FableHR privacy policy
FableHR is a WebHatch Designs project, Hutchinson, Kansas ("we"). It helps a business keep a record of what its AI agents are allowed to do, what they say they did, and what they say it cost. This policy says what we keep, why, for how long, and who else handles it.
What FableHR's answers are. FableHR's answers to agents are advisory. An agent that skips the check, ignores a "no", or under-reports its cost is not stopped. Spend figures are the agents' own reports, because FableHR cannot read your providers' bills. FableHR keeps cooperative agents within budget and on record. It is not a security boundary against a compromised or prompt-injected agent.
What we keep
| What | Why | How long |
|---|---|---|
| Your company's name, and each owner's email address | To know who may sign in | Until your company leaves FableHR |
| Each agent's name, role, and the name of the person accountable for it, as you type them | To show you your agents | Until your company leaves |
| Agent permissions (action names) and monthly limits | To answer agents' check-ins | Until your company leaves |
| Task titles and due dates, as you type them | To show agents and you their work | Until your company leaves |
| Check-ins: action names, token and cent estimates and reports, outcomes, times | To keep budgets and the record | 13 months (395 days) once settled, then deleted daily. An open check-in is kept until it is reported or expires |
| Monthly totals of tokens and cents for each agent | Budgets and the monthly review | 13 months, then deleted daily |
| The activity log: event names, ids, numbers and times. Never prompts, task titles, keys or codes | Your company's record of what happened | 13 months (395 days), then deleted daily |
| Agent keys, as one-way fingerprints with a short public prefix (we can't read a key back) | To recognise a key, and to show which key did what | A live key until it is revoked. A revoked key 13 months after revocation, then deleted daily |
| Recovery codes, as one-way fingerprints | To recognise a code | Until used, replaced, or your company leaves |
| Your authenticator's secret, encrypted | To check your sign-in codes | Until you replace it or your company leaves |
| Sign-in links and sessions, as fingerprints | To sign you in | Links 15 minutes. A sign-in that hasn't finished its second step lasts 15 minutes; a finished one at most 12 hours, ending after 60 minutes idle. Expired ones are deleted daily |
| Keyed fingerprints of network addresses (an IPv6 /64 counts as one) and email addresses that tried to sign in, or tried an agent key that failed | To slow down guessing | 24 hours |
Please don't put personal information about other people into agent names, task titles or action names beyond what you need. FableHR stores what you type there as you typed it.
What we don't do. No advertising, no tracking scripts, no selling or sharing of your data for marketing. The app has no analytics.
Who else handles it
- Cloudflare, Inc. (United States) runs the application and its database, under Cloudflare's Data Processing Addendum, which forms part of Cloudflare's customer agreement.
- Resend sends the sign-in emails, so it sees the owner's email address and the email's content.
- We don't turn on Workers Logs (the host's request logging) for FableHR.
Your choices
- An owner can revoke any agent's keys, suspend an agent, and export the activity log at any time.
- To have your company deleted, email hello@webhatchdesigns.com. Because a sender address can be forged, we write back to the owner address on record and act only on the answer from that address. We delete the company and every row it owns within 30 days of that answer, and confirm by email. Our host keeps a short point-in-time history of the database, so a deleted company can still be restored from it for up to 7 days, after which it is gone.
Children. FableHR is for businesses, not for children.
Changes. If this policy changes, we'll email each owner before the change takes effect.
Contact. hello@webhatchdesigns.com
Effective date: October 14, 2026.