Privacy Policy

This Privacy Notice has been developed taking into account Our understanding of the importance of Personal Data and Our responsibility to handle it respectfully and securely. Maintaining Your privacy and transparency around how Your Personal Data is used is one of Our top priorities.

The purpose of this Notice is to explain how We collect, use, store, and otherwise Process Your Personal Data when You interact with the Platform, or use Our services through the Platform.

We want You to feel confident that Your Personal Data is protected and Processed in accordance with applicable legal standards — including the General Data Protection Regulation, the Law of Ukraine "On Personal Data Protection", and other relevant data protection regulations.

The GDPR applies to Users located in the European Union, while the Law of Ukraine "On Personal Data Protection" governs the rights and obligations of Users located in Ukraine. For Users from other jurisdictions, the Processing of Personal Data shall be subject to the data protection laws applicable in their country of residence, as further detailed below in this Privacy Notice.

This Privacy Notice applies to all visitors and Users of the Platform, regardless of the device or method of access. It explains what information We collect, for what purposes, how long We retain it, and what rights You have regarding Your Personal Data.

Please read this Notice carefully before using the Platform or submitting any Personal Data.

By using the Platform, registering an Account, interacting with the Platform, or otherwise providing Us with Your Personal Data, You confirm that:

(I) You have read, understood, and agree to this Privacy Notice;

(II) You have reached the age at which You are legally allowed to give Consent to the Processing of Your Personal Data in Your jurisdiction. In any case, You must be at least 16 years old (or 13 in certain regions) or have obtained permission from a parent or legal guardian who agrees to this Privacy Notice on Your behalf.

If You do not agree with this Privacy Notice or any part of it, please do not use the Platform.

1. Definitions

For convenience, We use the following terms in this Privacy Notice:

"Privacy Notice" – this document, which is available at the following link: https://assistant.happ.tools/privacy-policy.

"Company" – Individual Entrepreneur Viacheslav Saloid, registered under the laws of Ukraine, tax identification number 3628308118, registration record №544422567292 dated 12.01.2022. Legal address: 47 Ilfa i Petrova Street, apt. 116, Odesa, 65122, Ukraine.

"Platform" – the digital environment available at https://assistant.happ.tools, managed by the Company, where Users can access the features of HAPP Assistant.

"Features" – the functionality and services available to the User via the Platform.

"Assistant" – an AI-powered voice assistant developed and provided by the Company. The Assistant is designed to automate routine voice communications in business processes and performs as a virtual agent, capable of answering incoming calls, interacting with users in real time, and executing various related functions.

"Content" – any materials, information, or intellectual property made available on the Platform, including (but not limited to) text, images, graphics, videos, audio files, software, and any other digital assets.

"Personal Data" – any information relating to an identified or identifiable natural person.

"Processing of Personal Data" – any operation or set of operations which is performed on Personal Data, whether or not by automated means, including but not limited to collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.

"Subject of Personal Data" – a natural person who accesses, uses, or interacts with the Platform and whose Personal Data is Processed in the context of such interaction (also referred to as "User", "You", "Your").

"Consent" – any freely given, specific, informed, and unambiguous indication of the User's wishes by which they, by a clear affirmative action, signify agreement to the Processing of their Personal Data.

"Third Party" – any legal person, public authority, agency, or body other than the Data Subject, the Controller, or the Processor, who may access Personal Data in accordance with the law or contractual obligation.

"Controller" – the Company, which determines the purposes and means of Processing of Personal Data.

"Processor" – a natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Controller.

"Cookies" – small text files that are stored on the User's device (such as a computer, tablet, or smartphone) when they visit the Platform. Cookies collect information about the User's interaction with the Platform, including preferences, login status, session duration, and browsing behavior.

"General Data Protection Regulation" (GDPR) – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

"CCPA" – California Consumer Privacy Act of 2018, applicable to Users from California, USA.

"CalOPPA" – California Online Privacy Protection Act of 2003.

2. Personal Data We Process when You use the Platform

2.1. Personal Data You provide to Us personally

When You choose to interact with the Platform, We may collect and Process certain Personal Data that You voluntarily provide to Us. This may occur, in particular, when:

• You contact Us via the contact form available on the Platform;
• You reach out to Us using the contacts provided on the Platform;
• or You initiate communication with Us in any other direct way.

At this stage, You may be asked to provide basic identifying and contact information, such as:

• Your full name;
• Your email address;
• Your phone number;
• the content of Your message.

This information is collected solely to allow Us to respond to Your inquiry, provide support, and begin business communication. You knowingly and voluntarily provide this information, and We Process it with care and respect.

In some cases — for example, if You decide to use Our Assistant service in Your business processes — additional categories of Personal Data may be collected. These may include:

• login credentials or passwords to access;
• integration tokens or unique keys for connecting to Your CRM system, telephony provider, or other services;
• information required for personalization of the Assistant's interaction (e.g., profile photo, gender, preferences, age, etc.).

Such Data is collected exclusively based on Your initiative and Consent, and only when You initiate Assistant configuration or cooperation with Us beyond general Platform use.

Additionally, when using Our Assistant service, Users or Third Parties interacting with the Assistant may voluntarily provide various categories of Personal Data, including — in some cases — special categories of Personal Data (as defined by Article 9 of the GDPR), such as health-related information, religious beliefs, political opinions, or other sensitive content.

Such information is not intentionally requested or required by Us, and We do not actively seek to collect or store special categories of Personal Data. However, We acknowledge the possibility that such Data may be shared voluntarily during interactions with the Assistant.

2.2. Personal Data We Process automatically

When You use the Platform, certain technical Data may be collected automatically by third-party analytics and tracking technologies that are integrated into Our Platform — specifically services such as Google Analytics or Meta Pixel.

The automatically collected Data may include:

• IP address;
• MAC address;
• browser type and version;
• operating system;
• screen resolution and device model;
• language and time zone;
• identifiers of the device (UDID, MEID);
• network provider and signal;
• traffic Data and browsing behavior (pages viewed, duration, clicks, navigation paths);
• Cookies, web beacons, and similar tracking technologies.

2.3. Our role as Controller and Processor

Depending on the context of Personal Data Processing, We may act either as a Controller or Processor under the meaning of the GDPR:

• when We collect and Process Personal Data of Our business clients (Users) (e.g., names, email addresses, login credentials, configuration preferences), We act as a Controller;
• when We Process Personal Data of end-users (e.g., phone call transcripts, voice recordings) on behalf of Our clients (Users) using the Assistant, We act as a Processor and perform such Processing solely under the instructions of the client (Users) and in accordance with a Data Processing Agreement (DPA).

3. Children's privacy

Protecting the privacy and safety of minors is very important to Us. We are committed to complying with data protection laws that regulate the Processing of children's Personal Data — including the GDPR, the Law of Ukraine "On Personal Data Protection", and other applicable regulations.

We do not knowingly Process the Personal Data of individuals under the age from which it is legally permitted to give valid Consent for the Processing of their Personal Data. In the EU, this age is generally 16 years, although in some countries it may be lowered to 13 years. In Ukraine, the minimum age is 14 years (with Consent of a legal representative), and full legal capacity is reached at 18.

We presume that by using the Platform, You confirm that:

• You have reached the legal age required to independently give Consent to the Processing of Your Personal Data in accordance with the legislation of Your country of residence;
• or that such Consent has been duly provided by Your legal representative (such as a parent or guardian).

If We discover that Personal Data has been provided by a person who has not reached the minimum legal age and such Consent was not obtained from a legal representative, We will take appropriate steps to delete this information as soon as reasonably possible.

4. Purposes of Personal Data Processing

We Process Your Personal Data solely for specific, lawful, and legitimate purposes, in line with the principles set out in the GDPR, the Law of Ukraine "On Personal Data Protection", and other applicable data protection legislation.

We do not Process Your Personal Data for any purposes beyond those described above. Should We intend to Process Your Data for purposes other than those stated, We will notify You in advance and, where required, request Your explicit Consent.

5. Legal basis for Processing Your Personal Data

We Process Your Personal Data only when We have a valid legal basis to do so, as defined by the GDPR and other applicable data protection laws.

6. Processing of special categories of Personal Data

In the course of using Our Assistant services, it is possible that You or other users may voluntarily disclose special categories of Personal Data — also referred to as sensitive data. This may include:

• Data revealing racial or ethnic origin;
• political opinions or religious or philosophical beliefs;
• trade union membership;
• genetic Data;
• biometric Data for uniquely identifying a natural person;
• health Data;
• Data concerning a person's sex life or sexual orientation.

We do not intentionally collect or Process such Data as part of the core functionality of the Platform. However, since the Assistant is capable of interacting with Users in real-time and receiving open-form inputs, there is a possibility that such Data may be shared voluntarily.

We Process special categories of Personal Data only under the conditions allowed by Article 9(2) of the GDPR, in particular based on explicit Consent or to protect vital interests.

7. Storage of Personal Data

7.1. How long do We keep Your Personal Data?

We retain Your Personal Data only for as long as it is necessary for the purposes for which it was collected.

7.2. Where do We store Your Personal Data?

Your Personal Data is hosted on servers located in Germany, within the European Economic Area (EEA), which ensures that the storage and Processing of Data complies with the strict privacy standards of the European Union.

7.3. Security of Your Personal Data

We have put in place appropriate security measures to prevent Your Personal Data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.

Organizational measures: Internal policies and instructions, Staff Training, Non-Disclosure Agreements (NDAs), Access control and role-based permissions, Action logging.

Technical measures: Data encryption, Data transfer protection (SSL, HTTPS), Two-factor authentication, Firewall, Backup, Automatic Data deletion after storage period.

8. Do We share Your Personal Data with Third Parties?

We never sell or rent Your Personal Data. We do not share it with Third Parties for their own marketing or advertising purposes, and We do not use it to train artificial intelligence or machine learning models.

We do share Personal Data in the four situations described below, and in no others.

8.1. Our own team. Personal Data is accessible to Our personnel — technical specialists, integrators and support staff — strictly on a need-to-know, role-based basis, only where necessary to operate and support the Platform. All such individuals are bound by confidentiality obligations, including non-disclosure agreements, and all access to production data is logged.

8.2. Service providers (Processors and Sub-processors). The Platform is built on third-party infrastructure and artificial intelligence services and cannot function without them. When You use the Assistant, the content of a conversation is transmitted to a large language model provider in order to generate a reply, and text is transmitted to a speech provider in order to generate audio. We engage each such provider under written data processing terms that restrict them to processing the data only on Our instructions, and — for the artificial intelligence providers — on terms that prohibit the use of the data to train their models.

The complete and current list of Our Sub-processors, naming each provider, what it Processes, where, and under which transfer safeguard, is published at happ.tools/subprocessors. We update that page before adding or replacing a Sub-processor, and business clients may subscribe there to receive 30 (thirty) days' advance notice of changes.

The main categories are: cloud infrastructure and hosting; large language model providers; speech synthesis and recognition providers; telephony and messaging providers, and CRM and booking systems, where You choose to connect them; authentication providers; transactional email and SMS; error diagnostics; and payment processing.

8.3. Business clients as Controllers. Where You are an end-user interacting with an Assistant operated by one of Our business clients, that client is the Controller of Your conversation Data and We act as its Processor. To exercise Your rights over that Data, please contact the business You were communicating with. If You contact Us instead, We are not permitted to act on the request ourselves — We will forward it to that client within 5 (five) business days and confirm to You that We have done so.

8.4. Corporate transactions. If We are involved in a merger, acquisition, financing due diligence, reorganisation or sale of assets, Personal Data may be disclosed to the counterparty and its advisers under confidentiality obligations, and may be transferred as part of that transaction. We will notify You before Your Personal Data becomes subject to a different privacy notice.

Authorities. We reserve the right to disclose and/or report any Personal Data of the User, if this is required by any law of Ukraine or the European Union or another normative legal act, or a confirmed legal requirement of state authority.

9. International transfers of Personal Data

Where the Data rests. All Personal Data is stored at rest on servers located in Frankfurt, Germany, within the European Economic Area (EEA). We do not change Our storage region without prior notice to Our business clients.

Access from Ukraine. We are established in Ukraine, and Our personnel access the Platform — and therefore the Personal Data stored on it — from Ukraine. Ukraine is not covered by an adequacy decision of the European Commission. That access is therefore itself a transfer of Personal Data to a third country, and We rely on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) as the transfer mechanism, supported by the measures listed below.

Transfers to service providers. To generate the Assistant's replies and speech, conversation content is transmitted to artificial intelligence providers, some of which are established in the United States. Certain messaging, authentication, notification and diagnostics providers likewise Process Data outside the EEA. Each such transfer, the provider concerned, and the safeguard relied upon are listed at happ.tools/subprocessors. These transfers are not limited to analytics and form part of the core provision of the Services.

Where We transfer Personal Data outside the EEA We rely on an adequacy decision of the European Commission where one applies to the recipient country or framework; on the Standard Contractual Clauses approved by the European Commission; or on certification under the EU-US Data Privacy Framework where the provider is certified.

In every case We also apply, as appropriate: contractual terms prohibiting artificial intelligence providers from using Your Data to train or improve their models, and zero-retention or limited-retention terms where the provider offers them; data minimisation — only the content needed to answer the specific request is transmitted, and call audio and media files are not sent to language model providers; encryption in transit (TLS 1.3) and at rest (AES-256-GCM); pseudonymisation of telemetry and exclusion of conversation content from application logs; and a documented policy of challenging any unlawful request for disclosure by a public authority, disclosing only the minimum necessary, and notifying the affected business client unless legally prohibited from doing so.

You may request a copy of the transfer safeguards We rely on, with commercially confidential terms redacted, by writing to [email protected].

10. Your rights regarding Personal Data

Under the GDPR, You have a set of rights that allow You to control how Your Personal Data is collected and used. You can exercise these rights at any time by contacting Us at [email protected].

We respond to all valid requests within 30 (thirty) calendar days of receipt.

11. Cookies

11.1. What are Cookies?

Cookies are small pieces of data (text files) that contain a unique User ID and information about how You use the Platform. Cookies are transmitted through a server and stored on Your device when You visit the Platform.

11.2. Consent to the use of Cookies

Cookies are not strictly necessary for visiting the Platform (except for the "strictly necessary" type of Cookies) and will be used by Us only after obtaining Your Consent to their use.

11.3. The types of Cookies We collect

11.4. How You can manage Cookies settings

You can manage and control the privacy Cookies settings through Your desktop browser's privacy or security settings.

• For Chrome: go to Settings > Privacy and Security > Cookies and other site data
• For Firefox: navigate to Settings > Privacy & Security
• For Safari: go to Preferences > Privacy

12. Sending marketing communications

By providing their Personal Data and checking the relevant box during registration or when submitting a contact form on the Platform, Users give their explicit Consent to receive marketing communications from the Company.

If You decide to withdraw Your Consent, You may unsubscribe at any time by clicking the "Unsubscribe" link in any of Our emails. You may also contact Us directly at [email protected] to stop receiving such communications.

13. External links

The Platform may contain links to external websites, platforms, or services that are not operated or controlled by the Company. Please note that We are not responsible for the content, privacy practices, or security of any third-party websites or services.

14. Changes to this Notice

We reserve the right to update or amend this Privacy Notice at any time and for any reason by publishing a new version on the Platform. We encourage You to review this Notice periodically to stay informed about any changes.

If the changes are substantial, We will notify You at least 15 (fifteen) calendar days before such changes take effect.

15. Dispute resolution

Before initiating legal proceedings in court, the User must first submit a written claim (a proposal for voluntary settlement of the dispute) to Us. Within 30 (thirty) calendar days of receiving the claim, We will respond in writing regarding the outcome of the claim review.

If no agreement is reached, the dispute shall be resolved by the competent courts of Ukraine, in accordance with the applicable legislation of Ukraine.

16. Contact information

If You have any questions, comments, or concerns regarding this Privacy Notice, please contact Us using any of the following methods:

• for data protection, privacy and data subject requests: [email protected] — the fastest route for anything covered by this Notice
• for contractual and legal notices: [email protected]
• for product support and general enquiries: [email protected]
• by phone: +38 (099) 482 9573
• by Telegram: @viacheslavsaloid
• or by using the contact form available on the Platform.

We will make every effort to respond as soon as possible, and no later than 30 (thirty) calendar days from the date of receiving Your inquiry.

17. Supervisory authorities

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of Your habitual residence, place of work, or the place of the alleged infringement. A list of the European authorities is published at edpb.europa.eu. Data subjects in Ukraine may complain to the Ukrainian Parliament Commissioner for Human Rights.

Exercising this right does not require You to contact Us first, although We would prefer the opportunity to resolve Your concern directly.

18. Additional information for residents of the United States of America

This section applies only if You are a resident of certain U.S. states that have implemented state-level privacy laws. You, as a Subject of Personal Data, have some special privacy rights. To use them, please contact Us at [email protected].

Please note: Depending on the state and legislative requirements, We have from 30 (thirty) to 60 (sixty) days to exercise Your request, with the right to postpone it for 30 (thirty) days more.

19. Additional information for residents of Ukraine

This section applies only to residents of Ukraine and is based on the Law of Ukraine "On Personal Data Protection" No. 2297-VI dated 01.06.2010.

As a resident of Ukraine, You have the right to:

• be informed about the sources, location, and purpose of the Processing of Your Personal Data;
• access Your Personal Data and receive a copy within 30 (thirty) calendar days after request;
• request correction or deletion of inaccurate or unlawfully processed Data;
• object to the Processing of Your Data in justified cases;
• withdraw Your Consent to Processing at any time;
• restrict or condition Your Consent when granting it;
• be protected from automated decisions that significantly affect You;
• file complaints to the Ukrainian Parliament Commissioner for Human Rights (ombudsman) or the court in case of violation of Data protection legislation.

To exercise any of these rights, please contact Us at: [email protected].