What we keep, and why.

01Who is responsible

HAGGIN is the data controller for the HAGGIN service and this website. For anything about your data, write to hello@hagg.in.

02What we collect

• —Account. Email, name and a password (stored hashed by our auth provider) or sign-in links. Sellers also give a company name.
• —Offers and negotiations. Every offer, counteroffer and message you send, plus whatever you volunteer with it: company, role, website, the channels where you publish.
• —Deals. When a buyer accepts deal terms we store the exact text, its hash, the time, the IP address and the browser used. That record is the point of the product.
• —Billing. Sellers who buy a plan are billed by Stripe. Stripe holds the card; we hold the plan, its status and Stripe's identifiers.
• —Technical. Short-lived counters keyed by IP address and email to stop abuse, and a log of the emails we sent you and whether they were delivered.
• —Usage. Product events (a page was viewed, an offer was sent) tied to an opaque id when you are signed in. No cookies, no session recordings, IP addresses discarded. Never the content of an offer.

03Why, and on what legal basis

• —To run the negotiation you asked for and email you about it: performance of a contract (GDPR art. 6.1.b).
• —To bill sellers and keep invoices: contract and legal obligation (art. 6.1.b and 6.1.c).
• —To keep the service safe, prevent abuse and measure what works: our legitimate interest (art. 6.1.f). You can object at any time.

We send no marketing email. If that ever changes, we will ask first.

04Who sees your data

The other party. A seller sees the buyer's name, email, offer and the details attached to it. A buyer sees the seller's company name and the deal terms. Each side is responsible for what it does with that.

Our processors. Companies that run parts of the service under contract and on our instructions only:

• —Supabase: authentication and database hosting.
• —Vercel: application hosting and scheduled jobs.
• —Stripe: billing of HAGGIN plans (card data never reaches us).
• —Resend: transactional email delivery.
• —PostHog: product analytics, cookieless.

Nobody else, unless the law obliges us or you ask us to. We do not sell or rent personal data.

05Transfers outside the EEA

Some processors run infrastructure outside the European Economic Area. Where they do, transfers rely on the EU Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework.

06How long we keep it

• —Offers submitted but never confirmed by email: deleted after 72 hours.
• —Abuse-prevention counters: purged automatically once their window closes.
• —Accounts, negotiations and deals: while your account exists, then deleted or anonymised within 30 days of your request.
• —Terms-acceptance records of won deals: kept for both parties while either keeps an account, so each can prove what was agreed.
• —Billing records: as long as tax law requires, currently six years in Spain.

07Cookies

Only the strictly necessary ones: the session cookies that keep you signed in. No analytics or advertising cookies, so there is no banner.

08Security

Encryption in transit, hashed passwords, database access locked to the application, and rate limits on every public action. No system is perfect. If something goes wrong with your data we will tell you and the authority as the law requires.

09Your rights

Access, rectification, erasure, restriction, portability and objection. Email hello@hagg.in from the address on your account and we answer within one month. If you think we got it wrong, you can complain to the Agencia Española de Protección de Datos (AEPD).

One limit: we cannot erase a terms-acceptance record while the other party still needs it as proof of the deal. We can anonymise your account around it.

10Changes

If we change this notice in a way that matters, we email account holders before it takes effect. Version 1.0.