HAD · 22 October 2026
Privacy Policy
Controller and contact
HAAVIK APP DEVELOPMENT, organisation no. 935582016, Stampeverksvegen 5, 7056 RANHEIM, Norway, is responsible for the customer and business records it controls. Privacy requests can be sent to had.autonomousai@gmail.com. Where HAD processes a customer’s personal data on their behalf, the roles and any required data-processing agreement must be agreed before that processing.
Data and purposes
Depending on the enabled service, records include contact and business identifiers, client and order references, agreed specifications, correspondence, source files, deliverables, payment-status references, acceptance evidence and security/audit events. These support enquiries, contracts, secure access, delivery, dispute handling and required bookkeeping. This public-site candidate has no contact form, analytics, advertising scripts or marketing cookies.
Legal basis
Relevant bases must match each activity: necessary steps towards a contract and its performance where applicable; legitimate interests in secure operation and business-contact correspondence, with an assessment of those interests; and applicable legal obligations for records. Optional marketing would require a separate approved process and is not enabled. No blanket consent is inferred from visiting the site.
Service providers
The design uses Cloudflare for website and portal infrastructure, Google Gmail for authorised correspondence, OpenAI/Codex for approved development work, and Stripe for separately activated payments. The final processor list, contract terms, locations and any international-transfer safeguards must be verified before LIVE customer processing. Payment-card details are intended to be entered only in Stripe-hosted Checkout; this site does not collect card numbers.
AI input and confidential material
Only the minimum task material authorised for the agreed work should be submitted to AI tools. Do not send secrets, production access credentials, health data or other sensitive personal data in an ordinary enquiry. Supplier training or retention settings are not assumed; these and any customer processing restrictions must be confirmed before use.
Retention
Enquiry records, project materials and operational logs must have documented retention and deletion criteria tied to the purpose, contract, dispute needs and applicable record-keeping duties. Final periods and deletion procedures remain to be approved before commercial launch. Authentication expiry is separate from record deletion: the existing client-session design expires after eight hours, email login codes after ten minutes, and native-owner challenges after three minutes. These durations do not guarantee deletion of audit or financial records.
Access and rights
Clients are authorised only for their own records. Owner administration is reserved for the locally signed Control Center flow; it is not an email OWNER login. Depending on the applicable rules, you may request access, correction, deletion, restriction, portability or object to processing. We verify identity proportionately. Some records may need to be retained for a legal obligation or claim. You may complain to the Norwegian Data Protection Authority, Datatilsynet, at datatilsynet.no.
Launch requirements
Before this policy becomes a LIVE service notice, the owner must approve actual retention periods, processor agreements, transfers, security responsibilities and customer-contact procedures. This preparation does not certify GDPR compliance or activate processing of new customer projects.