Hashicorp Discuss
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
HashiCorp collects account, usage, and marketing data, says it does not sell it, and points you to IBM’s policy after the acquisition.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Cookies, IP and logs, account and payment info, plus marketing data from partners.
Read the exact line
Privacy policy
“we may receive and process about you through: the use of our website, products, or support services; attendance of our virtual and in-person events; third party advertising and marketing partners”
Training
They run the site and products, market to you, improve products, and show relevant ads.
Read the exact line
Privacy policy
“To deliver an overall consistent experience, show you relevant ads for our services, and measure our marketing effectiveness”
Sharing
They say they do not sell your data, but share it with providers, ads, and some partners.
Read the exact line
Privacy policy
“Note: We do not rent, sell, or trade your Personal Information.”
Kept
They keep it as long as needed for the original purpose, then delete or it.
Read the exact line
Privacy policy
“We only process and keep any Personal Information for as long as necessary to achieve the purpose for which the information was originally collected.”
Controls
You can manage cookies and request access or deletion at privacy.hashicorp.com.
Read the exact line
Privacy policy
“You may visit privacy.hashicorp.com to initiate the deletion or contact us by emailing privacy@hashicorp.com”
Fine print
Policy can change as soon as it is posted; they are now part of IBM.
Read the exact line
Privacy policy
“Any changes or modifications will be effective immediately upon posting of the updated Privacy Policy.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Manage cookie preferences
Cookie banner or cookie preference center on their websites
or access
privacy.hashicorp.com or privacy@hashicorp.com
Opt out of marketing emails
Contact Us section / marketing opt-out described in the privacy policy
Read IBM’s privacy policy if you are a new IBM customer
IBM’s Privacy Policy, as linked from HashiCorp’s overview
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can buy or receive extra facts about you from other companies and add them to their file.
Read the exact line
Privacy policy
“We may also receive information about you, such as your name, employer, title, general location (e.g., country, state), inferred location, and contact information, from third parties, such as marketing partners”
For example, a marketing partner might tell them your job title and they update your record even if you never typed it.
Other companies can track you across websites using cookies on HashiCorp’s site.
Read the exact line
Privacy policy
“Third parties placing cookies on HashiCorp, an IBM Company’s site, may use these technologies to collect information about your online activities over time and across different services”
For example, an ad company might see you visited HashiCorp and later show you HashiCorp ads on another site.
New rules can apply as soon as they put them on the website, even if you did not get an email.
Read the exact line
Privacy policy
“Any changes or modifications will be effective immediately upon posting of the updated Privacy Policy.”
For example, they could change how they share data today and it would already apply when you next visit.
If the company is sold again, the buyer might use your data in new ways.
Read the exact line
Privacy policy
“You acknowledge that such transfers may occur and that the transferee may process Personal Information in a manner different to that set out in this Privacy Policy.”
For example, after IBM bought HashiCorp they already point you to IBM’s privacy policy for new customers.
Sales calls can be recorded if you agree, so staff can train on them.
Read the exact line
Privacy policy
“Audio and video recording data - For sales team’s training and awareness activities.”
For example, a demo call with a salesperson might be kept and played in internal training.
They say they will not sell your personal information to others.
Read the exact line
Privacy policy
“Note: We do not rent, sell, or trade your Personal Information.”
For example, they claim they will not put your email on a list sold to random buyers.
They describe independent security audits and certifications for their products.
Read the exact line
Privacy policy
“Currently, we have a SOC 2 Type 2 report, ISO 27001, ISO 27017 and ISO 27018 certifications”
For example, a customer can ask for SOC 2 or ISO reports before putting data in HashiCorp Cloud.
They say kids under 13 should not give them personal information, but it is mostly on you to stay away.
Read the exact line
Privacy policy
“We do not knowingly solicit information from or market to children under the age of thirteen (13).”
For example, there is no described ID check; a 12-year-old could still fill a contact form.
You can ask them to delete your personal information through a web form or email.
Read the exact line
Privacy policy
“You may visit privacy.hashicorp.com to initiate the deletion or contact us by emailing privacy@hashicorp.com”
For example, you submit a request at privacy.hashicorp.com and they say they respond within 30 days.
They say they do not make automated decisions about you and will not sell data without consent.
Read the exact line
Privacy policy
“We do not use automatic decision-making or profiling, and will not sell your Personal Information for any purpose without your prior consent.”
For example, they claim they will not auto-deny you a product based on a hidden score.
Words to know
Legal words from the lines above, in plain English.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- profiling
- Building a picture of who you are, what you like and what you might do next from your data. For example, an app may guess your income, health or politics from what you watch and tap.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
How we got here · grade D · score 40/100 · 15 of 15 policy answers backed by a verified quote · 7 not stated
What does the app collect beyond what it needs to work?
They collect account and contact details plus cookies, IP address, browser metadata, logs, and extra marketing data from partners.
Does it record your voice, face or body, and what happens to that?
Sales calls can be recorded with your consent for staff training; you can withdraw consent.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use third-party tags and cookies to show relevant ads and measure marketing.
Do they sell or share your data, and can you opt out?
They say they do not sell data, but share with providers, advertisers, enrichment firms, and some outreach partners; cookies have a preference center.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
They keep data as long as needed; you delete by contacting them or using privacy.hashicorp.com, not a simple in-app wipe with a set deadline.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe SOC 2, ISO certifications, pentests, and a security team.
Is there a real age gate, and are teens protected?
They say they do not seek data from children under 13, with no described age check.
Will they tell you when the rules change, and is the policy specific?
The policy is dated; material changes may get extra notice, but updates take effect as soon as posted.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 6,632 words at a college graduate level (Flesch reading ease 35); the terms are 6,349 words at a professional or legal expert level.
