01Who we are
No ad networks, no data brokers, no third parties beyond the ones named on this page.
hfs2s is a hosted build surface operated by Les, trading as hfs2s. We are the data controller for everything described on this page — meaning we decide what is collected and why, and we are accountable for it.
Write to [email protected] about anything here. A real person reads that address.
We are established in Spain and your data is processed in the European Union. We are therefore subject to the EU General Data Protection Regulation and to Spanish data protection law, and our supervisory authority is the Agencia Española de Protección de Datos (AEPD). The compliance page sets out that position in full.
02What we collect
Because you asked for access
The waitlist really is just an address and a timestamp. We do not log your IP with it.
- Your email address and the time you submitted it.
- If you sign in with Google: your email address and name, as Google gives them to us. Nothing else from your Google account — no contacts, no calendar, no Drive.
- Whether your account is approved, your role, and the date we first saw you.
- An optional short note from us to you, if an operator has left one on your account.
Because you are building something
This is the sensitive part. Anything you paste into chat is stored — so treat it like a document, not a conversation that vanishes.
- Everything you type into the chat with your workspace agent, and everything it replies. This is stored as a session transcript.
- Your onboarding brief: the form you filled in, any PRD or document you uploaded, and the questions and plan generated from it.
- Every file you upload — documents, images, archives, mailboxes — and every file the agent writes.
- The source code of your app and its version history, which is a real git repository we keep on your behalf.
- The name you give your workspace, and its technical record: an id and the dates it was created and last used.
Because we have to run the thing
- An activity log — an append-only record of what happened to your account: signing in, a link being sent, a workspace created or restarted, a version saved, a build starting and finishing, an operator making a change. It records the act, not the content: never a token, never a sign-in URL, never the body of a message.
- A mail log of messages we sent you: address, subject line and whether it was delivered. Never the body — email bodies here can contain a sign-in link, and a log is not a place to leave one lying around.
- Error reports when something breaks.
- Your IP address, held briefly to rate-limit the public signup form. It is never stored and never associated with your account.
We measure the service, not you. There is no analytics product on this site at all.
We also record how hard the service is working, so we can tell when it is under strain. That is operational telemetry. It contains no personal data and is not linked to any account.
There is no analytics on this site. No Google Analytics, no advertising pixels, no session recording, no heatmaps, no third-party scripts of any kind on our public pages. We do not sell personal data, we do not share it for advertising, and we do not profile you or make automated decisions about you that have legal effects.
03Why, and on what legal basis
| What we do | Legal basis (GDPR Art. 6) |
|---|---|
| Run your workspace, store your app, answer your messages | Performance of a contract — 6(1)(b) |
| Take your waitlist request and decide on access | Steps prior to entering a contract — 6(1)(b) |
| Send you sign-in links and service email about your app | Performance of a contract — 6(1)(b) |
| Keep the activity log, rate-limit signup, keep the service secure and prevent abuse | Legitimate interests — 6(1)(f) |
| Keep records we need to demonstrate we complied with the law | Legal obligation — 6(1)(c) |
GDPR makes us name a lawful basis for each use. These are ours.
Where we rely on legitimate interests, we have weighed our interest in a service that stays up and is not abused against your interest in not being recorded unnecessarily. That is why the activity log stores acts rather than contents, and why the signup rate-limiter never writes your IP address down. You can object to processing on this basis — see your rights.
We do not ask for special category data (health, beliefs, biometrics, and so on) and you should not put it into a brief, a chat message or an upload. If you do, you are supplying it on your own initiative and we have no lawful basis prepared for it.
04What the AI agent sees
The agent that builds your app is not run by us. Your chat messages, your brief, your uploaded documents and your app's code are sent to MiniMax, an AI provider outside the European Economic Area, because that is the model doing the work.
The same is true of the questions and the plan produced during onboarding, and of any image you ask us to generate.
If you would not email it to a supplier, do not paste it into the chat box.
This is unavoidable in a product whose entire function is an AI building software for you, but it should not be a surprise, so it is stated plainly rather than buried in a subprocessor list. Practically: do not paste customer databases, passwords, payment card details, health records or anything else you are not free to disclose to a third-party AI provider into your workspace.
Where we build the first version of an app for you, the brief you wrote is also given to an in-house engineering assistant of ours, which is backed by Anthropic's Claude models.
Your workspace is isolated from every other customer's, and from our own systems and credentials — see security.
05Your app is public
Not secret, but not listed either. Anyone with the link can open it; nobody can guess it.
Apps built on hfs2s are served at hfs2s.app/app/<id>/ and that
address is deliberately shareable — showing someone the thing you
built is most of the point. It is not indexed and the id is not guessable, but it
is not protected by a password either: anyone who has the link can open
your app.
So whatever your app displays, it displays to the public. If you put personal data into the app you are building, you become a controller of that data yourself and the responsibility for it is yours. Your workspace, your chat and your files are not public — only the running app is.
06Who else processes it
We use a small number of providers to run the service. Each one gets only what it needs to do its job.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| MiniMax | The AI model behind your workspace agent, the onboarding questions and plan, and image generation | Your chat messages, brief, uploaded document text and app code | Outside the EEA |
| Anthropic | The model behind our in-house engineering assistant, used when we build your first version | Your brief and the code being written from it | United States |
| Optional sign-in with a Google account | Your email address and name, at the moment you sign in | United States | |
| Resend | Delivers our email — sign-in links, and notice that your app is ready | Your email address and the message itself | United States |
| Cloudflare | DNS, TLS and network delivery | Traffic in transit and its metadata, including your IP address | Global edge network |
Everything else — your account, your workspace, your files, your app, the logs — is held in Spain, within the European Union. No third party beyond those listed above holds a copy.
We may also disclose data if the law requires it, or to establish or defend a legal claim. If we are ever compelled to hand something over, we will tell you unless we are legally prohibited from doing so.
07Leaving the EEA
Your data rests in Spain. It travels when the AI has to think about it.
Your data is stored in Spain. Some of it is transmitted outside the European Economic Area in the course of being processed — to MiniMax for the model that builds your app, and to Anthropic, Google, Resend and Cloudflare for the roles listed above.
Transfers to the United States rely on the EU–US Data Privacy Framework where the provider participates in it, and otherwise on the European Commission's Standard Contractual Clauses. For providers outside both, the transfer is made under Standard Contractual Clauses or, failing that, on the basis that it is necessary for the performance of our contract with you under GDPR Art. 49(1)(b) — because without sending your request to a model, there is no product.
Formalising this paperwork — signed data processing agreements and Standard Contractual Clauses with every provider above — is work in progress and is not finished. We would rather say so than imply a completeness we have not reached. Ask us where it stands at any time.
09How long we keep it
| What | Kept for |
|---|---|
| Waitlist entry | Until your account is created, or until you ask us to remove it |
| Account record | As long as you have an account |
| Workspace, app code, files, chat transcript | As long as the workspace exists. Destroyed with it |
| Activity log | Rolling — the current file plus one previous, then overwritten. A minimal line survives account deletion, see below |
| Mail log | Rolling, on the same basis. Addresses and subjects only |
| Error log | Rolling |
| Signup IP address | About one minute, then discarded. Never stored |
| Session cookie | 30 days, or until you sign out |
An idle workspace sleeps. Sleeping is not deleting — your files are exactly where you left them.
A workspace left inactive for a while is put to sleep to free up capacity. Nothing is deleted when this happens and it wakes in a few seconds when you come back.
10Your rights
Under the GDPR you have the right to:
- Access — get a copy of what we hold about you.
- Rectification — have anything inaccurate corrected.
- Erasure — have it deleted, subject to the note below.
- Restriction — have us stop processing it while a dispute is resolved.
- Portability — receive your data in a machine-readable form, or have it sent elsewhere. Your app's code is a git repository and we will hand you the whole thing.
- Object — to processing based on legitimate interests.
- Withdraw consent — where we relied on consent, at any time, without affecting what came before.
Ask, and we do it. There is no form and no ticketing system.
Email [email protected]. We will respond within one month, as the GDPR requires, and usually much sooner. We will not charge you, and we will not ask you to justify the request.
If you are not satisfied with how we handle it, you can complain to the Agencia Española de Protección de Datos at aepd.es, or to the supervisory authority in the EU country where you live or work. We would rather you came to us first, but you do not have to.
11Deleting your account
Ask at [email protected] and we will delete your account. Deletion is currently done by us on request rather than by a button you press yourself.
What is destroyed: your account record, your waitlist entry, and every workspace you hold, together with its storage — which means your app's code, its version history, your uploaded files and your chat transcript. This is irreversible and there is no backup to restore from.
Copy anything you want to keep out before you ask. There is no undo and no backup.
What survives, and why: a single line in the append-only activity log recording that an account was deleted, when, and by whom. A deletion that erased its own evidence would make our most destructive action our least accountable one. We keep it under GDPR Art. 17(3)(b) and Art. 6(1)(c) — the accountability records we are obliged to be able to produce. It contains your email address, the act, and the timestamp. Nothing else. Records of work done for you — engagements, help requests — also survive, and they name an address that no longer resolves to anything.
12Security
Traffic is encrypted in transit. Sessions are held in a cryptographically sealed,
HttpOnly, Secure cookie that JavaScript cannot read. Every
route that touches a workspace re-checks that it is yours, and returns exactly the
same "not found" whether a workspace is not yours or does not exist — so the system
cannot be used to discover who owns what.
Every workspace is sealed off from every other. Nothing you build can reach anyone else's.
Each workspace runs in its own isolated environment with its own storage, and our credentials are never made available inside one. Secrets never appear in a log line.
The full list of measures, and an honest list of what we have not done, is on the compliance page.
Breaches. If personal data is breached in a way that risks your rights, we will notify the AEPD within 72 hours as GDPR Art. 33 requires, and tell you directly without undue delay where Art. 34 requires it.
Found a vulnerability? Email [email protected]. We will not pursue you for reporting something you found in good faith and did not exploit.
13Children
hfs2s is not for children. You must be at least 18 to hold an account. We do not knowingly collect data from children, and if we learn we have, we will delete it. Tell us at [email protected].
14Changes
We will update this page when the product changes. The effective date and version at the top always say which text you are reading. If a change materially affects your rights, we will email you about it rather than quietly reposting the page.
Questions about any of it: [email protected].