Privacy Notice
1. About this notice
Hickory & Company ("Hickory & Company," "we," "us") provides AI tools to banks and other financial-services organizations. This Privacy Notice describes the personal information we collect, how we use it, and the rights you may have under applicable privacy laws.
This notice applies to:
- Visitors to our website;
- Employees and authorized users of Hickory & Company's bank-customer organizations who use our products as part of their work;
- Individuals who contact us, apply for employment with us, or otherwise interact with Hickory & Company directly.
If you are an end-customer of a bank that uses Hickory & Company products, the bank is the controller of your personal information. Hickory & Company processes that information only on the bank's instructions, as a service provider. Please consult your bank's privacy notice for information about how your personal information is handled.
2. Who we are and how to contact us
Hickory & Company is the entity responsible for the personal information described in this notice when we act as a controller.
Contact: info@hickory.co · 1 866 697 6985
3. Information we collect
We collect personal information in three contexts:
(a) When you visit our website.
- Device and browser metadata (IP address, user-agent string, referring URL, time of visit);
- Cookies and similar technologies (see §11);
- Information you submit through contact, demo-request, or careers forms (name, work email, employer, role, message).
(b) When you use Hickory & Company products as an authorized user of a bank customer.
- Identity and access information provisioned by your employer (name, work email, role, permissions);
- Authentication metadata (session tokens, sign-in timestamps);
- Activity logs of actions you take in the product (queries, prompts, outputs, audit events);
- Any personal information you submit to our AI tools while doing your work — this content is screened by data-loss-prevention (DLP) controls and held in tenant-isolated storage.
(c) When you apply for employment or otherwise contact us directly.
- Information you provide (résumé, cover letter, application responses);
- Communications with you (email, phone).
We do not collect or process consumer financial-account information; our product has no payment-rail integrations.
4. How we use information
We use personal information to:
- Provide, support, and improve our products and services;
- Authenticate users and authorize access at the direction of our bank customers;
- Communicate with you about our products, services, and your inquiries;
- Operate, monitor, and secure our systems;
- Evaluate employment candidates;
- Comply with legal obligations and enforce our agreements;
- Aggregate or de-identify information for analytics that do not identify individuals.
We do not use personal information for automated decision-making with legal or similarly significant effects without a lawful basis.
5. How we share information
We do not sell personal information. We share personal information only:
- With our bank customers — when you are an authorized user of a bank customer's tenant, your activity is visible to the bank as the controller of that tenant's data.
- With service providers (subprocessors) — third parties that operate parts of our infrastructure under contract (e.g., cloud hosting, hosted-LLM providers, identity, observability, communications, support tooling). Each operates under a written Data Processing Agreement obligating it to security and privacy controls equivalent to ours. A current list of subprocessors is available upon request.
- For legal, safety, and security reasons — to comply with law, subpoenas, or regulatory orders; to enforce our terms; or to protect the rights, safety, and security of Hickory & Company, our customers, and the public.
- In connection with a business transaction — in the context of a merger, acquisition, financing, or sale of all or part of our business, subject to standard confidentiality protections.
6. International data transfers
Hickory & Company is headquartered in the United States. Our infrastructure providers and one or more hosted-LLM providers may process personal information outside of the United States or outside of the jurisdiction in which you reside. Where required by law, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms. Where our bank customer requires it, we can constrain processing to local infrastructure on a per-tenant basis.
7. How long we keep information
We retain personal information only as long as necessary for the purposes for which it was collected, to comply with legal and contractual obligations, and to resolve disputes. Specific retention periods are governed by our internal Records and Retention policies and the agreement with the relevant bank customer.
8. How we protect information
Hickory & Company maintains a comprehensive information-security program audited under SOC 2. Technical controls include encryption at rest (AES-256) and in transit (TLS 1.2 or later), database-per-tenant isolation, tenant-isolated inference, web application firewall protection, role-based access control with least-privilege provisioning, and a DLP layer that screens sensitive data before any external-LLM call. See our System Description (available under NDA) for additional detail.
9. Your privacy rights
Depending on where you live, you may have the following rights regarding personal information we hold about you as a controller:
- Access — request a copy of the personal information we hold about you.
- Correction — request that we correct inaccurate personal information.
- Deletion — request that we delete personal information no longer required for a documented purpose.
- Portability — request a structured export of personal information you provided.
- Opt-out of sale or sharing for cross-context behavioral advertising — we do not sell personal information and do not share for cross-context behavioral advertising.
- Non-discrimination — we will not discriminate against you for exercising any of these rights.
To exercise a right, contact us at the address in §14. We will verify your request and respond within applicable statutory timelines.
If you are an authorized user of a bank customer's Hickory & Company tenant, rights requests about that tenant's data should be directed to your bank — they are the controller. We will support the bank in fulfilling your request.
10. State-Specific disclosures
California (CCPA / CPRA). California residents have the rights described in §9 above, including the right to know categories and specific pieces of personal information collected, the right to correct, the right to delete, the right to opt out of sale or sharing, the right to limit use of sensitive personal information, and the right to non-discrimination. We do not sell personal information and we do not share for cross-context behavioral advertising. To submit a verifiable consumer request, contact us at the address in §14.
Other state laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others). Where these laws apply, residents have substantially similar rights. We honor all applicable state rights requests.
11. Cookies and tracking technologies
Our website uses cookies and similar technologies for essential functions (session management, security), analytics (understanding traffic and feature use), and limited marketing measurement. You can control cookies through your browser settings. We do not use cross-context behavioral-advertising cookies.
12. Children's privacy
Hickory & Company products are not directed to children under 16, and we do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us.
13. Changes to this notice
We may update this notice from time to time. We will post the revised notice at this URL with an updated effective date and, where required, provide additional notice.
14. Contact us
Privacy questions, rights requests, or complaints:
info@hickory.co · 1 866 697 6985
Hickory & Company
1633 Innovation Way Ste 500
Lehi, Utah 84043