Privacy Policy

Who we are

House of AI is a coworking space and event venue at 40 Boardman Pl., San Francisco, CA 94103. We are the data controller for the information described here.

Our Hamburg location is operated separately by Wunder Mobility GmbH — see their Impressum. We do not share member, host or enquiry records between the two operations.

What we collect

We collect information in five situations, and nothing beyond what those situations need.

When you enquire about hosting an event

Our enquiry form asks for your name, company, email address, phone number, and details about the event you are planning — the date, expected number of guests, seating and catering preferences, budget, and anything else you choose to tell us. You give us this deliberately; we do not infer it.

When you become a member or book an event

We keep your contact details, the terms of your membership or booking, the agreement you signed, and a record of invoices and payments. We need this to run the booking and to keep proper accounts.

Contracts are signed electronically. The signature record includes your name, email address, IP address and the time you signed — this is what makes the signature verifiable.

Card and bank payments are processed by Intuit (QuickBooks Payments). We do not receive or store full card numbers.

When you visit this website

Our hosting provider records standard technical information such as IP address, browser type and pages requested, in server logs. We do not use advertising cookies or third-party tracking pixels on this site.

When you come to the building

We operate CCTV cameras covering entrances and communal areas, for the security of the building and the people in it. They record audio as well as video. Cameras are signposted at the entrance. Recordings are not monitored in real time, are accessible only to House of AI owners and the building manager, and are overwritten on a rolling basis. We do not use facial recognition, voice identification or any other biometric analysis.

When we photograph an event

We sometimes photograph events for our own marketing. Where images identify individuals we will tell you before the event and, where required, seek consent. If you appear in a photograph and want it removed, email us and we will take it down.

Dietary, accessibility and similar details

Some things you tell us in an enquiry can reveal sensitive information about you or your guests — a halal or kosher catering request, a food allergy, a mobility or accessibility requirement.

Where you give us these details, we use them only to run your event, we share them only with the caterer or supplier who needs them, and we delete them once the event is complete and any related invoice is settled. We do not build profiles from them and we do not use them for anything else.

Apart from this, we do not collect special categories of data such as health or biometric information.

Children

This website and our services are directed at businesses and adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we will delete it.

Why we use it

• To answer your enquiry and prepare a proposal
• To arrange, run and staff your event or membership
• To order catering, furniture and supplies for your event
• To send agreements for signature
• To raise invoices, take payment and keep our accounts
• To keep the building and the people in it secure
• To meet our legal, tax and accounting obligations

Where the GDPR or UK GDPR applies to you, our legal bases are:

Where we rely on legitimate interests, we have balanced those interests against your rights, and you can object at any time.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it to make automated decisions that produce legal or similarly significant effects.

Our internal admin system

We run an internal operations tool at admin.house-of.ai that holds our event pipeline, member records, supplier orders and invoices. It is used only by House of AI staff. It is not open to the public, and there are no customer accounts on it.

Access requires a signed-in staff account and is limited by role — for example, financial records are visible only to owners. Actions that change records are written to an audit log.

That tool connects to our own QuickBooks company so that we can create and send invoices. In practice it reads and writes only customer and invoice records. The connection itself is authorised through Intuit's standard accounting permission, which is broader than that — we have limited the tool to the records above by how we have built it, not by the permission Intuit grants. The credential is encrypted before it is stored and is never exposed to the browser.

Who we share it with

We use service providers to run parts of our operation. Each receives only what it needs to perform its function, and none of them may use your information for their own purposes.

• Accounting and payments — Intuit (QuickBooks). Receives name, email address, invoice details and payment information so that we can bill you and keep our books.
• Hosting and database — for this website and our admin system. Receives enquiry, booking and invoice records, and technical log data.
• Email — for proposals, invoices and booking correspondence. Receives name, email address and message content.
• Agreements and electronic signature — receives name, email address, company and agreement terms.
• Document generation — for event proposals. Receives name, company and event details.
• Caterers and equipment suppliers — receive guest numbers and any dietary or accessibility requirements for your event.

You can ask us at any time which specific providers we use and we will tell you.

We may also disclose information where the law requires it, or to establish or defend a legal claim. If we receive a law enforcement request we will tell you unless we are legally prohibited from doing so.

If we sell or transfer the business, records may pass to the buyer. We will tell you before that happens.

Where it is held

Our providers store data in the United States. If you contact us from outside the US, your information will be transferred there.

Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on one of the following:

• the EU–US Data Privacy Framework and its UK Extension, where the provider is certified — you can check any provider's current status on the official list at dataprivacyframework.gov; or
• the European Commission's Standard Contractual Clauses (2021), with the UK Addendum where the UK GDPR applies.

You can ask us which mechanism applies to a particular provider, and we will tell you.

How long we keep things

We keep personal information for as long as we need it for the purposes described above, and for as long as the law requires us to. In practice that means:

• Enquiry records, for as long as the enquiry is live and a reasonable period afterwards in case you come back to us
• Booking, membership, invoice and payment records, for as long as tax and accounting law requires — generally seven years
• Dietary and accessibility details, only until the event is complete and settled
• CCTV footage, on a short rolling cycle before it is overwritten
• Event photographs, until we stop using them or you ask us to remove them

You can ask us at any time to delete information we hold about you. Where we cannot — because a record is required for tax purposes or is subject to a legal hold — we will tell you and explain why.

How we protect it

• Traffic to this site and our admin system is encrypted in transit
• Admin access requires a signed-in staff account, with permissions by role
• Credentials for connected services are encrypted before storage and are not exposed to the browser
• Changes to records are written to an audit log
• CCTV footage is accessible only to House of AI owners and the building manager

No system is perfectly secure, and we will not claim otherwise. If a breach affects your information we will tell you and the relevant authorities as the law requires.

Your rights

You can ask us to:

• show you the personal information we hold about you, and tell you where we got it and who we have shared it with
• correct it if it is wrong
• delete it
• stop using it for a particular purpose, or object to our use of it
• send you a copy in a portable format, or send it to someone else
• withdraw consent you have given, at any time — this does not affect anything we did before you withdrew it

If you are in California, the CCPA as amended by the CPRA gives you the right to know what we collect, to delete it, to correct it, to limit our use of sensitive personal information, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in the CCPA, so we do not offer a "Do Not Sell or Share My Personal Information" link.

If you are in the EEA, the UK or Switzerland, you also have the right to complain to your data protection supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk).

How to make a request

Email christian@house-of.ai.

We will acknowledge your request within 10 business days and respond within 45 calendar days. If the request is complex we may extend this by a further 45 days, and we will tell you why before we do.

Before we act, we need to be confident you are who you say you are. For most requests we will ask you to reply from the email address we hold for you and to confirm details already in our records. We will not ask you for a password or for financial information, and we will not create a new record about you just to verify a request.

An authorised agent may make a request on your behalf if they provide written permission signed by you. We may still contact you directly to confirm.

Some information cannot be deleted on request — an invoice we are required to keep for tax purposes, for example. Where that applies we will say so and explain why.

Do Not Track and Global Privacy Control

There is no common industry standard for how websites should respond to browser "Do Not Track" signals, and this site does not respond to them. We do not track visitors across other websites, so there is no cross-site activity for such a signal to switch off.

We honour Global Privacy Control signals. Because we do not sell or share personal information, a GPC signal does not change how we handle your data.

Changes to this policy

If we change how we handle personal information we will update this page and change the date at the top. Material changes affecting current members or hosts will be notified by email.