Last updated
July 2026
Roles
For project data processed on a deployment, the customer is the controller and Hecato AI is the processor, acting on documented instructions under the agreement. For enquiries made through this website, Hecato AI is the controller and the privacy policy applies.
Categories of data
Deployments process the bid package: drawings, specifications, scope documents, addenda, bid instructions and proposed contract terms. These documents incidentally contain personal data, typically the names and roles of estimating, commercial and project staff named within them, and it is handled under the same terms as the rest of the package.
Instructions and use
Hecato processes project data only on the customer's documented instructions and for the purposes set out in the agreement. Specifically:
- Project data is not used to train models for other customers.
- Project data is not accessed by Hecato staff except as needed to provide support under agreed procedures.
- Outputs are generated only for the customer whose data is being processed.
Sub-processors
We use a small number of infrastructure sub-processors. The current list, with purpose and location for each, is provided during procurement and on request at hello@hecato.ai, and the agreement sets the notice period for changes. Where flow-down restrictions on a project limit which sub-processors may touch the data, the deployment is scoped to comply before any record is shared.
Location and residency
Hosting region is agreed at deployment against any restrictions that apply to the bid documents. Where data classification prohibits an external processor entirely, Hecato is deployed inside the customer's own environment.
Security
Access is permissioned by role and by bid. Output is source linked, so every finding traces to the document, page and section it came from. Technical and organizational measures are set out in the agreement, and the security page on this site describes the posture in plain terms, including what we do not claim.
Deletion and exit
On termination, bid data is returned in an agreed format and then deleted on the timescale set in the agreement, with deletion confirmed in writing on request.
Contact
Procurement and data protection questions go to hello@hecato.ai.