Legal & Trust Center

This is the canonical home for the agreements, policies, and notices that govern the Hanzo Services. Every Hanzo surface — the Console, cloud, API documentation, and signup — links to these documents at hanzo.ai/legal/<name> rather than restating them, so there is one authoritative version of each.

Status: draft, pending counsel. The documents below are complete drafts written to be truthful about what the platform does today. They are not yet effective. Each carries a publication gate listing what must be verified — entity address, mailboxes, retention jobs, subprocessor rows, consent pipeline — before it is published as binding. See the internal implementation checklist for the engineering gates behind these commitments.

Agreements

• Terms of Service — the master agreement for all Services, including Enso routing, benchmarks, research, agents, and APIs.
• Data Processing Addendum — processor terms, SCCs, subprocessor governance, and security measures for business customers.

Policies

• Privacy Policy — what personal data we process, why, and the four data-use states that govern research and training.
• Acceptable Use Policy — the conduct rules for every user, application, and agent.
• AI Research and Data Contribution Terms — the opt-in terms for using your data in Hanzo research and training, and the Verified Commons.
• Consumer Health Data Privacy Policy — our posture under Washington's My Health My Data Act and similar laws.

Notices and registers

• Research API Supplemental Terms — terms for the /v1/research registry, evidence integrity, and durability states.
• Subprocessor Register — the providers that process data on your behalf, including the Enso routing chain.
• Cookie Notice — cookies and similar technologies, and how to control them.
• Biometric, Voice, and Likeness Notice — how features that process faces, voices, or likeness are governed.

How these fit together

The Terms of Service is the spine; it incorporates the Acceptable Use Policy, Privacy Policy, DPA, and — only on an affirmative election — the AI Research and Data Contribution Terms. The Privacy Policy defines four data-use states (service-only by default, then private improvement, research and training, and public commons); no data is used for training without an affirmative election, and none is published without a separate per-artifact contribution. The Subprocessor Register names every provider a request can reach, including model providers behind an inference gateway. The remaining notices cover cookies, biometric/voice/likeness, consumer health, and the research registry.

Contact

• Legal notices: [email protected]
• Privacy requests: [email protected]
• Security reports: [email protected]
• Abuse reports: [email protected]