Website and accounts
Privacy notice
This notice describes the public website and currently available account features. BloodHound assessment-specific data practices will be documented before those workflows launch.
Updated · Text version
Website ownership and acceptable use
We store the website origin linked to your account, its public proof code, code expiry, verification and expiry timestamps, and the date and version of the acceptable use policy you accepted. This lets us restrict Mini Hound to your verified website. A proof code is generated using 128 random bytes (256 hexadecimal characters); it is public verification material, not a login credential.
We fetch the public verification page you submit, with strict destination, size and time limits. Verification lasts 30 days. Starting a new proof replaces the prior website record. Verification records are retained with your account and removed when the account is deleted; infrastructure backups may follow separate retention processes.
Mini Hound messages and source
Voice input is optional. If you use it, your browser handles speech recognition; availability and processing depend on your browser and its speech service.
Mini Hound sends your message, attached text and the public source needed for the answer to the configured AI provider: Google Cloud for the enabled Gemini routes, or Inception Labs for the legacy Mercury route. Do not send passwords, API keys, confidential code or personal data. Our hosting and AI providers process requests under their own terms; we do not promise that their operational logs have zero retention.
New conversations and messages are saved to your private cloud account for cross-device access. We also retain target registrations, scan history, candidate findings, verification decisions and limited recovery state. Structured records use our private PostgreSQL database; source artifacts and checkpoints use private encrypted AWS S3 storage in the United States. Older browser chats are not uploaded unless you choose Import browser chats to cloud. Imported text is marked as unverified historical material.
Abuse-prevention counters expire after two days. Legacy monthly counters expire after 35 days and no longer limit scans. Token accounting stores usage totals, model identifiers, reservations and reset timestamps without message text. Token records remain until account deletion. Requests must be limited to public sites you own or have permission to review.
Who operates this website?
WarHoundAI operates warhoundai.com. The company is based in Nehtaur, Uttar Pradesh, India, and is led by Founder & CEO Rajauddin Karimulla. Privacy questions can be sent to founder@warhoundai.com.
Information we collect
- Account details: name, email address, a salted password hash, email-verification and reset records, and session information.
- Workspace information: project names and target URLs you save, and encrypted credentials if you choose to save them through the account workflow. Saving a URL does not run a security scan.
- Website analytics: page path, IP address, approximate country/city, browser and device information, referrer hostname, visit time, and a random visitor identifier. The analytics collector strips URL query strings and fragments.
- Security and operations information: limited authentication, rate-limit, and administrative activity records used to protect and operate the service.
- Messages you choose to send by email, including information needed to respond to support or privacy requests.
Account and resource analytics
When analytics is enabled, we record public signup-button clicks and resource downloads using a random visitor identifier and the public source page. The backend records new account creation and first email verification once, excluding administrators and known bots. A private account identifier connects those two stages; it is not returned in the acquisition report. Marketing events do not contain email addresses, passwords, verification codes, project targets or review notes.
Attribution uses the last observed external referrer within seven days. Direct, missing and unavailable attribution are reported as unknown; counts are approximate and are not a claim of an exact causal link to a search or AI answer. These analytics records are retained for up to 90 days, are restricted to administrators and respect Do Not Track and Global Privacy Control. If an opted-out signup was not recorded, later verification does not recreate that missing marketing history.
How we use information
We use account and workspace data to provide sign-in, verify email addresses, support password recovery, save account information, and restrict private records to authorized users. We use security records to limit abuse and investigate operational issues. Website analytics helps us understand visits and device usage.
We do not run third-party advertising trackers in the website implementation or use the website previews to send your target to an AI assessment provider. The product previews are illustrative. Do not include confidential information in a public product inquiry.
Service providers and processing
The website uses Vercel for hosting and server functions, Supabase as its database infrastructure, and Hostinger for account email delivery and the company mailbox. These providers process information needed to perform their services. Provider infrastructure may process or store data outside your country.
Mini Hound uses Google Cloud-hosted Gemini inference when the Gemini routes are enabled. The legacy Mercury route uses Inception Labs. Current per-account model routing is shown inside Mini Hound. Relevant conversation context and collected source may be sent to that provider through our server functions. Do not submit credentials or confidential material. Amazon Web Services stores private evidence and recovery files and hosts the sanitized reusable knowledge index. The index uses an open-source embedding model; it does not train or change the chat model. Reusable discoveries require independent verification, sanitization and approval before global publication.
Retention and deletion
Website visitor analytics and administrative audit records are retained for up to 90 days through scheduled cleanup. Expired email tokens, sessions, verification challenges, and rate-limit records are cleaned up. Account and saved workspace information remain while the account is maintained unless deletion is requested.
Deleting a cloud conversation hides it immediately and cancels its pending work. A scheduled process permanently removes its message bodies, run checkpoints and recovery payloads after 30 days. Target-level finding records remain separate security history. General scan artifacts expire after 90 days; older S3 object versions may persist for up to 30 additional days. Sanitized approved knowledge and source prompt versions are retained as versioned operational references. Contact us to request deletion or correction of account information. We may need to verify the request, and infrastructure backups or legally required records may follow separate retention processes. We have not published a fixed backup-erasure schedule.
Your requests and choices
You can read public product pages without an account. You can use browser privacy signals to opt out of application visitor analytics and clear browser cookies or local storage through your browser settings. Clearing a session cookie signs you out locally.
For access, correction, or deletion requests, contact founder@warhoundai.com from the account email where possible. Do not send passwords, authentication codes, or unmasked API credentials.
Changes to this notice
Effective 19 October 2026. We will update this page as live website features and processing practices change. This notice does not claim a compliance certification or describe unlaunched assessment functionality as already available.