Privacy Policy

This policy explains how Havstack (“we”, “us”) collects and uses personal data when you visit havstack.io, request early access, or use a Havstack account. Havstack is operated by Ramshackle Capital AB, based in Stockholm, Sweden. We are the data controller for the processing described in this policy.

Contact: haven.app.project@gmail.com

Early access requests.

When you request early access we collect your email address, name and company name. We use it to contact you about early access, onboarding, and the development of Havstack. Legal basis: our legitimate interest in responding to your request and building the product you asked to try (Art. 6(1)(f) GDPR). You can ask us to delete you from this list at any time.

Accounts.

If you are invited to a Havstack workspace, we collect your email address, name, and authentication data needed to operate your account, and we log basic activity required to run the service securely (such as sign-in events). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Workspace content.

Documentation, requests, and other content that teams put into their Havstack workspace is controlled by the organization that owns that workspace. We process it on their behalf and on their instructions. Questions about that data should go to your workspace administrator.

Technical data.

Our hosting provider processes IP addresses and request logs as a technical necessity to deliver the site and protect it against abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

We do not use advertising trackers and we do not sell personal data.

We only use cookies that are necessary for the service to function, such as keeping you signed in. We do not use analytics or marketing cookies.

We use a small number of service providers (processors) to run Havstack:

• Supabase — database, authentication, and file storage
• Vercel — hosting and content delivery
• Resend — transactional email delivery

These providers process data on our behalf under data processing agreements. Some of them are based in, or use infrastructure in, the United States. Where data is transferred outside the EU/EEA, transfers are protected by the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

We do not share personal data with anyone else, except if required by law.

• Early access requests: until you ask to be removed, or until early access ends and we either onboard you or delete the list.
• Account data: for as long as your account exists, then deleted or anonymized within 90 days.
• Technical logs: retained by our hosting providers for their standard retention periods, typically 30–90 days.

Under the GDPR you have the right to access, correct, and delete your personal data, to restrict or object to processing, and to data portability. To exercise any of these rights, email haven.app.project@gmail.com. We will respond within one month.

You also have the right to lodge a complaint with a supervisory authority. In Sweden, that is the Swedish Authority for Privacy Protection (IMY), imy.se.

We may update this policy as Havstack develops. The date at the top reflects the latest version. If we make material changes to how we handle your data, we will notify account holders by email.