Security & Compliance

Privacy Policy — Hyperloop

Effective: May 1, 2026 · Last updated: September 28, 2026 · Contact: [email protected]

Hyperloop (“we,” “us”) provides an accounts-receivable / cash-application platform (app.hyperloopai.io) that helps businesses match incoming customer payments to their invoices. This policy explains what we collect, how we use and share it, and your choices.

1. Who this applies to

Hyperloop is a B2B service used by businesses (“customers”). This policy covers data we process about our customers, their authorized users, and the financial data our customers connect to the service.

2. Information we collect

Account & user data: name, business email, role, and authentication data for users of the platform.
Financial & accounting data: invoices, customers, and payments our customers sync from their ERP/accounting systems.
Bank transaction data (via Plaid): when a customer connects their business bank account through Plaid, we receive incoming transaction data and account metadata (account name, type, and last-four “mask”) for the purpose of matching payments to invoices. We request read-only access and only the Transactions product; we do not initiate payments or move funds.

3. How we use information

We use the information solely to provide the service: detecting incoming cash, matching payments to open invoices (cash application), collections workflows, reporting, and support. We do not sell personal or financial data, and we do not use platform data for advertising.

Some features use AI: relevant content (such as invoice details and message drafts) is processed by our large-language-model provider (Anthropic) to generate drafts, classifications, and summaries, on a per-customer basis at the time of your request.

To operate, secure, and improve the service, we also create de-identified data (with identifiers removed) and use it, and the models trained on it, to improve the service. We keep it de-identified and do not attempt to re-identify it (other than to verify de-identification). We do not train our models on identified personal or financial data.

4. Bank data and Plaid

We use Plaid Inc. to securely connect to your financial institution. When you link an account, you interact with Plaid’s flow and authorize the connection; your banking credentials are handled by Plaid and are never seen or stored by Hyperloop. Plaid’s handling of your data is governed by Plaid’s own privacy policy (https://plaid.com/legal/#end-user-privacy-policy). We store only an encrypted access token and the transaction/account data needed for cash application.

We share platform data only with sub-processors that help us operate the service, under appropriate contractual protections, limited to what each requires:

Plaid — bank connectivity and transaction data.
DigitalOcean — cloud hosting and infrastructure.
Anthropic — AI features (e.g., collections drafting), where applicable.
Email delivery provider — to send and receive service-related email, such as collections messages and replies, where email is enabled.
Accounting-integration provider — to connect supported accounting/ERP systems, where you enable that integration.

A current list of sub-processors is available on request.

We may also disclose information to comply with law or protect our rights. We do not sell your data. Our website’s analytics and marketing cookies are covered in section 9.

6. Gmail data — Google API Limited Use

If you connect a Google (Gmail) account to send accounts-receivable reminder emails, Hyperloop requests the single send-only scope https://www.googleapis.com/auth/gmail.send (plus openid and email to identify the connected account). Hyperloop’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements:

Send-only access. Hyperloop can only send mail on your behalf. We do not read, list, download, store, or modify any email or other content in your mailbox, and we cannot access your inbox, drafts, labels, or sent history.
Single, user-facing purpose. Gmail access is used only to send accounts-receivable reminder emails on your behalf — from your own connected mailbox, to your own customers — at your direction. It is not used for any other purpose.
No advertising. We do not transfer or use Gmail data for advertising purposes.
No human access. We do not allow humans to read your Gmail data; reminder emails are sent programmatically, and we do not read the mailbox at all.
No AI/ML training. We do not use Gmail data to develop, improve, or train generalized and/or AI/ML models.

You connect and disconnect the Gmail integration at will, and you can revoke Hyperloop’s access at any time from your Google Account permissions page.

7. Security

We use technical and organizational measures appropriate to the risk, including encryption of data in transit and at rest, role-based and least-privilege access controls, per-customer data isolation, and access logging. No method of transmission or storage is completely secure, but we work to protect your information and review our measures over time.

8. Data retention & deletion

We retain data only as long as needed to provide the service and meet legal/ recordkeeping obligations. Raw bank-transaction payloads are automatically purged after 90 days; connections and associated bank data are deleted when you unlink an account or on request/offboarding. See our Data Retention & Deletion Policy.

Account deletion. You may request deletion of your account and all associated data at any time by emailing [email protected] from your account email (or as your organization’s administrator). On a verified request, we permanently delete your organization’s data — customers, invoices, communications, integration tokens, and account records — within 30 days, except where we must retain limited information to comply with law (e.g., tax/financial recordkeeping) or to resolve a dispute. Any residual copies in routine backups are overwritten on our regular backup cycle. Canceling a paid subscription is separate from deletion: cancellation downgrades your account to the free tier and does not by itself erase your data.

9. Your rights & choices

Disconnect: you can unlink a bank connection at any time in the app, which removes the connection and stops data collection.
Access & deletion: you may request access to or deletion of your personal data by contacting [email protected]. We honor applicable privacy-law rights (e.g., CCPA/CPRA) and respond within the timeframe required by law.
Website cookies: hyperloopai.io uses analytics and marketing cookies (Google Analytics, and Google Ads, LinkedIn and Meta to measure our ads and show them to past visitors, which California law may treat as “sharing”). In the US you can opt out at any time; in the EU and UK we set them only if you accept. Change your choice in Your privacy choices. We honor Global Privacy Control.

By connecting a financial account, you consent to the collection, processing, and storage of the associated data as described here and authorize the connection via Plaid.

11. Changes to this policy

We may update this policy; we will revise the “Last updated” date and, for material changes, provide additional notice.

12. Contact

Questions or requests: [email protected], HyperloopAI, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713.