Privacy Policy

1. Data Controller Information

Data Controller: Hanniel Solutions Ltd (trading as HannVerse Compliance Cloud)

• Data Protection Officer: dpo@hannverse.com
• Privacy Contact: privacy@hannverse.com
• Website: https://hannverse.com

2. Data We Collect

2.1 Account Information

2.2 Usage Data

• Documents created, viewed, edited, deleted
• Features used (AI services, translations, transcriptions)
• Login times, session duration, IP addresses
• Device information (browser, OS, device type)
• Workflow and approval actions

2.3 Payment Data

• Billing name and address
• Payment method (via Stripe - we do NOT store card details)
• Transaction history and invoices

2.4 Document Content

• RAMS, risk assessments, permits, incident reports
• Uploaded files and attachments
• Voice recordings (for transcription)
• Comments and annotations

3. How We Use Data

3.1 Service Provision

• Creating and managing your account
• Providing access to the Platform
• Processing documents and AI services
• Storing and retrieving your content
• Enabling collaboration features

3.2 Business Operations

• Processing payments and billing
• Preventing fraud and abuse
• Enforcing Terms & Conditions
• Managing subscriptions

3.3 Marketing (with consent)

• Sending product updates and newsletters
• Providing educational content
• Announcing new features

Note: You can opt out of marketing at any time via account settings or unsubscribe links.

4. Legal Basis for Processing (GDPR)

For EU/UK users, we process data under the following legal bases:

5. Data Sharing

We do NOT sell your data. We only share data in the following circumstances:

5.1 Service Providers (Processors)

We engage third-party processors who help us deliver services:

• Hosting: Vercel (frontend), Render (backend), AWS S3 (file storage)
• Database: PostgreSQL on Render
• Payment: Stripe (payment processing)
• Email: Resend (transactional emails)
• AI Services: OpenAI (Whisper transcription), DeepL (translation), Azure Form Recognizer / AWS Textract (document processing)
• Monitoring: Sentry (error tracking)

All processors are bound by Data Processing Agreements (Article 28 GDPR).

9. Your Rights

You have the following rights regarding your personal data:

9.1 Right to Access (Article 15)

Request a copy of your personal data we hold. We will provide this within 30 days.

9.2 Right to Rectification (Article 16)

Correct inaccurate or incomplete data via account settings or by contacting us.

9.3 Right to Erasure ("Right to be Forgotten") (Article 17)

Request deletion of your data. We will comply unless legal retention requirements apply.

9.4 Right to Data Portability (Article 20)

Receive your data in machine-readable format (JSON/CSV export available).

9.5 Right to Lodge a Complaint

Complain to your local data protection authority:

• UK: Information Commissioner's Office (ICO) - https://ico.org.uk
• EU: Your national Data Protection Authority
• Canada: Office of the Privacy Commissioner - https://priv.gc.ca
• California: California Attorney General - https://oag.ca.gov

To Exercise Your Rights: Email privacy@hannverse.com with your request. We will respond within 30 days.

12. Region-Specific Privacy Rights

12.1 European Union & United Kingdom (GDPR/UK GDPR)

EU/UK residents have all rights listed in Section 9 under GDPR/UK GDPR. We are your data controller and process data as outlined in this policy.

12.2 California (CCPA/CPRA)

California residents have additional rights:

• Right to Know: Request disclosure of data categories collected
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt out of "sale" of personal information (Note: We do NOT sell data)
• Right to Non-Discrimination: We will not discriminate for exercising CCPA rights

12.3 Canada (PIPEDA)

Canadian residents have rights to:

• Access personal information we hold
• Correct inaccuracies
• Challenge our compliance
• Withdraw consent (where applicable)

12.4 United Arab Emirates (DIFC Data Protection Law)

UAE residents under DIFC jurisdiction have rights similar to GDPR, including access, correction, erasure, and complaint to the Commissioner of Data Protection.