Privacy Policy

Hakkan is operated by Alroy Ndhlovu, a sole proprietor based in South Africa (the “Provider”, “we”, “us”). For the purposes of the Protection of Personal Information Act, 2013 (POPIA), we are the responsible party for your personal information, and Alroy Ndhlovu is the Information Officer. Where the EU or UK General Data Protection Regulation (GDPR) applies to you, we act as the data controller for account data and, for the content you submit for processing, as described below.

• Account information you give us: email address, and optionally your name, occupation, timezone, and avatar.
• Content you submit: the topics and questions you research, and the writing samples you paste to train a voice profile. We keep the voice profile we derive (tone, rhythm, sample phrases), not the raw samples themselves.
• Files you upload: research documents (PDF, Word, text) and photos of written notes. These are read in memory to pull out the research question and its claims, then discarded. We never store the file itself. What we keep is what you see on screen before you run anything: the question and the claims, saved with that piece of research exactly as if you had typed them. To read a file we send its contents to our AI provider, which is covered under Sub-processors below.
• Research data we retrieve for you: publicly available social media posts, comments, and web content relevant to your topics, together with their source links and author handles, and the reports and content we generate from them.
• Usage data: how many studies and content pieces you run, so we can meter your plan, plus basic technical logs and error reports.
• Payment information: handled by Paddle (see below). We do not see or store your card number. We keep a Paddle customer reference and your subscription status so we know what plan you are on.

• To provide the service: run research, generate content, and store your reports.
• To meter your plan, take payment, and manage your subscription.
• To send transactional messages (for example, when a research run finishes).
• To keep the service secure, debug errors, and prevent abuse.
• To send optional product updates only if you opt in. We never pre-tick marketing consent.

We use a small set of trusted providers to run Hakkan. Some of them process the content you submit. In particular, your topics, retrieved research data, and reports are sent to large language model providers to filter, cluster, and generate reports and content.

• SocialCrawl (Ridio Company): retrieves publicly available social media and web data for your topics.
• Anthropic and xAI (Grok): large language models that process your topics and research data to produce reports and content. Both exclude API traffic from model training by default under their commercial terms. Anthropic deletes API logs after 7 days and xAI after 30.
• Anything you upload is handled by Anthropic only. Files you upload are your own material rather than public data we fetched, so we send them to the provider with the shortest retention window and no fallback. If that provider is unavailable, the upload fails rather than being routed somewhere else.
• Supabase: database, authentication, and file storage.
• Paddle: our payment processor and Merchant of Record (see the Terms). Paddle handles checkout, card data, and tax.
• Hostinger: application hosting.
• Sentry: error monitoring.

We do not sell your personal information, and we do not share it with advertisers.

Hakkan’s research draws on publicly available social media and web content, retrieved through third-party providers rather than official platform partnerships. We store only what a report needs, together with the source link so every claim can be traced. We do not build advertising profiles of the people whose public posts appear in your research, and if someone asks us to remove data about them, we will honour that request where we are able to identify it.

We keep your information only as long as necessary for the purposes above, consistent with POPIA and GDPR’s storage-limitation principle:

• While your account is open: your account data, personas, and reports are kept so the product works.
• When you delete your account: we erase your personal data from our live systems promptly. Residual copies in encrypted backups are purged within 30 days as those backups rotate. You can also export your data or delete your account at any time from Settings.
• Billing records: Paddle, as Merchant of Record, retains transaction records it is required to keep for tax and accounting law, even after you delete your account. This is permitted under GDPR Article 17(3)(b).

Under POPIA and, where it applies, GDPR, you have the right to access, correct, and delete your personal information, to object to or restrict certain processing, to withdraw consent, and to data portability. You can export your data and delete your account directly in Settings, or contact us to exercise any of these rights. You also have the right to lodge a complaint with the Information Regulator of South Africa, or with your local supervisory authority in the EU or UK.

We protect your data with row-level access controls so each account can reach only its own data, encryption in transit, secrets kept out of client code, and input validation on the server. No system is perfectly secure, but we work to current best practice and fix issues promptly when we find them.

Some of our providers are located outside South Africa. Where your personal information is transferred abroad, we rely on the providers’ own safeguards and contractual protections to keep it protected to a standard consistent with POPIA and GDPR.

We use only the cookies needed to keep you signed in and to keep the service secure. We do not use advertising or cross-site tracking cookies.

Hakkan is not intended for anyone under 18, and we do not knowingly collect personal information from children.

We may update this policy as the product changes. We will update the date at the top, and for material changes we will give notice in the app or by email.

For any privacy question or to exercise your rights, contact the Information Officer at privacy@hakkan.app. General enquiries: hello@alroyndhlovu.com.