Privacy policy

Haven Group Tech Ltd ("Haven", "we", "us") is a company registered in England and Wales with company number 17179874. Our registered office is:

Office 9700
321-323 High Road
Chadwell Heath
Essex
RM6 6AX
United Kingdom

We are the "controller" of the personal data described in this policy: that is, we decide why and how it is used. You can contact us about it at info@havengroup.site.

When a business uses Haven to talk to its own customers, that business decides what happens to its customers' conversations and we process them on its behalf. In that case we are a "processor", and the data processing terms apply. If you are a customer of one of our customers, contact that business first about your data.

Account details. Your email address, name (optional), business name, role in the workspace and your password. Passwords are stored only as a one-way hash, never in readable form.

Sign-in and security records. Session records, sign-in attempts, and the IP address and browser details of important account and security events (for example logins, password resets and changes to a plan). Rate limits use a scrambled form of your IP address. These records protect your account and the service, and help us investigate problems.

Billing records. Your orders, plan, amount, payment method type, status and references from the payment provider. Card, Mobile Money and crypto payments are made on the payment provider's own pages. We do not receive or store your full card number.

Support and contact messages. What you write to us through the contact form or the Support page, with your name, email, company and the conversation that follows.

Agent data you provide. Pages from websites you verify, documents you upload, agent instructions, connection settings (credentials are stored encrypted), the conversations your agents have, and usage counts. We handle this for you as your processor.

Information from our website. If you sign up, a spam-protection service (Google reCAPTCHA) checks the request and receives technical information from your browser such as your IP address.

We use personal data only where the law allows. In the UK and EU these are the "legal bases" we rely on:

• To provide the service (creating and securing your account, running your agents, showing usage, taking payment): because we need to do it to carry out our contract with you.
• To send account emails (email verification, password resets, invitations, receipts, usage and renewal notices, and replies to your support requests): because it is part of the contract, or in our legitimate interest in keeping you informed.
• To answer your messages and run support: our legitimate interest in helping the people who contact us, or the contract where you are a customer.
• To keep the service safe and prevent abuse and fraud (rate limits, lockouts, audit logs, payment checks): our legitimate interest in protecting the service, our customers and ourselves.
• To keep records and meet legal duties (accounts, tax, responding to lawful requests): because the law requires it.
• To establish, exercise or defend legal claims: our legitimate interest.

We do not use your personal data for advertising, and we do not sell it. We do not send marketing emails. If that changes we will ask first and make it easy to opt out.

We use one cookie, called haven_session, which keeps you logged in to the dashboard. It is strictly necessary for the service, cannot be read by scripts on the page, and lasts for 7 days or until you log out. Haven's own operators use a separate, equivalent cookie on their own site.

We do not use analytics or advertising cookies and we do not track you across other websites. On the sign-up form, Google reCAPTCHA may set its own cookies and read information from your browser to tell people from bots; it works under Google's own privacy policy and terms.

Because the cookie we set is strictly necessary, we do not need to ask for your consent to use it. If we ever add other cookies, we will ask first.

We use trusted service providers to run Haven. They may process personal data only for the purposes we give them. Depending on how you use the service, they include:

• Render: hosts our application interface (API) and its database.
• Amazon Web Services: hosts our website, provides our domain name service and sends and receives email (Amazon SES).
• Stripe, Fapshi and NOWPayments: take card, Mobile Money and crypto payments.
• Google (Gemini) and Groq: AI models that write agent replies and turn your documents and web pages into a searchable index.
• Google reCAPTCHA: protects the sign-up form against bots.
• Meta (WhatsApp): if you connect your own WhatsApp Business account to an agent.

We may also share personal data where the law requires it (for example with a court, regulator or tax authority), to protect our rights or others' safety, or if our business is sold or reorganised, in which case the new owner must respect this policy. The current list of providers that process data for our customers is in the data processing terms.

Some of our providers handle data outside the UK and the European Economic Area, including in the United States. When personal data is transferred out of the UK or EEA, we make sure one of the safeguards the law recognises is in place: for example an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU standard contractual clauses. Ask us at info@havengroup.site if you would like to know more about the safeguards for a particular provider.

We keep personal data only for as long as we need it for the reasons above. An automatic clean-up runs every day and deletes what has passed its period.

• Account details are kept while your account is open. If you ask us to close it, we delete your account details, agents, conversations, knowledge and keys. We keep only the financial records described below.
• Billing and payment records (orders, payments, refunds, credit history and subscriptions) are kept for six years, because UK tax and company law require it. We keep them even if you ask us to delete your account.
• Support tickets and the files attached to them are deleted 24 months after they are resolved. Files you attach in the agent chat stay with that conversation and go when it is deleted or your account is erased. Contact-form messages are deleted after 24 months.
• Login sessions are deleted 30 days after they end, and password-reset and verification links 30 days after they expire.
• Copies of emails we sent you and notifications are deleted after 90 and 180 days.
• Per-message usage records are deleted after 13 months. Full payment-provider messages are deleted after 90 days, with a one-line record kept for 13 months.
• Security and activity records are kept for 24 months. Those about payments, plan changes, refunds and emergency stops are kept for six years. They record actions, not the content of your conversations.
• Agent content and conversations are kept for you, as your processor. You can remove documents and pages from your knowledge in the dashboard at any time, and we delete or return the rest when the agreement ends, as the data processing terms describe.
• Sandbox demo chats (the free demo on our website, which needs no account) are deleted after 7 days. They are anonymous and only about a pretend business.
• Reviews you write are shown publicly with the name and business you choose, until you edit or delete them in your dashboard (or we remove them). They are deleted if your account is erased.
• Payment providers (Stripe, Fapshi and NOWPayments) keep their own records under their own policies. We cannot delete those for you, so contact them directly if you want that.

We take security seriously. Among other measures:

• connections to Haven use encrypted HTTPS;
• passwords are hashed, and API keys are stored only as hashes and shown in full once, when you create them;
• credentials for systems you connect are encrypted and not shown again after saving;
• each customer's agent data is kept separate at the database level;
• dashboard sessions use cookies that scripts cannot read, with protection against cross-site requests;
• the people who run Haven sign in with a password and a one-time code, and their actions are recorded in an audit log that cannot be edited;
• we only read websites whose owner has verified them, and we follow their robots.txt rules;
• we limit how fast anyone can try to sign in or call sensitive actions.

No system is completely secure. If a personal data breach affects you, we will tell you and the regulator where the law requires.

Under UK and EU data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have it corrected if it is wrong or incomplete;
• ask us to delete it, in some cases;
• ask us to restrict how we use it, in some cases;
• object to uses based on our legitimate interests;
• receive the data you gave us in a portable format, where we use it under a contract with you;
• ask a person to look again at a decision made only by automated means that has a legal or similarly significant effect on you (Haven does not make decisions like that about you).

To use any of these rights, email info@havengroup.site. We will reply within one month, and may ask you to confirm who you are first. There is no charge unless a request is clearly unfounded or excessive. If you live somewhere with its own data protection law, you may have other rights, and we will respect them where they apply to us.

Please tell us first, so we can try to put things right. You also have the right to complain to the supervisory authority where you live or work. In the UK that is the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.

Haven's agents use AI models to write replies. Replies are produced automatically from the conversation and the knowledge your business has given the agent. Agents have tools that can read or change data in your systems only if you connect and enable them, and high-risk actions wait for a person on your team to approve them. Haven itself does not use this to make decisions about individuals that have legal or similarly significant effects.

Haven is for businesses and is not aimed at children. You must be at least 18 to have an account. We do not knowingly collect personal data from children through our own website. If you think a child has given us personal data, email info@havengroup.site and we will delete it.

We will update this policy when our practices change. The date at the top of this page shows when it last changed. If a change is significant, we will tell account holders by email or in the dashboard before it takes effect.