Privacy notice
DT Global Ventures Ltd runs Haechy and decides how your account data is used. We collect your email, a check of your mobile number and what you do in Haechy, to run the service, keep abuse off it and improve it. For the data inside the apps you host, we act on your instructions as your processor.
Effective 6 November 2026. Last updated: 6 November 2026.
1. Who we are
Haechy is operated by DT Global Ventures Ltd, company number 16042336, 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom.
For anything about your personal data, write to privacy@haechy.com. Other contact addresses are on the trust page.
2. Two roles
We are the controller (we decide why and how the data is used) for your Haechy account, the check of your mobile number, support mail, messages sent through this website and the logs of how Haechy is used.
We are a processor (we act on the app owner's instructions) for the data inside an app you host on Haechy, including the people who sign in to that app. If you are a customer, you decide what goes into your app and why. The processing terms for that data are part of the terms of service.
3. What we collect
- Account: your email address, an optional name, your plan, your default region, how you arrived at Haechy (recorded once), a referral code if one was used, and the country your sign-up request came from.
- Mobile number check: at sign-up we send your number to Twilio to find out its country and line type and to send you a text-message code. We hold the number itself only while the code can still be entered (at most a day), and after that only a one-way hash of it. Records of each attempt are deleted after 30 days. Once you have verified, your account keeps only a one-way hash of the number (so one number can start only one free account) and its country.
- Sessions and Claude connections: hashed copies of your console session and of the tokens that let Claude act on your account, with expiry times, and the first part of your browser's user-agent text. Sign-in links are stored as hashes with the email they were sent to.
- Your workspace and apps: workspace members and their roles, app names, addresses, descriptions, regions and access settings, deploy records (status, check results, build output, errors), the outside services you approve and the reasons given, blocked attempts to reach other services, backup records and the number of emails your apps send.
- Results Claude asks us for: when Claude reads an app's logs or runs a database query for you, the result is stored briefly so Claude can fetch it.
- App settings and secrets: values you ask Claude to store for your app are encrypted before they are stored.
- Product events: a record of actions such as signing up, the outcome of the phone check (with country and line type), choosing a region, requesting an outside service (the main domain only) and signing in to an app (role and method, no email address).
- Activity log: who deployed, created or deleted an app, changed its access or members, asked for, approved, denied or removed an outside service, took or restored a backup, and requests for access to an app (including the requester's email).
- Support and enquiries: what you write to our addresses or through the contact form: name, email and message.
- This website: page requests reach our host, which sees technical details such as IP address and browser. We use cookieless, aggregate visit statistics.
- Payments: paid plans are not open yet. When they open, our payment provider will collect billing details and card data and we will update this notice.
4. Why we use it, and our lawful basis
| Purpose | Data | Lawful basis (UK and EU GDPR) |
|---|---|---|
| Providing Haechy: your account, apps, sign-in, backups, approvals | Account, workspace and app data, sessions, activity log | Contract |
| Keeping spam and abuse off Haechy, one free workspace per person, blocking sign-ups from countries we can't serve | Mobile number check, sign-up country, hashed number, blocked-request records | Legitimate interests (running a service that isn't abused). We use the number only for this, never for marketing, and never show it to other members. |
| Security and fixing faults | Logs, sessions, activity log, deploy records | Legitimate interests |
| Understanding how Haechy is used so we can improve it | Product events, aggregate website statistics | Legitimate interests |
| Answering questions and requests | Support mail, contact-form messages | Contract where you are a customer, otherwise legitimate interests |
| Meeting legal duties such as sanctions rules, tax and responding to lawful requests | Account and, later, billing data | Legal obligation |
We do not send marketing text messages. We do not sell your personal data.
5. People who sign in to apps hosted on Haechy
If you use an app that someone built on Haechy, the app's owner decided to collect and use your data and is responsible for it. Haechy sends you a sign-in link at the email address the owner invited, keeps a sign-in cookie for 12 hours and tells the app your email, name, role and an identifier. That identifier is a one-way hash of the app and your email, so you have a different identifier in each app.
We process this data for the app owner, to run sign-in. To see, correct or delete data an app holds about you, contact the app's owner first. If you can't reach them, write to privacy@haechy.com and we will pass your request on or deal with the part we hold. If you ask for access to an app you aren't allowed into, we record your email in that workspace's activity log and tell the owner. Sign-ins themselves are counted in our product events without your email address.
6. Who receives your data
We use a small number of companies to run Haechy: Amazon Web Services for hosting, storage, email and DNS; Twilio for the mobile number check; Vercel for this website; Resend to deliver contact-form messages; a Google-hosted mailbox for mail sent to our addresses; and Polar for payments once paid plans open. What each does, what data it sees and where is on the sub-processors page.
Anthropic is not our processor. When you use Haechy from Claude, your own Claude account sends requests to us, and whatever you show Claude (for example a key you type into the chat, a database result or a log) passes through Anthropic under your terms with them. We also disclose data to authorities or advisers when the law requires it or to protect our rights, and to a buyer if the business is sold.
Our staff can technically reach customer data on our servers. We limit that to what is needed to run and secure the service.
7. Where data is processed and international transfers
Our control plane (accounts, sign-in, approvals, settings, logs, activity records and encrypted secrets) runs in the United States, whatever region your apps use. Each app's running container, database and backups are in the region you chose for that app. Deploy bundles, app emails, and the log lines and query results returned to Claude also pass through the US. Our company is in the UK, and our providers operate in the US and elsewhere, so personal data from the UK, EU and EEA is transferred to countries outside them.
For those transfers we rely on the mechanisms the law provides: adequacy decisions where they exist, the EU-US Data Privacy Framework and its UK extension where the recipient is certified, and otherwise standard contractual clauses or the UK equivalents. We are still confirming which of these applies to each provider. If you would like details, ask at privacy@haechy.com.
Some services we use to send email, verify phone numbers and take payments process data outside your chosen region. See our sub-processors.
8. How long we keep it
| Data | Kept for |
|---|---|
| Mobile number during sign-up | Deleted 30 days after the attempt. On success, only a one-way hash and the country stay on the account. |
| Sign-in links, console sessions, Claude connection codes and tokens | Deleted 30 days after they expire or are revoked |
| App sign-in sessions | 12 hours (the cookie). On our side we keep only a product event without the email address, and access requests in the activity log. |
| Product events | 25 months |
| Activity log (deploys, approvals, app and member changes, backups and restores, access requests) | 400 days |
| Blocked outside-service attempts | 90 days |
| Deploy bundles in storage | 2 days |
| Nightly backups | 35 days in storage. What you can see and restore depends on your plan: 7 days on Free, 30 days on paid plans. |
| Weekly, manual, pre-restore and final-before-delete backups | 90 days |
| Mail sent to our addresses | 90 days in our mail store |
| A deleted app | Its container, database and address are removed straight away. A final backup is kept for 90 days, then deleted. |
| Your account | Until you ask us to delete it. We complete deletion requests within 30 days. Backups age out on the schedule above. |
Account, workspace and app records stay for as long as the account exists. Some records may be kept longer where the law requires it, or while we deal with a dispute, an abuse report or a legal claim.
9. Your rights
Under the UK and EU GDPR you can ask us for access to your personal data and a copy, correction, deletion, restriction of use, and transfer of data you gave us (where we use it under contract). You can object to use that rests on legitimate interests. Where we rely on consent you can withdraw it at any time.
Email privacy@haechy.com. There is no self-serve delete or export button in the console yet, so we handle requests by hand and may ask you to confirm who you are. You can complain to the Information Commissioner's Office in the UK (ico.org.uk) or to the data protection authority in the EU or EEA country where you live or work. We would like the chance to put things right first.
US residents. Many US states give residents the right to know what we hold, and to ask for access, correction and deletion. We do not sell personal information or share it for advertising across other companies' sites, so there is nothing to opt out of. We won't treat you worse for making a request. Use the same address.
Australia. You can ask for access to and correction of your personal information at the address above, and you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
10. Cookies
- This website sets no cookies. Its visit statistics are served from our own domain and are cookieless.
- The console (console.haechy.com) uses only cookies it needs to work:
__Host-haechy_consolekeeps you signed in (30 days),__Host-haechy_csrfprotects forms (30 days), and__Host-haechy_visitorremembers the email of someone verified for an app (12 hours). The console loads no analytics or third-party scripts. - Apps on
haechy.appget one sign-in cookie,__Host-haechy_session, which lasts 12 hours. An app's owner may add their own cookies; that is their responsibility.
11. Security
We describe the controls we use on the security page. They reduce risk; they don't remove it.
12. Children
Haechy is not for anyone under 18, and we don't knowingly collect data from them. If you think a child has signed up, tell us and we will delete the account.
13. Changes to this notice
If we change this notice in a way that matters, we will update the date at the top and tell account owners by email before the change applies. Questions: privacy@haechy.com, or the contact page.