Privacy Policy

Data Controller

The controller within the meaning of Art. 4(7) GDPR for the personal data processed on haiati is Mahmoud El-Gamal (natural person / private individual), Donau-City-Straße 3, Büro 11, 1220 Wien, Austria. Contact for all privacy inquiries: [email protected].

Categories of Data We Collect

We process only the categories of personal data required for the respective feature:

• Account data — display name, email address, password hash (Argon2id), preferred language, country/city, two-factor secrets (TOTP, backup codes), passkey credentials (WebAuthn), consent and confirmation timestamps, and chosen sign-in method (email code, password, or third-party account).
• Profile data — for service providers: business name, descriptions, category, languages spoken, phone number, messenger number, website, booking link, images, optional public street address, and location coordinates; for job applicants: voluntary candidate profile (summary, skills, languages).
• Content and communication data — published provider profiles, deals, marketplace listings, job postings, events including RSVPs (display name, status, party size, check-in status; no email address shared with organizers), community questions, answers, comments, neighborhood endorsements, neighborhood help requests, job applications (cover letter, resume PDF, shared contact details), and direct messages with attachments.
• Technical connection and log data — we do not record general browsing or click behavior (page views, click paths, or mouse movements) on a personal basis. When accessing the platform, technically necessary server log data (IP address, timestamp, requested path, HTTP status code, user agent) is generated and deleted after 14 days. For security-relevant operations (sign-in, account erasure, data export, moderation) we keep an audit log in which the IP address is removed after 90 days.
• Payment and transaction data — all features are currently free of charge for users and businesses; no payment data is collected. If optional paid add-on services are offered in the future via an external payment service provider, we will store only payment status, amount, currency, and transaction identifiers, never credit card or bank account details.

Purposes, legal bases and recipients

We process personal data for these purposes. For each purpose we name the legal basis and the recipients that are connected in the running environment.

• Account, profile and settings

  Legal basis: contract (Art. 6(1)(b) GDPR)

  Recipients: EU server and database hosting provider, Edge network, security, and object storage provider, and Transactional and notification email service provider

• Sign-in, sessions and second factors

  Legal basis: contract (Art. 6(1)(b) GDPR)

  Recipients: EU server and database hosting provider, OAuth identity provider for account sign-in, and Transactional and notification email service provider

• Publishing provider profiles, deals, listings, jobs, events, questions, answers, endorsements, and help requests, as well as generating personal invitation links for businesses (without storing third-party business data)

  Legal basis: contract (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR)

  Recipients: EU server and database hosting provider, Edge network, security, and object storage provider, and Transactional and notification email service provider

• Event RSVPs, attendee management for organizers (display name, status, party size, check-in status; no attendee email address is shared), co-organizers, and unlocking the exact venue address and online meeting link after confirmed RSVP

  Legal basis: contract (Art. 6(1)(b) GDPR)

  Recipients: EU server and database hosting provider, Edge network, security, and object storage provider, and Transactional and notification email service provider

• Applications to jobs (cover text, résumé, the extract for the employer) and the own applicant profile

  Legal basis: contract (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR)

  Recipients: EU server and database hosting provider, Edge network, security, and object storage provider, and Transactional and notification email service provider

• Messages between users and inquiries to providers

  Legal basis: contract (Art. 6(1)(b) GDPR)

  Recipients: EU server and database hosting provider and Edge network, security, and object storage provider

• Notifications in the app, by e-mail and by push

  Legal basis: contract (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR)

  Recipients: EU server and database hosting provider and Transactional and notification email service provider

• Notices and moderation decisions under the Digital Services Act

  Legal basis: legal obligation (Art. 6(1)(c) GDPR) and legitimate interests (Art. 6(1)(f) GDPR)

  Recipients: EU server and database hosting provider and Transactional and notification email service provider

• AI features through the central AI gateway

  Legal basis: legitimate interests (Art. 6(1)(f) GDPR) and explicit consent (Art. 9(2)(a) GDPR)

  Recipients: no external recipients

• Search, saved searches, bookmarks and anonymous search statistics

  Legal basis: contract (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR)

  Recipients: EU server and database hosting provider

• Feedback and bug reports from the form in the app

  Legal basis: legitimate interests (Art. 6(1)(f) GDPR)

  Recipients: EU server and database hosting provider and Transactional and notification email service provider

• Consents, objections and requests of data subjects

  Legal basis: legal obligation (Art. 6(1)(c) GDPR) and legitimate interests (Art. 6(1)(f) GDPR)

  Recipients: EU server and database hosting provider

• Logs and operation of the platform for security

  Legal basis: legitimate interests (Art. 6(1)(f) GDPR)

  Recipients: EU server and database hosting provider, Edge network, security, and object storage provider, and Error monitoring and stability service provider

Recipients and Processors

We share personal data only with categories of recipients to the extent required to operate the platform, provide a feature you requested, or comply with legal obligations. Data processing agreements under Art. 28 GDPR are in place with all processors.

• EU server and database hosting provider — processor

  Operation of the application server and PostgreSQL database

  Seat and transfer: Germany (EU)

• Edge network, security, and object storage provider — processor

  Encrypted tunnel, DNS, attack protection, and object storage for uploaded files, backups, and map tiles

  Seat and transfer: US (EU-US Data Privacy Framework, Standard Contractual Clauses); object storage with EU jurisdiction

• Transactional and notification email service provider — processor

  Delivery of sign-in codes, system notices, and selected email notifications

  Seat and transfer: France (EU)

• Error monitoring and stability service provider — processor

  Technical error reports with pseudonymous user identifier (without plain-text email or message content)

  Seat and transfer: EU data region; US (EU-US Data Privacy Framework)

• OAuth identity provider for account sign-in — independent controller

  Optional sign-in via an existing third-party account (confirmed email address, name, and account identifier only; no profile picture import)

  Seat and transfer: Ireland (EU) and US (EU-US Data Privacy Framework)

Sign-in with a Third-Party Account (OAuth) — Account Data Disclosure

When you choose to sign in via a supported third-party OAuth / OpenID Connect identity provider, haiati requests only the standard basic scopes (openid, email, profile). We use this information solely to verify your identity and to create or link your haiati account. We never request access to your email inbox, cloud storage, calendar, or contacts with that provider.

• Data accessed — your confirmed email address with the identity provider, your display name, and your unique account identifier (sub). Any profile picture stored there is explicitly not imported.
• Data usage — used solely for authentication, creating or linking your haiati account, and suggesting your display name.
• Storage — email address, name, and linked account identifier are stored in our database in the European Union for the retention periods listed below.
• No advertising, no profiling — third-party sign-in data is never used for advertising, behavioral profiling, or automated decision-making.
• No sale, no sharing — we do not sell, rent, or share this account data with third parties for their own purposes.
• Revoking access — you can disconnect the linked sign-in method at any time in your haiati security settings as well as in the account permissions of your identity provider, and continue using your haiati account via email code, password, or passkey.

International Data Transfers

Our application server and database are located in Germany (European Union). Where individual processors or sub-processors are located in the United States or another third country outside the EEA, transfers take place exclusively on the basis of an adequacy decision of the European Commission under Art. 45 GDPR (in particular the EU-US Data Privacy Framework or the UK adequacy decision) or on the basis of the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR. You can request a copy of the applicable safeguards via the contact address above.

Data protection officer

There is no statutory obligation to appoint a Data Protection Officer under Art. 37 GDPR for our current scale of operations. For all privacy matters, you can reach the controller directly at [email protected].

Retention Periods

We keep data only as long as the purpose requires. These periods apply:

• Inactive accounts: enter the erasure process 24 months after last activity following a reminder email with 30 days’ notice.
• Accounts that never confirmed the terms: enter the erasure procedure 7 days after they were created.
• Sessions: deleted as soon as they expire.
• One-time codes and confirmation values of sign-in: deleted 1 day after they expire.
• Closed-beta invite codes: deleted 30 days after they expire.
• Expired listings with their images: deleted 6 months after they expire.
• Listings closed by their owner: deleted 180 days after archiving.
• Closed or expired job posts: deleted 7 months after they end.
• Archived job posts: deleted 180 days after archiving.
• Ended events: deleted 12 months after they end.
• Registry entry of released files: deleted as soon as the file is removed.
• Invitations to businesses: deleted 30 days after they expire.
• Closed or expired neighborhood help requests: deleted 90 days after they end.
• Expired or archived provider deals: deleted 180 days after they expire.
• Withdrawn or removed neighborhood recommendations: deleted 180 days after withdrawal.
• Attendee lists of events: deleted 90 days after the event ends.
• Invitations to co-organizers: deleted 14 days after the invitation.
• Applications with the résumé: deleted 7 months after the rejection or hiring.
• Withdrawn applications: deleted 30 days after the withdrawal.
• Conversations with their attachments: deleted 24 months after the last message.
• Notifications in the app: deleted 180 days after they are created.
• Log of sent e-mail series: deleted 24 months after sending.
• Decided notices: deleted 6 months after receipt.
• Name and address of notifiers: removed 183 days after the decision was sent to them.
• Moderation decisions with their statement of reasons: deleted 36 months after the decision.
• Usage log of the AI features: deleted 13 months after the call.
• Daily counters of AI use: deleted 13 months after the day.
• Feedback on AI suggestions: deleted 12 months after it is created.
• Cached AI answers: deleted as soon as they expire.
• Anonymous search statistics: deleted 90 days after the day.
• Feedback and bug reports: deleted 12 months after they are resolved.
• Records of withdrawn consents: deleted 3 years after the change.
• Completed erasure requests: deleted 60 days after the request.
• Recovery ledger of completed erasures: deleted 60 days after completion.
• Log of important operations, without names and addresses: deleted 12 months after the entry.
• IP addresses in the log: removed 90 days after the entry.
• Address digests in erasure audit logs: deleted 60 days after the entry.
• Finished background jobs: removed 30 days after completion.
• Inbox of payment notifications: deleted 90 days after receipt.
• Backups: kept for 30 days.
• Server logs: kept for 14 days.

Automated Processing and AI

When AI features are enabled, haiati uses an external AI language model service provider as a processor via a paid business interface (paid-tier API). Under the contractual terms of this business interface, your inputs are not used to train the provider’s models. AI is used for: (1) translations and text suggestions when creating profiles, listings, or questions, (2) labeled AI initial answers to community questions, (3) automated pre-screening of published texts for severe rule violations, where every final decision to restrict or remove content or suspend an account is made by a human, and (4) optional structuring of pasted resume text only after your prior explicit consent (Art. 6(1)(a), Art. 9(2)(a) GDPR), without storing the pasted raw text permanently. No automated individual decision-making including profiling under Art. 22 GDPR takes place.

Cookies and local storage

haiati stores on your device only strictly necessary cookies and local browser storage entries (Section 165(3) TKG 2021) required to provide a service you explicitly requested (authentication, security, language and location selection, and protecting your unsent drafts). We do not use advertising, analytics, or third-party tracking cookies. Here is the complete inventory:

• haiati.session_token — Cookie

  Keeps you signed in.

  60 days

• haiati.two_factor — Cookie

  Carries a sign-in through the second factor.

  10 minutes

• haiati.better-auth-passkey — Cookie

  Ties a passkey registration or sign-in to the browser that started it.

  5 minutes

• __Host-haiati_country_hint — Cookie

  Remembers the country you chose.

  365 days

• __Host-haiati_near_city — Cookie

  Remembers the coarse place (city or district) and radius of a near-me search while you move between pages.

  1 hour

• __Host-haiati_beta_invite — Cookie

  Carries a confirmed closed-beta invitation code through registration (including Google sign-in redirect) and is deleted once the account is created.

  1 hour

• __Host-haiati_provider_invite — Cookie

  Carries an opened provider invitation link through registration and is deleted once the account is created.

  1 hour

• theme — Local storage

  Remembers the colour scheme you chose.

  until you clear the browser data

• haiati.localeHintDismissed — Local storage

  Remembers that you dismissed the language hint.

  until you clear the browser data

• haiati:recent-searches — Local storage

  Lists your last searches in the search field; never sent to the server.

  until you clear the browser data

• haiati:question-draft:native-v1 — Local storage

  Keeps an unsent question so a reload does not lose it; removed after sending.

  until you clear the browser data

• haiati:answer-draft:native-v1:* — Local storage

  Keeps an unsent answer per question so a reload does not lose it; removed after sending.

  until you clear the browser data

Your Rights

Under Articles 15 to 22 GDPR, you have the following rights at any time with respect to the controller:

• Access (Art. 15 GDPR) — Request confirmation and a complete copy of the personal data processed about you, or retrieve it directly at any time under "My data" in your account settings.
• Rectification (Art. 16 GDPR) — Correct or complete inaccurate personal data at any time in your profile and account settings.
• Erasure (Art. 17 GDPR) — Permanently delete your account and associated data at any time in your account settings or without signing in via the public erasure page, unless statutory retention obligations or overriding legal grounds apply.
• Data portability (Art. 20 GDPR) — Download the data you provided in a structured, commonly used, machine-readable format (JSON) as well as a printable view.
• Restriction (Art. 18 GDPR) and Objection (Art. 21 GDPR) — Request restriction of processing and object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (legitimate interests); you can also switch off the home-page compilation of matching entries from your saved searches at any time in your privacy settings.
• Withdrawal of consent (Art. 7(3) GDPR) — Withdraw any consent you have given (e.g. for marketing emails or AI resume assistance) at any time with effect for the future in your privacy settings.
• Complaint (Art. 77 GDPR) — Lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence or at the seat of the controller.

Security

We protect your data using technical and organizational measures in accordance with Art. 32 GDPR: encrypted transmission (TLS/HTTPS), Argon2id password hashing, optional two-factor authentication and passkeys, strict access controls, automated verification of uploaded files, and separate encrypted backups. Personal data breaches are notified in accordance with Articles 33 and 34 GDPR.

Obligation to Provide Data

Public search and browsing pages on haiati can be used without registration. Creating an account requires a valid email address, confirmation of the minimum age, and acceptance of the Terms of Service; without this information, an account cannot be opened. When publishing profiles, listings, job postings, events, or job applications, only the fields marked as required are necessary to fulfill the respective request. All other details (such as phone numbers, optional profile fields, or consents) are voluntary; not providing them simply means the corresponding optional feature cannot be used.

Children

haiati is intended for persons aged 16 and over (or at least 18 years old for residents of Egypt). We do not knowingly collect personal data from persons below this age limit. If we learn that an account was created below the applicable minimum age, we delete the account and associated data promptly.

Changes to This Policy

We update this Privacy Policy whenever processing activities, recipient categories, or legal requirements change. The current version and its version identifier are always available on this page. We notify registered users in advance of material changes by email or by a prominent notice in the application.

Contact and Supervisory Authority

For all privacy inquiries and to exercise your rights, contact us at [email protected]. The competent supervisory authority at the controller’s seat is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria — email: [email protected], website: www.dsb.gv.at.