Last updated: 22 September 2026
1. Who we are
Project Hollow (“Hollow”, “we”, “us”, “our”) is operated by Soulstack. Hollow is a private, invite-only, AI-native workspace suite at projecthollow.com.
Soulstack is the data controller for personal data processed through Hollow. Address for data-protection queries and legal correspondence: Office One, 1 Coldbath Square, Farringdon, London, EC1R 5HL, England. Email: privacy@projecthollow.com.
2. What data we collect
We collect the following categories of personal data:
- Account data - name, email address, password (stored as a salted hash, never in plain text), and profile settings.
- Workspace content - everything you create or upload while using Hollow: notes, tasks, files, spreadsheet and slide content, diagrams, budgets, contacts, recipes, calendar events, Yap messages, Cascade automations, and Lumen monitoring configuration and data.
- AI conversation data - prompts you send to Hollow AI (in Hollow Studio, Hey Hollow voice, or an in-app assistant panel), the workspace context automatically attached to a request (such as the note or task you have open), and the responses generated.
- Authentication and security data - sign-in timestamps, session and device identifiers, multi-factor authentication status, and app-integrity/challenge signals used to keep sign-in secure.
- Developer API data - API key metadata (name, creation date, last use) if you mint a personal developer key, and the request data you send to the Tasks or Lumen API.
- Technical data - IP address, browser and device information, and server logs, processed for delivery, security and abuse prevention.
Hollow’s Mail app connects to a mailbox account you configure over IMAP/SMTP or OAuth; we do not separately collect or store a copy of your external email account credentials beyond what is needed to maintain that connection.
3. How we use your data
Purpose
Lawful basis (UK GDPR Art. 6)
Creating and operating your account
Contract performance
Providing the workspace apps and storing your content
Contract performance
Running Hollow AI requests, including sending them to the model provider you selected
Contract performance
Authentication, session security and abuse prevention
Legitimate interest
Responding to support and data-protection requests
Legitimate interest / legal obligation
Sending service emails (invites, password resets, security alerts)
Contract performance
Improving Hollow and fixing issues
Legitimate interest
4. Who we share data with
- Firebase (Google Cloud) - authentication, database, file storage and serverless functions underpin every app in the suite. Google acts as a data processor.
- AI model providers - a Hollow AI request is sent to the provider behind whichever model you selected (Google, Anthropic, OpenAI, xAI, Microsoft or an open-weight model host, depending on your choice in Models). Each provider processes that request under its own standard API and data-processing terms, acting as a data processor for Hollow. Your workspace content is not used to train third-party foundation models without your explicit opt-in.
- Other members of a shared workspace - content you explicitly share (a notebook, a task board, a Yap channel, a Design Space) is visible to the accounts you share it with, and only to those accounts.
- Third-party integrations you connect - Cascade connectors, MCP servers and GitHub connections are opt-in per account. Once connected, the relevant data passes to that third party under its own terms; disconnecting stops this.
- Our email delivery provider - for transactional service email (invites, password resets, security alerts) only.
We do not sell your personal data, and we do not run advertising or ad-tracking of any kind.
5. International transfers
Hollow is operated from the United Kingdom. Some of the processors above - including AI model providers and Google Cloud infrastructure - may process data outside the UK and European Economic Area. Where that happens, we rely on the transfer safeguards available under UK GDPR, such as UK adequacy regulations or the UK Addendum to the EU Standard Contractual Clauses with the relevant processor.
6. How long we keep your data
Workspace content and account data are retained for as long as your account is active. Deleting a note, task, file or other item removes it from the application immediately. Deleting your account (Account settings → Account deletion) permanently removes your associated workspace data; this cannot be undone. Residual copies may briefly persist in routine infrastructure backups before being overwritten in the normal course of our backup cycle. Server logs are kept only as long as needed for security and delivery purposes, then deleted.
7. Your rights
Under UK GDPR, you have the right to:
- Access - request a copy of the personal data we hold about you.
- Rectification - ask us to correct inaccurate data.
- Erasure - ask us to delete your data where there is no compelling reason for continued processing.
- Restriction - ask us to restrict processing in certain circumstances.
- Portability - export your notes, files and conversation history at any time from Account settings, or request a structured export directly.
- Object - object to processing based on legitimate interests.
- Withdraw consent - withdraw consent where processing is based on consent, such as opting in to model training.
To exercise any of these rights, email privacy@projecthollow.com. We will respond within one calendar month.
8. Cookies and tracking
Hollow does not use analytics, advertising or tracking cookies. We use only strictly necessary cookies and browser storage required to keep you signed in and to remember workspace preferences such as your theme. If that changes, this section will be updated first and, where required, your consent will be requested.
9. Children
Hollow is not directed at individuals under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. Material changes will be communicated to the email address on your account. The “Last updated” date at the top of this page reflects the latest revision.
11. Complaints
If you have a complaint about how we handle your data, email privacy@projecthollow.com in the first instance. We will acknowledge your complaint and aim to respond within one calendar month.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
ico.org.uk/make-a-complaint