Privacy Policy

This Privacy Notice describes how Hibana Labs B.V. ("we", "us", or "our") collects, uses, and shares information about you when you visit our website https://hibana.ai, or contact us for information.

We are committed to protecting your privacy and handling your personal data in an open and transparent manner, in compliance with the General Data Protection Regulation (GDPR).

This notice applies only to this website, related marketing activities and customer interactions. It does not apply to the use of any of our final products and deployed solutions, which is governed by a separate privacy notice.

The controller responsible for the processing of personal data described in this notice is:

Legal Representatives: Mehran Mehri (CEO) and Roberto Alonso (CTO)
Email: privacy@hibana.ai

Within the scope defined in this privacy notice, we are not legally required to appoint a Data Protection Officer (DPO). If you have any questions about data protection, you can reach us at the contact details provided above.

We process your personal data for various purposes based on different legal grounds.

When You Visit Our Website (Server Log Files)

When you access our website, our server automatically collects information that your browser transmits. This data includes:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website from which the access is made (Referrer URL)
• Browser type and version, and your computer's operating system

We process this data for the following purposes:

• To ensure a smooth connection and comfortable use of our website.
• To evaluate system security and stability.
• For administrative purposes and to detect and prevent misuse.

The legal basis for this processing is our legitimate interest (Article 6(1)(f) GDPR) in maintaining the security and functionality of our online presence. This data is not merged with other data sources and is typically deleted after 30 days.

When You Visit Our Website (Web Analytics)

We use Cloudflare Web Analytics, provided by Cloudflare, Inc., to understand how many people visit our website and how it performs. It does not use cookies or similar technologies, does not track you across websites and does not build profiles of individual visitors. It measures:

• Pages visited
• Referrer (the website you came from)
• Browser and device type
• Approximate country
• Page loading performance

The purpose is to measure traffic and improve our website. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in understanding and improving our online presence. Cloudflare acts as our processor under the same Data Processing Agreement described in section 4.

When You Contact Us (Contact Form and Email)

When you send us a message through the contact form on our website, the information you enter is transmitted to us by our form service provider, Web3Forms, which acts on our behalf as a processor. This includes:

• Your name
• Your email address
• Your company or organization (optional)
• The content of your message

The purpose of this processing is to receive and answer your enquiry. The legal basis is our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR), or, if your enquiry relates to entering into a contract with us, pre-contractual measures (Article 6(1)(b) GDPR). If you write to us by email instead, we process the same kind of information on the same basis.

For more information about how Web3Forms handles data, please see their Privacy Policy: https://web3forms.com/privacy.

When We Manage Scheduled Interviews (Google Calendar)

For organizing and keeping track of customer interviews and product feedback sessions, we may use Google Calendar. This involves processing:

• Your name and email address
• Details related to the scheduled interview

The purpose is the effective organization of our customer outreach and market research. The legal basis is your consent (Article 6(1)(a) GDPR), which you provide by agreeing to the interview, or as a pre-contractual measure (Article 6(1)(b) GDPR) if it relates to a potential purchase. Google acts as a data processor, and data may be processed on servers in the U.S.

We have a Data Processing Agreement with Google that incorporates the EU Standard Contractual Clauses (SCCs). For more information, please review Google's Privacy Policy: https://policies.google.com/privacy.

When We Conduct Prospect or Customer Interviews (Google Meet and Gemini)

For (prospective) customer interviews, we may use Google Meet for video calls and Gemini for note-taking. This involves processing:

• Your name and email address
• Content of the interview, including any notes taken

The purpose is to gather feedback and insights from our (prospective) customers to improve our products and services. The legal basis is your consent (Article 6(1)(a) GDPR) when you agree to participate in the interview.

Google acts as a data processor, and data may be processed on servers in the U.S. We have a Data Processing Agreement with Google that incorporates the EU Standard Contractual Clauses (SCCs). For more information, please review Google's Privacy Policy: https://policies.google.com/privacy.

Our website is hosted by Cloudflare, Inc. The technical data described under "Server Log Files" above is processed on their infrastructure.

• Global Network: Cloudflare delivers websites through a worldwide network of servers. Your request is usually handled by a server close to your location, which may be outside the European Union.
• Data Processing Agreement (DPA): We maintain a Data Processing Agreement (DPA) with Cloudflare, which governs the processing of your personal data and ensures compliance with applicable data protection laws.
• International Data Transfers: Where personal data is transferred outside the EU (for example, to the United States), such transfers are regulated by our DPA and safeguarded through the EU Standard Contractual Clauses (SCCs).

Our website does not use cookies for tracking, analytics or advertising. Our web analytics (see section 3) are cookieless.

The website stores one preference in your browser's local storage: your choice of light or dark appearance. This information stays on your device and is not sent to us. Our hosting provider may also use strictly necessary technical cookies for security purposes.

You can delete stored data or block cookies at any time through your browser settings. For more information, please refer to our Cookie Policy.

We only store your personal data for as long as it is necessary for the purposes for which it was collected or to comply with legal obligations.

• Server Log Data: Deleted within 30 days.
• Web Analytics Data: Kept only in aggregated form, for as long as needed to understand traffic to our website.
• Contact Enquiries: Data from your enquiries will be deleted once the matter is resolved. If it results in a business relationship, we are subject to statutory retention periods under Dutch and German commercial law and must store it for up to 10 years.

You have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): To request information about the data we hold about you.
• Right to Rectification (Art. 16 GDPR): To have inaccurate data corrected.
• Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR): To have your data deleted, provided there are no legal grounds for us to retain it.
• Right to Restriction of Processing (Art. 18 GDPR): To request a limitation on the processing of your data.
• Right to Data Portability (Art. 20 GDPR): To receive your data in a machine-readable format.
• Right to Withdraw Consent (Art. 7(3) GDPR): If processing is based on your consent, you can withdraw it at any time.

Right to Object (Article 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on our legitimate interests (Article 6(1)(f) GDPR). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms.

To exercise any of these rights, please contact us at privacy@hibana.ai.

You have the right to lodge a complaint with a data protection supervisory authority. As our main establishment is in the Netherlands, our lead supervisory authority is the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
Website: https://autoriteitpersoonsgegevens.nl/

You also have the right to lodge a complaint with your local supervisory authority, for example, if you reside in Germany.

We do not use your personal data for automated decision-making or profiling.