What we keep, and why.

01Who is responsible

HAGGIN is the data controller for the HAGGIN service and this website. For anything about your data, write to hello@hagg.in.

02What we collect

• —Account. Email and name. There are no passwords: you sign in with one-time links we email you. Sellers also give a company name.
• —Offers and negotiations. Every offer, counteroffer and message you send, plus whatever you volunteer with it: company, role, website, the channels where you publish.
• —Deals. When a buyer accepts deal terms we store the exact text, its hash, the time, the IP address and the browser used. That record is the point of the product. An independent certifier may receive the deal's identifiers and the hash of the terms, so either side can later prove the record was not changed. Never the terms themselves, and nothing about you.
• —Billing. Sellers who buy a plan are billed by Stripe. Stripe holds the card; we hold the plan, its status and Stripe's identifiers.
• —Technical. Short-lived counters keyed by IP address and email to stop abuse, and a log of the emails we sent you and whether they were delivered.
• —Usage. Product events (a page was viewed, an offer was sent) tied to an opaque id when you are signed in. No cookies, no session recordings, IP addresses discarded. Never the content of an offer. We also count visits to each Haggin page per day, with no IP address, cookie or browser details, so its seller can see how many people opened it.

03Why, and on what legal basis

• —To run the negotiation you asked for and email you about it: performance of a contract (GDPR art. 6.1.b).
• —To bill sellers and keep invoices: contract and legal obligation (art. 6.1.b and 6.1.c).
• —To keep the service safe, prevent abuse and measure what works: our legitimate interest (art. 6.1.f). You can object at any time.
• —To email you about your own account. A few emails from the founder when something is left halfway (a draft never published, a Haggin nobody has opened, a trial about to close, a plan you cancelled), a note to buyers who might sell too, and a weekly summary of your live Haggins. Our legitimate interest (art. 6.1.f) and, for customers, emails about our own service (art. 21.2 of the Spanish LSSI). Every one has a link to stop them, and so does Settings.
• —To send you our newsletter, The Third Button, only if you join it with the button on its page or in Settings: your consent (art. 6.1.a). Your email then goes to beehiiv, which sends it. Leave from any issue.

We never sell or share your address. Offers, counters and deals always reach you, because they are the negotiation itself.

04Who sees your data

The other party. A seller sees the buyer's name, company, role, offer and the details attached to it. The buyer's email is shared with the seller only once a deal is agreed, by either side, which the buyer accepts explicitly when making the offer. A buyer sees the seller's company name and the deal terms. When a seller sends next steps for a deal, that email carries the address of the person who sent it as reply-to, so the buyer can answer them directly. Each side is responsible for what it does with that.

Our processors. Companies that run parts of the service under contract and on our instructions only:

• —Supabase: authentication and database hosting.
• —Vercel: application hosting and scheduled jobs.
• —Stripe: billing of HAGGIN plans (card data never reaches us).
• —Resend: delivery of the emails the app sends.
• —PostHog: product analytics, cookieless.
• —beehiiv: our newsletter, The Third Button (receives your email only if you join it).
• —NexArt: independent certification of deal acceptances (receives identifiers and a SHA-256 hash, never the terms or personal data).

Nobody else, unless the law obliges us or you ask us to. We do not sell or rent personal data.

05Transfers outside the EEA

Some processors run infrastructure outside the European Economic Area. Where they do, transfers rely on the EU Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework.

06How long we keep it

• —Offers submitted but never confirmed by email: deleted after 72 hours.
• —Abuse-prevention counters: purged automatically once their window closes.
• —Accounts, negotiations and deals: while your account exists, then deleted or anonymised within 30 days of your request.
• —Terms-acceptance records of won deals: kept for both parties while either keeps an account, so each can prove what was agreed.
• —Billing records: as long as tax law requires, currently six years in Spain.

07Cookies

Only the strictly necessary ones: the session cookies that keep you signed in. No analytics or advertising cookies, so there is no banner.

08Security

Encryption in transit, no passwords to steal, database access locked to the application, and rate limits on every public action. No system is perfect. If something goes wrong with your data we will tell you and the authority as the law requires.

09Your rights

Access, rectification, erasure, restriction, portability and objection. Email hello@hagg.in from the address on your account and we answer within one month. If you think we got it wrong, you can complain to the Agencia Española de Protección de Datos (AEPD).

One limit: we cannot erase a terms-acceptance record while the other party still needs it as proof of the deal. We can anonymise your account around it.

10Changes

If we change this notice in a way that matters, we email account holders before it takes effect. Version 1.3.