Privacy Policy

1. Data Controller

2. Data Collected

In particular, we process the following personal data:

• Email address (at registration)
• Name or display name (at registration)
• Content you create in your crews, such as ideas, happenings, comments, messages, tasks, notes, ratings and votes
• Usage data (access times, pages visited)
• Device information (browser type, operating system, IP address)

Expenses

When you use the Expenses module, we process amounts, descriptions (including custom category names, e.g. “Ben's gift”), date, category, who paid, who is included, and recorded settlements. This information is visible to the members of your crew who have access. The legal basis is Art. 6(1)(b) GDPR (use of the feature). We do not use expense entries for AI suggestions.

After you delete your account, we remove the link between these entries and your profile. Details may still be attributable to you through their content or context, for example through a description like “Ben's birthday dinner”. Descriptions and amounts are kept as long as the related happening exists, so that the other members can follow their own expenses and shares (Art. 6(1)(f) GDPR). If the creator or an admin deletes the happening, its expenses and settlements are deleted as well. If you leave the crew, your name stays visible to members on the entries you were part of. If you leave it yourself while you still have something to give back in a happening, members who paid for you directly and still get something back from you can also see your email address so they can reach you (Art. 6(1)(f) GDPR). We tell you about this before you leave. Once everything between you is settled, the address is no longer visible. If you are removed from the crew, your email address stays hidden. For this rule, we only keep a note that you left yourself and delete it at the latest one day after nothing is open in this crew any more.

You can delete your own entries yourself at any time. If you are no longer a member of the crew, have deleted your account, or are named in someone else's description, contact helpme@hapnua.com for access, rectification, erasure or objection. We review the request and have the affected entries deleted or neutralised by the creator or an admin.

3. Legal Basis

For your account, the planning features and the necessary sign-in emails, we process the data required in each case on the basis of Art. 6(1)(b) GDPR (contract). Security logs, such as server logs to prevent misuse, and the continued existence of shared crew content after an account is deleted are based on Art. 6(1)(f) GDPR. Our legitimate interest is secure, reliable operation and the shared planning of the other crew members. Where we are legally obliged to retain data, Art. 6(1)(c) GDPR applies.

4. Recipients and service providers

We use the following service providers to operate Hapnua:

5. Cookies

Hapnua only uses technically necessary cookies. We do not use tracking or marketing cookies.

6. Data Retention

We store your data for as long as your account exists. When you delete your account, we immediately delete your profile, your sign-in data and your personal contributions, i.e. your ideas, comments, messages, likes, ratings and votes. Content you created for a crew, such as happenings, tasks, notes, date proposals and expenses, remains available to the other members because it is part of their shared planning. We remove the link to your profile, but its content may still point to you. For entries in the Expenses module, section 2, “Expenses”, also applies. If you want such content to be deleted as well, write to us at helpme@hapnua.com. We review your request and implement requests you are entitled to. As proof of deletion, we keep a log entry with an internal identifier, without your name or email address. Deleted data remains in database backups for up to seven days. Data we are legally obliged to retain, such as billing records, is deleted only after the statutory period has expired.

7. Your rights (Art. 15–22 GDPR)

You have the following rights. To exercise them, write to us at helpme@hapnua.com.

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

8. Supervisory Authority

You can lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.