Privacy Notice

Last updated: 2 May 2026

This translation is provided for convenience. The English version is canonical for legal interpretation.

This notice covers what data Habibi Crew collects, why, where it's processed, and your rights — including under Japan's APPI (個人情報の保護に関する法律).

What we collect

• Account identity: your Whop user id, display name, and email (the latter only if you grant the email scope).
• Profile data: target airlines, experience level, languages, focus areas you provide during onboarding.
• Training content: messages you send, AI responses, attempt scores, and (from Sprint 2) journal entries and stories.
• Usage telemetry: per-call token counts, costs, and time-on-platform metrics for billing reconciliation and capacity planning.
• Abuse signals: when our automated detection flags potential abuse (jailbreak attempts, prompt-leak attempts, replay), we record the matched pattern and a redacted excerpt.

Sub-processors (where your data goes)

To provide AI training, your conversations and uploaded text are sent to:

• OpenRouter (gateway) — routes our model calls to one of the providers below.
• Anthropic (default chat + judge models).
• OpenAI (occasionally, for cheap classifier paths).

These providers retain logs per their published policies. Anthropic and OpenAI do not train on our API traffic. We will update this list if we add or remove providers; check this page or your in-app settings for the current list.

Where data is stored

User profile data, attempts, and messages are stored in Cloudflare D1 and R2 (object storage) in Cloudflare's global infrastructure. Data may be processed in regions outside Japan; we don't currently offer JP-region-only storage. If this is a hard requirement for you, please contact us before subscribing.

Admin access

Members of the Habibi Crew team can view your transcripts for support and quality purposes. Every admin view of your transcripts is logged and surfaced to you in Settings → Privacy in a future sprint. If you'd like a list now, contact us.

Retention

• Messages and attempts: 90 days after account closure, then deleted.
• Voice recordings (when introduced): 30 days, opt-in only.
• Photos (when introduced): 30 days, opt-in only, separately deletable.
• Billing / financial records (cost ledger): retained 7 years per Japanese tax law.

Your rights (APPI / GDPR)

You have the right to:

• Access and correct your data.
• Request deletion of your data.
• Withdraw consent for AI memory features at any time (Settings → Privacy).
• Receive an export of your data.

Export and one-click delete arrive in Sprint 3. In the meantime, email us and we'll process the request manually within 14 days.

Contact

Questions about this notice or your data: habibicrewai@gmail.com (placeholder — update before launch).