Last updated: 10 July 2026 · Draft pending legal review
haAplo ("we", "us") measures how readable and citable websites are for AI engines, and helps make them user and AI-friendly. This policy explains what personal data we collect, why, and what your rights are. It applies to the haAplo web application and API. We offer haAplo to both businesses (B2B) and consumers (B2C).
The data controller is [LEGAL ENTITY NAME], [REGISTERED ADDRESS], VAT [VAT NUMBER]. Privacy contact: privacy@haaplo.com.
| Data | Why we collect it | Legal basis |
|---|---|---|
| Account data: email address and password (password stored hashed, never readable by us) | To create and secure your account | Contract |
| Audit data: the URLs you submit, crawled page content and audit results | To run the audits and fixes you request and show your history | Contract |
| Site and monitoring data: sites you register, tracked prompts, AI-bot visit counts reported by the optional plugin | To provide monthly re-audits, citation monitoring and reading proof | Contract |
| Usage and cost metering: API usage per account | To enforce plan quotas and prevent abuse | Legitimate interest |
| Technical logs: IP address (stored as a hash for anonymous rate limiting), timestamps, errors | Security, rate limiting, debugging | Legitimate interest |
| Billing data: name, billing address, VAT number, payment method | To process subscription payments (handled by Stripe; we never see your full card number) | Contract / legal obligation |
| Waiting-list email (if you joined the waiting list) | To contact you about availability | Consent |
We do not sell personal data, we do not run advertising profiling, and we use only technical cookies (your login session). There is no advertising tracker on this site.
When you audit a website, its publicly available pages are crawled and parts of their content are processed by AI model providers (listed below) to analyse content quality and generate fixes. We only process content that is already public on the audited website, and our generators are grounded: they only reuse facts found on your pages.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) |
| Railway | API hosting | EU region |
| Netlify | Website hosting | Global CDN |
| Resend | Transactional email | EU/US |
| Stripe | Payments, invoicing, VAT | EU/US |
| Anthropic, OpenAI, Perplexity, Google | AI analysis of audited public content; citation checks | US (EU endpoints where available) |
Where a provider processes data outside the EU/EEA, transfers rely on adequacy decisions or Standard Contractual Clauses.
You can request deletion of your account and all associated personal data at any time by emailing privacy@haaplo.com from your account email address. We will complete the deletion within 30 days and confirm it to you. Billing records we are legally required to keep are retained for the statutory period only.
You have the right to access, rectify, delete and export your personal data, to restrict or object to processing, and to withdraw consent at any time. Write to privacy@haaplo.com. You can also lodge a complaint with your local data protection authority.
If this policy changes in a way that affects you, we will update this page and the date above. Substantial changes will be announced by email to account holders.