Data processing terms

These terms apply when Haven Group Tech Ltd ("Haven", a company registered in England and Wales with company number 17179874) processes personal data on behalf of a customer ("you") to provide the Haven Agent Platform.

For that personal data, you are the "controller" (or, where you act for someone else, a processor) and Haven is your "processor" (or sub-processor). You decide why and how the data is processed. Haven processes it only on your documented instructions.

Where Haven decides for itself why and how to use personal data, for example your account details, it is a controller. That is covered by our privacy policy.

These terms apply for as long as Haven processes personal data on your behalf. If they conflict with the terms of service on personal data, these terms prevail.

• Subject matter: providing AI agents that answer messages, search your knowledge and run the tools you enable.
• Duration: while you have an account, and for the deletion period described below.
• Nature and purpose: storing, indexing, retrieving, analysing, generating replies from and transmitting data, in order to run your agents, show usage and keep the service secure.
• People whose data it is: your own customers and prospects who talk to your agents, your staff who use the dashboard, and anyone whose details appear in content you provide.
• Types of data: conversation messages, contact details and other details people share in conversations, information your agents look up through tools you connect, the content of websites you verify and documents you upload, and dashboard user details.
• Special categories of data: the service is not designed for them. Under our terms of service you must not use Haven to process them without our written agreement.

Haven will:

• process personal data only on your documented instructions (these terms, your settings in the dashboard, and your use of the service), unless the law requires otherwise, in which case we will tell you first where we lawfully can;
• tell you if we think an instruction breaks data protection law;
• make sure that everyone we allow to process the data is bound by a duty of confidentiality;
• keep each customer's agent data separate from other customers' data;
• run high-risk tool actions only after a person on your team has approved them;
• not sell the data, and not use it for our own purposes, including training AI models ourselves.

Haven puts in place technical and organisational measures that are appropriate to the risk. They currently include the measures in the "Security measures" section below. We may change them if the result is no less protective.

You give us general authorisation to use sub-processors. We will make sure that each one is bound by data protection terms that give essentially the same protection as these, and we remain responsible for what they do.

At the date of these terms, the sub-processors that may handle customer personal data are:

• Render: hosting of the application interface (API) and its database;
• Amazon Web Services: website hosting, domain name service and email sending and receiving (Amazon SES);
• Google (Gemini API): AI model that writes replies, and generates embeddings that make your documents and pages searchable;
• Groq: AI model that writes replies, where we use it;
• Stripe, Fapshi and NOWPayments: payment processing (billing data only, not conversation content).

If you connect your own channels or systems, for example a WhatsApp Business account, an email address or a CRM, those services act on your instructions and under your own agreement with them, and are not our sub-processors.

We will give you at least 30 days' notice before adding or replacing a sub-processor, by email or in your dashboard. If you object on reasonable data protection grounds within that time, we will work with you to find a solution. If we cannot, you may cancel the affected service without penalty before the change takes effect.

Some sub-processors process data outside the UK and the European Economic Area, including in the United States. Where that happens we make sure one of the transfer safeguards that applies under UK GDPR and EU GDPR is in place, such as an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU standard contractual clauses. Where those clauses are needed and not already part of the sub-processor's terms, we will enter into them with you or on your behalf on request.

Taking into account the nature of the processing, we will give you reasonable help to:

• respond to requests from people exercising their data protection rights: we will pass on to you any request we receive about your data without answering it ourselves, unless you ask us to;
• carry out data protection impact assessments and consult regulators, where they relate to the service;
• show that you have met your own obligations, using the information in these terms and further information we reasonably provide.

We may charge a reasonable fee for help that goes beyond the normal use of the service.

We will tell you without undue delay after we become aware of a personal data breach affecting your data. We will give you the information we have that you need to meet your own notification duties: what happened, the likely effects, what data and how many people may be affected, and what we are doing about it. We will keep you updated as we learn more.

You can remove documents and website pages from your knowledge in the dashboard at any time.

When the agreement ends, we will, on request made within 30 days, help you obtain a copy of your content where reasonably practicable. After that we will delete or anonymise your content within a reasonable time, and then remove it from our backups as they expire. We may keep personal data where the law requires, for example billing records, and security and audit logs that record actions rather than the content of conversations. Anything we keep stays protected under these terms.

We will give you the information you reasonably need to check that we are meeting these terms. If that is not enough, you may carry out an audit, no more than once a year unless a regulator requires it or there has been a breach, with at least 30 days' written notice, during working hours, in a way that does not disrupt the service or put other customers' data at risk, and subject to confidentiality. You bear the cost of the audit.

Each of our liabilities under these terms is subject to the limits and exclusions in the terms of service. These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where data protection law says otherwise.

Questions about these terms: info@havengroup.site.

These are the main measures Haven applies to personal data in the service:

• Encryption in transit. All connections to the website and the API use HTTPS.
• Credentials. Passwords are stored as salted one-way hashes (argon2id). API keys are stored only as hashes. Credentials you give us for systems you connect are encrypted (AES-256-GCM) and are not shown again after saving.
• Separation between customers. Agent data is kept separate by customer at the database level, so a query for one customer cannot read another's rows.
• Access control. Workspace roles (owner, admin, member) control what each person can do. Dashboard sessions use cookies that scripts cannot read, with protection against cross-site requests.
• Staff access. The people who run Haven use a separate operator site, with a password and a one-time code, sessions that expire, and an audit log of what they do. The audit log cannot be edited or deleted.
• Abuse protection. Rate limits and temporary lockouts on sign-in and sensitive actions, spam protection on sign-up, and signature checks on messages from payment providers.
• Safe web crawling. The service reads only websites you have shown you control, follows their robots.txt rules, and blocks requests to internal networks.
• Human approval. High-risk tool actions wait for a person on your team to approve them.
• Logging and monitoring. Important account, billing and support events are recorded with who did them and when, without storing passwords or request bodies.