Privacy Policy
Version 1.0 · Last updated 13 September 2026 · Canonical URL: https://airhive.ai/legal/privacy
1. Controller and contact details
The controller for the processing described in this Privacy Policy is Airhive GmbH, Eckernwoort 16, 22607 Hamburg, Germany, registered with the commercial register of the Local Court (Amtsgericht) of Hamburg under HRB 199886, represented by its managing director Daniel Dede ("Airhive", "we", "us").
Privacy contact: privacy@airhive.ai, or by post to the address above marked "Data protection". Airhive is not currently required to appoint a Data Protection Officer; if this changes, the contact details will be published in this section.
This Policy applies when you visit airhive.ai, use dash.airhive.ai or an Airhive application, create an Account, join a Workspace, subscribe, contact support, use AI Features, enable Connected Services or otherwise interact with Airhive. Capitalised terms have the meaning given in the Terms of Service.
2. Airhive as controller and as processor
Airhive has two distinct data-protection roles:
- Airhive is the controller for Account, website, subscription, billing, support, security, product-usage and communication data. Airhive determines the purposes and means of that processing. This Privacy Policy describes it.
- Airhive is the processor for personal data contained in Customer Content. The Customer decides what to upload, how to organise it, who may access it and which features may process it, and is the controller (or, where the Customer itself acts for another controller, the processor). The Data Processing Agreement ("DPA") governs that processing; this Privacy Policy does not.
If you use a Workspace provided by your employer, client, association or another organisation, that organisation is the controller for your Workspace membership, your activity within the Workspace and the content you work with. Contact the Workspace Administrator for information about that organisation's processing. Airhive remains the controller for your Account credentials and for the security and technical data described below.
3. Categories of personal data
| Category | Examples |
|---|---|
| Account and profile data | Name, email address, password hash, avatar, language, preferences, Account identifier, authentication and recovery data. |
| Workspace and collaboration data | Workspace names, membership, roles, invitations, permissions, guest access, Hives, sub-Hives, sharing settings, review decisions, instructions and audit-log entries. |
| Customer Content (processed as processor under the DPA) | Files, documents, images, extracted text, metadata, titles, tags, entities, prompts, document-chat messages, summaries, classifications, Generated Output and file relationships. |
| Subscription and billing data | Plan, seats, billing address, VAT information, invoices, payment status, transaction references and limited payment-provider information (for example the last four digits of a card and the card type). Airhive does not store full card details. |
| Technical and security data | IP address, device, browser, operating system, session identifiers, login events, access logs, security events, error logs, performance data and abuse indicators. |
| AI and connector data | AI Feature settings, consent status, shared scope, files read, prompts, instruction versions, Generated Output, confidence data, connector identifiers, access tokens in encrypted form, revocation events and related logs. |
| Source and import data | Email-in addresses, connected-folder identifiers, file-source information, synchronisation records and import status. |
| Communications | Support requests, feedback, legal notices, security reports, marketing preferences and records of our responses. |
| Cookie and device-storage data | Cookies, local storage, session storage and similar technologies described in the Cookie Policy. |
4. Sources of personal data and whether you must provide it
We obtain personal data directly from you, from a Customer or Workspace Administrator that invites you, from your device and browser, from Connected Services you authorise, from payment providers, and from files or messages you or another authorised person submit to the Service.
Providing your name, email address and a password is necessary to create an Account; providing billing details is necessary to purchase a paid Plan. Without this data, Airhive cannot conclude or perform the contract with you. All other data is provided voluntarily; where you do not provide it, the related optional function (for example a Connected Service, an avatar or marketing communications) is not available.
Customer Content may contain personal data about people who do not directly interact with Airhive. In that case, the Customer is responsible for providing any required notice and establishing a lawful basis. Airhive processes that data under the DPA and the Customer's instructions.
5. Purposes and legal bases
| Purpose | Examples | Legal basis |
|---|---|---|
| Account creation and authentication | Create and administer Accounts; authenticate users; recover access. | Contract, Article 6(1)(b) GDPR; legitimate interests in secure access, Article 6(1)(f). |
| Provide Workspaces and document services | Upload, storage, indexing, search, Hives, sharing, collaboration, export and deletion. | Contract, Article 6(1)(b); for Customer Content, Customer instructions under the DPA. |
| AI Features | OCR, classification, naming, entity and tag extraction, document chat, summaries, suggestions, review and lifecycle functions. | Contract, Article 6(1)(b); Customer instructions under the DPA; consent where a specific optional feature legally requires it. |
| External connectors | Connect selected files or Workspaces to a user-selected AI, storage or workflow provider. | Contract and user instruction, Article 6(1)(b); consent where required for optional access or device technologies. |
| Billing and subscription management | Process payments, invoices, taxes, renewals, refunds and failed payments. | Contract, Article 6(1)(b); legal obligation, Article 6(1)(c). |
| Security, fraud and abuse prevention | Access controls, logs, anomaly detection, rate limits, incident response, enforcement and illegal-content handling. | Legitimate interests, Article 6(1)(f); legal obligation where applicable, Article 6(1)(c). |
| Product operation | Troubleshooting, aggregate usage statistics, capacity planning and feature performance measured on aggregated data. | Legitimate interests, Article 6(1)(f); consent where a particular technology requires it (see Cookie Policy). |
| Support and communications | Respond to enquiries; send service, security, billing and legal messages. | Contract, Article 6(1)(b); legitimate interests, Article 6(1)(f). |
| Marketing | Send product news or offers. | Consent, Article 6(1)(a); or, for existing customers, legitimate interests, Article 6(1)(f), under the conditions of § 7(3) of the German Act against Unfair Competition (UWG): we obtained your email address in connection with the sale of a service, we use it only for direct advertising of our own similar services, you have not objected, and you were clearly informed when the address was collected and are informed in every message that you can object at any time free of charge. |
| Legal compliance and claims | Comply with authorities, preserve records, establish, exercise or defend legal claims. | Legal obligation, Article 6(1)(c); legitimate interests, Article 6(1)(f). |
Where we rely on legitimate interests, those interests are operating a secure and commercially sustainable service, preventing abuse, understanding product performance, protecting rights and providing appropriate customer support. You may request further information about a specific balancing assessment from privacy@airhive.ai.
6. AI processing inside Airhive
Airhive uses automated and AI-assisted processing to extract text, classify documents, suggest titles and Hives, identify entities, detect duplicates, provide semantic search and document chat, generate summaries and support review or lifecycle workflows.
Depending on the feature, AI processing is performed by Airhive's own systems or by the AI service provider named in the Subprocessors list, acting on Airhive's behalf under contractual confidentiality, security, data-protection and purpose-limitation obligations. All AI processing takes place within the EU/EEA.
No training on Customer Content. Airhive does not use Customer Content to train, fine-tune, evaluate or otherwise improve any artificial-intelligence or machine-learning model, whether Airhive's own or a third party's, and contractually prohibits its subprocessors from doing so. The only exception is a separate, express, opt-in agreement by the Customer for a specifically described purpose, which the Customer may withdraw at any time with effect for the future.
Airhive applies data minimisation, prompt scoping and file-level access restrictions before AI processing, and redaction or pseudonymisation where the feature supports it. These measures reduce risk but do not guarantee that all personal data or confidential information is removed.
Generated Output is assistive and may be wrong. Standard Airhive features do not make decisions producing legal or similarly significant effects concerning individuals solely by automated means. Customers must apply meaningful human review before using output in consequential decisions.
Airhive maintains records of AI access, instruction versions, proposals, confidence information and user decisions, both for security and accountability. Where you interact directly with an AI system (document chat), the interface tells you so, and AI-generated content is marked as such. Further information on the AI models used and their limitations is set out in the AI Transparency Notice at https://airhive.ai/legal/ai-transparency.
7. External AI and other Connected Services
A Customer may optionally connect an external AI assistant, cloud-storage account, email source, identity provider or other Connected Service. When enabled, selected data is transmitted to that third party at the Customer's direction.
A third party connected under the Customer's own account acts as an independent controller or as the Customer's processor under a separate agreement with the Customer. Airhive does not control that provider's retention, model training, access, international transfers or downstream use, except where Airhive has separately appointed it as a subprocessor.
External connectors are disabled until activated by an authorised user. Airhive records activation, access scope, credential or token identifiers, access events, revocation and related security events in order to administer and secure the connector functionality.
8. Recipients of personal data
We disclose personal data to the following recipients where necessary:
- hosting, infrastructure, backup, AI-processing, email, support, monitoring and security providers acting as processors under contract; they are listed in the Subprocessors list;
- payment providers, banks, tax advisers and accounting providers involved in subscriptions and legal recordkeeping;
- Workspace members, invited collaborators, shared-link recipients and Connected Services selected by the Customer;
- professional advisers, auditors, insurers and transaction counterparties subject to appropriate confidentiality;
- courts, authorities, regulators or law enforcement where disclosure is required or lawfully necessary;
- a successor in connection with a merger, restructuring, financing or sale, subject to applicable safeguards.
Airhive does not sell personal data. Airhive does not disclose identifiable Customer Content to data brokers or use it for behavioural advertising.
9. Subprocessors and payment providers
The public Subprocessors list at https://airhive.ai/legal/subprocessors identifies every provider that processes Customer Content or other personal data on Airhive's behalf, stating the provider's legal name and seat, purpose, data categories, processing location and, where relevant, transfer mechanism.
Airhive's payment provider (Mollie B.V., Amsterdam, Netherlands) acts partly as Airhive's processor and partly as an independent controller for fraud prevention, anti-money-laundering, payment-network and legal compliance purposes. Its own privacy notice applies to that independent processing.
10. Where data is processed and international transfers
Airhive hosts and processes Customer Content, Account and profile data, Workspace data, billing data, AI and connector data, and technical and security data on servers located in the European Union (Germany, and Luxembourg for backups) operated by the providers named in the Subprocessors list.
As at the effective date of this Policy, no personal data is transferred to a country outside the EU/EEA, and no provider outside the EU/EEA has access to personal data. Should Airhive in future engage a provider established outside the EU/EEA, or grant access from outside the EU/EEA, Airhive will first ensure an appropriate transfer mechanism — an adequacy decision of the European Commission or the European Commission's Standard Contractual Clauses together with supplementary measures where required — and will update the Subprocessors list with at least 30 days' notice to Customers subject to the DPA. You may request a copy of the safeguards from privacy@airhive.ai.
11. Cookies, local storage and analytics
Airhive uses cookies, local storage, session storage and similar technologies as described in the Cookie Policy. Technologies strictly necessary to provide a service you have requested are used without consent (§ 25(2) TDDDG). Non-essential analytics, advertising, heatmap or tracking technologies are used only after you have given consent, which you can withdraw at any time in the cookie settings.
12. Security and confidentiality
Airhive applies the technical and organisational measures described in Annex 2 of the DPA, including encryption in transit (TLS 1.2 or higher) and at rest, authentication with multi-factor authentication available to every user, role-based and least-privilege access, workspace separation, logging, backup and restoration, vulnerability management, supplier controls and incident response.
No system can guarantee absolute security. Users must protect credentials, devices, upload addresses and sharing settings and promptly report suspected compromise to security@airhive.ai.
13. Retention and deletion
| Data category | Retention |
|---|---|
| Account and profile data | For the duration of the Account; deleted within 30 days after Account deletion, except for data subject to a statutory retention period or needed to establish, exercise or defend legal claims (retained until expiry of the relevant limitation period, at most three years after the end of the year of Account deletion). |
| Customer Content | Until deletion by the Customer or termination, followed by deletion from production systems within 30 days. Encrypted backup copies are overwritten within the backup rotation cycle of at most 35 days after production deletion. |
| Workspace audit and AI logs | For the retention period configured for the Plan (shown in the Workspace settings); at most for as long as the Workspace exists plus 30 days, unless required for an open security investigation or legal claim. |
| Billing, tax and accounting data | For the statutory retention periods under German commercial and tax law (currently 8 years for accounting records and 10 years for invoices, § 257 HGB, § 147 AO). |
| Support communications | For as long as needed to resolve the request and for three years after the end of the year in which the request was closed, to establish or defend claims. |
| Security logs | 90 days, unless a specific log entry is needed for an ongoing security investigation or legal claim. |
| Marketing preferences | Until withdrawal or objection; a suppression record (email address only) is retained thereafter to respect your choice. |
Airhive may retain limited data where required by law, necessary to establish or defend claims, required to prevent fraud or needed to document deletion. Retained data is restricted to the relevant purpose.
14. Data subject rights
Under the GDPR you have the right to access your personal data (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20), to object (Article 21), and to withdraw a consent at any time with effect for the future (Article 7(3)).
You may object at any time to processing based on legitimate interests for reasons relating to your particular situation; we will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to direct marketing at any time without giving reasons, and we will stop it.
To exercise rights concerning Account data, contact privacy@airhive.ai. If your data appears in Customer Content controlled by an Airhive Customer, Airhive will refer the request to that Customer and assist it under the DPA.
We may request information reasonably necessary to verify identity. Rights may be restricted where an exemption applies, including protection of other persons, legal privilege, security or legal claims.
15. Complaints and supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA Member State of your habitual residence, place of work or the alleged infringement. The supervisory authority competent for Airhive is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, https://datenschutz-hamburg.de, mailbox@datenschutz-hamburg.de.
We encourage you to contact privacy@airhive.ai first so that we can address the issue, but this does not affect your right to complain directly to an authority.
16. Children and sensitive information
Airhive does not offer paid Plans to persons under 18. Individuals aged 16 or 17 may use a free Plan only with the consent of a parent or legal guardian, and Airhive does not knowingly process personal data of persons under 16. If you believe that a person under 16 has created an Account, contact privacy@airhive.ai and we will delete it.
Customers must not upload children's data, special-category data, criminal-offence data or other highly sensitive information unless they have a lawful basis, appropriate safeguards and have confirmed that the selected Plan and configuration are suitable.
17. Automated decision-making
Airhive uses automation to organise and assist with documents. Airhive does not make decisions about individuals that produce legal or similarly significant effects solely by automated means (Article 22 GDPR). If this changes, Airhive will provide the information and safeguards required by law before doing so.
18. Changes to this Policy
We may update this Policy to reflect changes in law, providers, products or data practices. Material changes will be notified through the Service or by email at least 30 days before they take effect. The version number and effective date are shown at the top of this Policy, and previous versions are available on request from privacy@airhive.ai.
19. Contact
Privacy enquiries and data-subject requests: privacy@airhive.ai
Security incidents: security@airhive.ai | General legal contact: legal@airhive.ai