Privacy Policy · Haulbi

1. Introduction

This Privacy Policy explains how Haulbi (“Haulbi”, “we”, “us”) processes personal data when you visit our website, sign up for an account, or otherwise interact with our services. We are committed to processing your data lawfully, transparently and only for specified purposes in line with the EU General Data Protection Regulation (“GDPR”, German implementation: “DSGVO”) and other applicable data-protection laws.

Controller: Haulbi GmbH[TODO: legal review — verify the legal entity name and registration]
Köpenicker Straße 154
10997 Berlin
Germany
Contact: hello@haulbi.com
Data Protection Officer: dpo@haulbi.com[TODO: legal review — confirm DPO name and postal address once appointed]
Represented by: [TODO: legal review — list of Geschäftsführer]

2. What data we collect

We process personal data only to the extent necessary to provide our services, comply with legal obligations, or pursue legitimate interests. The categories below describe the data we may collect:

2.1 Account data

When you register for a Haulbi workspace, we collect your name, work email address, company name, role and authentication credentials. If you sign in via a third-party identity provider (e.g. SSO), we receive the profile attributes your provider releases.

2.2 Usage data

Within an active workspace we process the operational data required to deliver our wholesale-OS features: CRM records, ERP documents, journal entries and configuration. This data is controlled by your organization and processed on your behalf under the Data Processing Agreement.

2.3 Log & telemetry data

Our infrastructure records technical information such as IP address, request timestamps, browser type, referring URL and error traces. We use this data to operate, secure and improve the service.

2.4 Cookies & similar technologies

We use a small set of cookies and similar storage technologies on our marketing website and inside the application. See our Cookie Policy for the full inventory.

3. Why we process it (legal basis)

Each processing activity relies on one or more of the legal bases defined in Art. 6 (1) GDPR:

Contract (Art. 6 (1) (b) GDPR) — to provide the service you signed up for, authenticate you, and process payments.
Legitimate interest (Art. 6 (1) (f) GDPR) — to secure our infrastructure, prevent abuse, measure aggregate usage, and improve product quality. We balance our interests against your rights on a case-by-case basis.
Consent (Art. 6 (1) (a) GDPR) — for non-essential cookies, marketing emails, and any optional integrations that rely on your explicit opt-in. You can withdraw consent at any time without affecting prior lawful processing.
Legal obligation (Art. 6 (1) (c) GDPR) — to comply with tax, commercial and anti-money-laundering laws.

5. Who we share it with

We do not sell personal data, and we do not share it with third parties for their own marketing purposes. We only disclose data where it is necessary to operate Haulbi, comply with the law, or enforce our terms. Typical recipients are:

Hosting & infrastructure — [TODO: confirm hosting provider — placeholder: Vercel Inc., EU region] for application hosting, edge network and object storage.
Email delivery — [TODO: confirm transactional email provider — placeholder: Postmark / SMTP] for sending account, billing and operational emails.
Payment processing — [TODO: confirm payment processor — placeholder: Stripe] for handling subscription payments. Card data is collected and stored directly by the payment processor under PCI-DSS.
Customer support tooling — internal ticketing and knowledge-base tooling, used solely to respond to your requests.
Authorities — where compelled by valid legal process.

Data processed on behalf of customers is handled under our Data Processing Agreement; sub-processors are listed and notified there.

6. International transfers

Personal data of EU/EEA residents is primarily processed within the European Union. Where a transfer to a third country is necessary (for example because a sub-processor stores data outside the EEA), we rely on:

Adequacy decisions adopted by the European Commission under Art. 45 GDPR, or
The EU Standard Contractual Clauses (SCCs) together with the supplementary measures required by the Schrems II judgment.

You can request a copy of the safeguards applied to a specific transfer by emailing our Data Protection Officer.

7. How long we keep data

We retain personal data only for as long as needed to fulfil the purpose for which it was collected, plus any statutory retention period that applies. Specifically:

Account data — for the duration of the contractual relationship and a transition window of up to 30 days after termination, after which it is deleted or anonymised.
Operational data in your workspace — until you delete it or close the workspace, subject to mandatory retention periods (typically 6–10 years for accounting records under § 147 AO and § 257 HGB).
Log & security data — typically 30 to 180 days, unless required for an active investigation.

8. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you (Art. 15),
Rectify inaccurate or incomplete data (Art. 16),
Request erasure of your data, where applicable (Art. 17, “right to be forgotten”),
Restrict the processing of your data in defined circumstances (Art. 18),
Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (Art. 20, data portability),
Object to processing based on legitimate interest or for direct marketing (Art. 21),
Lodge a complaint with a supervisory authority — in particular the authority of your habitual residence, place of work or place of the alleged infringement (Art. 77).

To exercise any of these rights, contact us at hello@haulbi.com. We will respond within one month as required by Art. 12 (3) GDPR.

9. Cookies

For details on the cookies and similar technologies we use, their purpose, duration and how to opt out, see our Cookie Policy.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced at least 30 days in advance by email (for active customers) and by a prominent banner on this website. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact

Questions about this policy or about how we handle your data? Email hello@haulbi.com or use our contact form.