applicable support-tool settings and legal requirements.
Security, operational and log data	Typically for a limited operational period, such as up to 90 days, unless longer retention is necessary for security, abuse investigation, fraud prevention, legal compliance, service integrity or dispute resolution	Longer retention may apply where logs are relevant to abnormal activity, security incidents, misuse of credits, account abuse, IP complaints or legal requests.
Backup data	Retained according to backup rotation, disaster-recovery and business-continuity cycles, and then overwritten, deleted or made unavailable in the ordinary course	Deletion from active systems may occur before deletion from backups. Backup data is generally not restored except for disaster recovery, security, legal or service-integrity purposes.
Aggregated, de-identified or anonymized data	May be retained for longer periods where it no longer identifies you or any End User	We may use such data for analytics, diagnostics, security, product improvement and reporting, where permitted by applicable law.
Community Template and Remix data	While the Community Template or associated Remixed Projects remain available; limited source-attribution, Project Source Notice, and Remix-lineage records may be retained longer where necessary to document the applicable license, protect rights, resolve disputes, enforce the Terms of Service, or comply with law	Removing a Community Template, disabling Remix, or deleting your account may stop future access to the original template and prevent new Remix activity where technically supported. These actions do not delete lawfully created Remixed Projects, remove required Project Source Notices, or require HappySeeds to withdraw prior marketing materials. HappySeeds will stop featuring the template in new marketing materials within a reasonable period.

Before you delete an account, project, application, workflow, or AI agent, save what you need. After deletion, deactivation, the end of a grace period, or backup rotation, we may be unable to restore projects, applications, User Content, End-User Data, or account information.

Removing a Community Template, disabling Remix, or deleting your account may stop future access to the original Community Template, but those actions will not retroactively delete Remixed Projects lawfully created before removal, remove Project Source Notices that must be retained under the Terms of Service or applicable law, or require HappySeeds to recall, modify, or delete marketing materials featuring the template that were published before removal. HappySeeds will stop featuring the template in new marketing materials within a reasonable period after removal. HappySeeds may retain limited source-attribution and Remix-lineage records where necessary to document the applicable license, protect rights, resolve disputes, or comply with law.

If you have connected third-party services, used your own API key, configured a custom domain, enabled a payment provider, embedded third-party tools or deployed your application through third-party infrastructure, those third parties may retain information under their own terms and retention policies. You are responsible for reviewing those third-party retention practices and for providing any required retention and deletion disclosures to your End Users.

12. Security

12.1 Our Security Measures. We use commercially reasonable technical and organizational measures designed to protect personal information, User Content, End-User Data and related technical information against unauthorized access, loss, misuse, alteration, disclosure or destruction. These measures may vary depending on the nature of the data, the feature used, the deployment configuration and the service provider involved, and may include:

encryption in transit using TLS/SSL;
encryption at rest for stored data where supported by our infrastructure, database and storage systems;
tenant-level logical separation for user accounts, projects, applications and application data;
access controls, whitelist controls and need-to-know internal access;
secure password hashing for password-based login;
separate handling, restricted access and protective measures for API keys, tokens, secrets and environment variables;
security logging, monitoring, internal security assessments and abuse review;
vendor review and internal security review processes;
measures designed to detect, investigate and respond to abnormal activity, misuse of credits, unauthorized access, malware, phishing, spam, security incidents or violations of our Terms of Service.

12.1.1 Your Security Responsibilities. You should not include API keys, access tokens, private keys, passwords, secrets or other sensitive credentials in prompts, public project files, public application interfaces, frontend code, screenshots, support messages or any other location where they may be exposed to End Users or the public. Before publishing a project, designating it as a Community Template, enabling Remix, downloading a Download Package or distributing source code externally, you must also review and remove .env files, personal information, confidential information, database samples, unauthorized materials and other sensitive or restricted content. Where the Service provides tools to store or manage secrets or environment variables, we will use reasonable safeguards designed to protect them. You remain responsible for your own third-party accounts, API usage, charges, permissions, quotas and data flows associated with credentials or API keys that you provide or configure.

If you create, deploy, embed or make publicly available an application, workflow or AI agent through HappySeeds, you are responsible for configuring and operating that application securely. This includes reviewing the data your application collects, limiting unnecessary collection, protecting any credentials or API keys you use, configuring access permissions appropriately, reviewing third-party integrations, and providing any security, privacy or legal notices required for your End Users.

12.2 Security Certifications. We do not currently hold SOC 2, ISO 27001 or similar third-party security certifications unless and until such certification is obtained and publicly stated by HappySeeds.

12.3 Security Incident Notification. If we become aware of a personal-data breach or security incident that requires notification under applicable law, we will notify affected users, regulators or other parties as required by applicable law and within the timeframes required by such law.

12.4 No Guarantee of Complete Security. No method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee that the Service, User Content, End-User Data, published applications, third-party integrations or communications will be completely secure or free from unauthorized access, interruption, loss or misuse.

13. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information. These rights may include the right to request access to your personal information, correction of inaccurate information, deletion of information, portability of information, restriction of processing, objection to certain processing, withdrawal of consent, and the right not to be discriminated against for exercising your privacy rights.

The rights in this section concern personal information. They do not require us to provide project source code.

You may submit a privacy request by contacting us at [email protected] or through any dedicated privacy request channel or form that we make available. We may ask you to provide information reasonably necessary to verify your identity and process your request. If we cannot verify your identity or authority to act on behalf of another person, we may be unable to fulfill the request.

13.1 European Union Privacy Rights. If you are located in the European Union, you may have rights under the EU General Data Protection Regulation ("GDPR") or other applicable data protection laws, including the rights described above. You may also have the right to lodge a complaint with your local data protection supervisory authority. Where required by GDPR Article 27, we will appoint an EU representative and publish the representative's contact details in this Privacy Policy or a separate notice. We generally respond to valid GDPR requests within one month, subject to permitted extensions for complex or multiple requests.

13.2 California and U.S. State Privacy Rights. If you are a California resident or a resident of another U.S. state with applicable privacy rights, you may have the right to know, access, correct, delete and obtain a copy of personal information, to opt out of the sale, sharing or use of personal information for targeted advertising or certain profiling, to limit the use or disclosure of sensitive personal information where applicable, and to use an authorized agent to submit requests on your behalf. Where required by applicable law and technically supported, we will honor legally recognized opt-out preference signals, including Global Privacy Control. We generally respond to U.S. state privacy requests within 45 days, subject to permitted extensions.

13.3 Hong Kong Privacy Rights. If you are located in Hong Kong, you may have rights under the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"), including the right to request access to and correction of personal data that we hold about you and the right to opt out of direct marketing. If you have questions or complaints about our privacy practices, you may contact us at [email protected]. You may also lodge a complaint with the Hong Kong Privacy Commissioner for Personal Data.

13.4 Choices Regarding Communications and Cookies. You may manage cookies and similar technologies through our cookie banner or preference center where available, your browser settings, or other mechanisms described in our Cookie Policy. Where permitted by applicable law, we may send you product updates, newsletters or other promotional messages. You may opt out of marketing communications at any time by using the unsubscribe link in the message or by contacting [email protected]. Some service-related communications, such as security alerts, billing notices, account notices or legal updates, are necessary for the Service and may not be fully disabled while you maintain an account. Opting out of marketing communications does not affect our ability to send you service-related communications.

14. Cookies, Advertising Choices and Do Not Track / GPC

14.1 Cookies and Similar Technologies. We and our service providers may use cookies, local storage, pixels, tags, SDKs and similar technologies to operate the Service, keep you signed in, remember your preferences, measure performance, understand usage patterns, prevent fraud, maintain security, support analytics and, where enabled and lawful, measure or attribute marketing campaigns. These technologies may include tools such as Google Analytics, Google Tag Manager, Google Ads, Reddit Pixel, Umami, CookieYes and similar services. For a full description of the technologies we use, their purposes, duration and providers, please see our Cookie Policy.

14.2 Essential Technologies. Certain cookies and similar technologies are necessary for the Service to function. They maintain security, remember your session and choices, keep you signed in, prevent fraud and enable core features. Essential technologies cannot be disabled through our preference center. You may block them through your browser settings, but doing so may cause parts of the Service to stop working properly.

14.3 Non-Essential Technologies and Regional Consent. Non-essential analytics, performance, advertising, marketing measurement or similar technologies are used only where enabled and lawful. In the European Union, we will seek prior consent before activating non-essential cookies or similar technologies where required by applicable law. In the United States and Hong Kong, we will provide notices, consent mechanisms or opt-out choices as required by applicable law.

14.4 Managing Your Choices. You may manage your cookie preferences through our cookie banner or preference center where available, or through your browser or device settings. You may withdraw or change your consent for non-essential technologies at any time through the cookie banner or preference center. Withdrawing consent does not affect any processing that took place before withdrawal. For further details on available controls, please see our Cookie Policy.

14.5 Advertising Opt-Out and Preference Signals. We do not sell personal information for money as further described in Section 13. Some browsers, devices or extensions may transmit "Do Not Track" ("DNT"), Global Privacy Control ("GPC") or other opt-out preference signals. DNT and GPC are not the same signal and may be treated differently under applicable law. Where required by applicable law and technically feasible, we will treat legally recognized opt-out signals, including GPC, as a request to opt out of the sale, sharing or use of personal information for targeted advertising, depending on the applicable law, the signal received and the technical context.

15. Children and Minors

15.1 Minimum Age to Use the Service. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are under 13, you may not create an account or use the Service. For users who are 13 or older but under the age of majority in their jurisdiction, access to the Service is permitted only where allowed by applicable law, app-store requirements, platform rules and our Terms of Service. Minimum age requirements may vary depending on the jurisdiction, distribution channel and platform. For example, mobile-app distribution or platform ratings may indicate minimum ages such as Android 13+ or Apple 16+ where applicable. Certain higher-risk features, including paid subscriptions, publishing functions, commercial use, custom-domain deployment, AI-agent deployment and payment-related functionality, may require users to be at least 18 years old or the age of majority in their jurisdiction, as further described in our Terms of Service.

15.2 Our Approach to Children's Marketing. We do not intentionally market K-12 content, children-directed services or services specifically directed to children under 13.

15.3 Restrictions on Applications, Workflows and AI Agents You Create. You may not use the Service to create, deploy, embed or operate applications, workflows or AI agents directed to children under 13, or to knowingly collect personal information from children under 13, unless you independently comply with all applicable child-privacy, parental-consent, age-assurance and online-safety laws and HappySeeds expressly permits such use in writing.

You may not use the Service to create applications, workflows or AI agents directed to minors aged 13 to 17, or any other age group treated as minors under applicable law, unless you are solely responsible for complying with all applicable laws and platform requirements. These may include, where applicable, COPPA, GDPR child-consent rules, the PIPL requirements for children under 14, U.S. state child and teen privacy laws, app-store age-rating rules, advertising restrictions, parental-consent requirements and similar laws.

15.4 Enforcement and Reporting. If we learn that we have collected personal information from a child or minor in violation of applicable law or our Terms of Service, we will take reasonable steps to delete the information, restrict the account, remove the relevant application or take other appropriate action. If you believe that a child or minor has provided personal information to us in violation of this Privacy Policy, please contact us at [email protected].

16. AI Transparency and Automated Decisions

16.1 HappySeeds's Use of AI Systems. HappySeeds uses AI systems and third-party AI model providers to generate, assist with, modify, analyze or debug code, applications, workflows, AI agents, images, text, configurations and related outputs at your direction. AI-generated outputs may be inaccurate, incomplete, outdated, insecure, non-unique, biased or unsuitable for your intended use. You are responsible for reviewing, testing and validating AI-generated outputs before deployment, publication, commercial use or reliance, and for obtaining professional review where appropriate.

16.2 HappySeeds's Automated Decision Practices. HappySeeds does not use personal information to make fully automated decisions that produce legal or similarly significant effects about users, such as decisions relating to credit, employment, housing, education, insurance or healthcare. We may use automated or semi-automated technical signals to detect abuse, fraud, spam, malware, unauthorized access, misuse of credits, security risks or abnormal activity. These signals are used to protect the Service and may result in review, restriction, suspension or other enforcement action. Where required by applicable law, you may contact us to request review of a restriction or enforcement action, unless we are legally prohibited from responding or doing so would compromise security, abuse prevention or an ongoing investigation.

16.3 Your Obligations When Deploying AI to End Users. If you create, deploy, embed or make publicly available an AI agent, workflow or application that interacts with End Users, generates content for End Users, makes recommendations, collects End-User Data or takes actions on behalf of End Users, you are responsible for providing all legally required notices, disclosures, consent mechanisms, opt-outs and human-review channels. This may include, where applicable, clearly informing End Users that they are interacting with an AI system, that content is AI-generated, or that an automated system is being used to support a decision, recommendation, response or action. Where AI-generated outputs involve personal information about individuals, you are responsible for reviewing such outputs for accuracy, fairness and appropriateness before making them available to others, and for providing correction mechanisms and appropriate explanations to affected individuals where required by law.

16.4 Regional AI Transparency Requirements. Applications, workflows or AI agents made available to users in the European Union, the United States, Hong Kong or other regulated markets may be subject to AI transparency, generative AI, deep synthesis, automated decision-making, consumer protection, data protection or sector-specific requirements. You are responsible for determining whether such requirements apply to your application, workflow or AI agent and for complying with them, including any requirements to label AI-generated content, provide human review, disclose automated processing, avoid misleading users, maintain records, prevent unlawful discrimination or restrict high-risk use cases.

16.5 Prohibition on Fully Automated Significant Decisions. You must not use HappySeeds to create, deploy or operate AI systems that make fully automated decisions producing legal or similarly significant effects for individuals, including decisions relating to credit, lending, insurance, employment, education, housing, healthcare, legal rights, eligibility for essential services or similarly significant matters, unless you have all required legal authorizations, human-review mechanisms, safeguards, testing, documentation and disclosures required by applicable law.

17. Third-Party Links, Integrations and User Configurations

17.1 Third-Party Services. The Service may include or allow you to use links, integrations, templates, embeds, APIs, AI model connections, model-routing services, payment providers, domain and DNS providers, analytics tools, authentication providers, database services, communication tools, app stores, community features and other third-party services. You may also independently connect third-party services through your own account, API key, credentials or configuration.

17.2 Third-Party Terms and HappySeeds' Responsibility. Third-party services are governed by their own terms, privacy policies, data-processing terms, security practices and retention practices. HappySeeds is not responsible for the privacy, security, availability, content, accuracy, legality, retention, AI model-training practices, payment processing or other practices of any third-party service that you choose to access, connect, embed, configure or use. If you use a user-supplied API key or independently configure a third-party AI provider, payment service, domain registrar or other service, your use of that service is governed by your separate relationship with that provider, not by this Privacy Policy.

17.3 Your Responsibilities. You are responsible for reviewing and complying with the terms, privacy policies and data-processing requirements of any third-party service you connect to your projects, applications, workflows or AI agents. You are also responsible for providing any notices, consents, opt-outs or other disclosures required by applicable law to your End Users in connection with any third-party service integrated into your application.

18. Changes to This Privacy Policy

18.1 When We May Update. We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, vendors, service providers, legal requirements, regional availability, product features, AI model providers, security measures or data-processing activities.

18.2 How We Notify You. When we make material changes to this Privacy Policy, we will provide notice by reasonable means. This may include posting a notice through the Service, sending a notice or updated text to the email address associated with your account, displaying an in-product notice, or using other legally permitted notice methods. The "Last Updated" date at the top of this Privacy Policy indicates when this Privacy Policy was last revised.

18.3 Effect of Changes. Where required by applicable law, we will obtain your consent before applying material changes to processing activities that require consent. Your continued use of the Service after the effective date of an updated Privacy Policy constitutes your acknowledgment of the updated Privacy Policy, to the extent permitted by applicable law. If you do not agree with the updated Privacy Policy, you should stop using the Service and may request deletion of your account as described in this Privacy Policy or our Terms of Service.

19. Contact Us

If you have questions, concerns, complaints or requests regarding this Privacy Policy or our data practices, you may contact us using the details below:

Email: [email protected]
Support: [email protected]
Website: HappySeeds.ai
Mailing Address: BetterYeah (Hong Kong) Intelligent Technology Co., Limited
Room 316, 3/F, 143 Wai Yip Street, Kwun Tong, Kowloon

If you are contacting us to exercise a privacy right, please include enough information for us to understand and verify your request. We may request additional information to verify your identity, protect your account and prevent unauthorized access to your personal information.

Where appointment of an EU representative or another local representative is required by applicable law, we will update this Privacy Policy or provide a separate notice with the relevant contact details.