Privacy Policy

1. Who we are

This policy is issued by Haveio Ltd (company number 17455280), registered in England & Wales (“Haveio”, “we”, “us”). You can contact us about this policy at legal@haveio.co.uk. Our registered office is Suite Ra01, 195-197 Wood Street, London, England, E17 3NU.

2. What this policy covers

This policy covers two related but distinct things:

• the public marketing website at haveio.co.uk, including the contact/early-access form; and
• the Haveio product (“the Platform”) at app.haveio.co.uk, used by business customers and the people they invite (employees, managers, admins).

3. Two different roles Haveio plays

For the marketing website and enquiries sent to us directly, Haveio is the data controller — we decide why and how that information is used.

For information a customer organisation enters into the Platform about its own people — names, contact details, onboarding information, HR records, uploaded documents, signatures — the customer organisation is the data controller, and Haveio acts as a data processor, processing that data only under the customer’s instructions and for the purpose of providing the Platform. A separate data processing agreement between Haveio and each customer is intended to govern this relationship in detail. That agreement has not yet been finalised — see Section 13.

4. Information we collect

Website enquiries. If you submit the Contact or Early Access form, we receive your name, work email address, company name, job role, company size, area of interest and any free-text message you write. This is emailed to us via the Resend email service. A hidden anti-spam field is also submitted but is never populated by a genuine visitor. Where the underlying hosting infrastructure (Cloudflare) applies rate-limiting to reduce abuse of the form, an IP address may be processed briefly for that purpose.

Account information. When someone creates a Platform account: name, email address, a password (stored only as a salted cryptographic hash, never in plain text), an optional profile image, and two-factor authentication enrolment status (the 2FA secret itself is stored encrypted, and one-time recovery codes are stored only as one-way hashes — never the recovery codes themselves).

Organisation information. Company name, legal name, company number, industry, plan and support contact details, entered by a customer’s administrator when setting up their account.

Employee/HR records. Entered by a customer’s administrators, or by employees themselves during onboarding, which may include: legal name, preferred name, date of birth, personal and work email address, phone number, home address, National Insurance number, payroll number, pay frequency, job title, department, work location, manager, employment type, contracted hours, start date, and (where applicable) end date and reason for leaving, plus emergency contact details.

Onboarding submissions. The information above, plus right-to-work status, the file name of an uploaded ID document, and confirmation that required policies or a contract have been acknowledged. Bank account details for payroll are not currently captured by this table in the product — only a yes/no flag that details were provided elsewhere — and how (or whether) full bank details will be collected and stored is an open decision; see Section 13.

Uploaded documents. Contracts, policies, certificates, identity documents and company documents are stored as files in Supabase Storage in a private, access-controlled bucket — never a public URL. The Platform generates short-lived signed links to a file only when someone with permission needs to view it.

E-signatures. When a document is signed, we record: the method used (drawn, typed, or an uploaded signature image), the signature image or typed name, a cryptographic checksum proving exactly which version of the document was signed, an explicit confirmation-of-intent flag, and — as evidence that the signature is genuine — the signer’s IP address, browser/device user-agent string and the exact timestamp.

Audit and activity logs. An append-only, technical record of significant actions taken within an organisation’s account (who did what, and when), plus a human-readable activity history against each employee’s record. These logs exist for accountability, dispute resolution and security investigation, and the product does not provide any way to edit or delete an existing entry.

Other workplace records, where a customer organisation uses the relevant module: payslips (issued as files in Supabase Storage), compliance records, training records, shifts/rotas, attendance, leave requests, job postings, and internal announcements.

Security and sign-in information. Session identifiers that keep you signed in; records of failed login attempts and any resulting temporary lockout; password-reset and email-verification requests (only a one-way hash of the underlying code is ever stored); and two-factor sign-in challenge records.

Notifications. In-product notification content, and each person’s notification preferences.

5. How we use it

• To provide, operate and secure the Platform and the specific features a customer organisation has enabled.
• To respond to enquiries and understand interest in Haveio.
• To authenticate users, protect accounts, and investigate suspected misuse, using the audit, login-attempt and signature-evidence records described above.
• To meet our own legal, tax and accounting obligations.

We do not sell personal information, and we do not use data that customers put into the Platform for our own advertising or profiling.

6. Our legal bases for processing (UK GDPR)

Website enquiries: our legitimate interest in responding to you and developing the business, or steps you have asked us to take before entering into a contract.

Platform account and security data: performance of our contract with the customer organisation, and our legitimate interest in keeping the service secure and reliable.

Employee/HR data entered into the Platform: this is processed by Haveio on the instructions of, and on behalf of, the customer organisation. The customer organisation, as controller, is responsible for identifying its own lawful basis (for example, the employment contract, a legal obligation, or its own legitimate interests). This division of responsibility is intended to be set out fully in the data processing agreement referred to in Section 3, which has not yet been finalised.

7. Who we share information with

We use a small number of service providers (“processors”/“sub-processors”) to run Haveio:

• Supabase — hosts the Platform’s database and file storage. Current architecture intends this to be hosted in the EU. Confirming that the live Supabase project region matches this intention is an open action — see Section 13.
• Vercel — hosts the running Platform application. Confirming the specific hosting region(s) is an open action — see Section 13.
• Cloudflare — hosts and delivers the marketing website, and provides basic bot/rate-limit protection on the contact form.
• Resend — delivers transactional email, including account invitations, email verification, password reset messages, two-factor sign-in codes, and notifications of website enquiries, sent from the send.haveio.co.uk domain.

We only share personal information with these providers to the extent needed to run the service, under their own terms. We do not sell or rent personal information to third parties.