Privacy Policy

Updated 17.08.2026

1. Who is responsible for your data

The controller is Good Point GmbH, Liechtensteinstraße 63/10, 1090 Vienna, Austria. Data protection enquiries: support@hanc.ai.

This policy covers the processing that happens in HANC Studio (studio.hanc.ai). Processing in the HANC product and on hanc.ai is described in the policies of those services.

2. Two different roles

  • The data of your Studio account we process as controller.
  • Your working material, and the data collected by the agents you build, we process as processor on your instructions. There you are the controller: the lawful basis, informing the people concerned and answering their requests are yours.

3. What we process

  • Account: email address, name, company name, password hash, email confirmation status, role, chosen language and interface theme.
  • Sign in with HANC AI: the identifier, email address and name HANC returns when you agree to link the accounts.
  • Working material: the brief, the conversation with the builder, uploaded documents and images, the address of your website and its publicly available content, the assembled workflows and their versions, verification reports and test-run records.
  • Technical data: IP address, user agent, request time and path, response codes, errors, rate-limit and lockout counters.
  • Payment: the Stripe customer identifier, purchases, amounts, payment status and invoices. Card details are handled by Stripe and never reach us.
  • Support: the content of your message and the address it came from.

4. Purposes and legal bases

  • Running the service, assembling and verifying workflows, publishing agents — performance of the contract, Art. 6(1)(b) GDPR.
  • Registration, sign-in and email confirmation — performance of the contract, Art. 6(1)(b) GDPR.
  • Bot and abuse protection, rate limits, security logs — legitimate interest, Art. 6(1)(f) GDPR.
  • Taking payment, accounting and invoicing — performance of the contract and legal obligation, Art. 6(1)(b) and (c) GDPR.
  • Improving build quality from aggregated, de-identified statistics — legitimate interest, Art. 6(1)(f) GDPR.
  • Product emails unrelated to running the service — consent, Art. 6(1)(a) GDPR, withdrawable at any time.

5. Cookies and local storage

We use no third-party advertising or analytics cookies.

  • hsa_auth — the sign-in session, HttpOnly, required for the service to work.
  • hsa_sso — a short-lived marker for signing in with HANC AI, valid for 10 minutes.
  • hanc_lang — the language you chose for these pages.
  • The bot check at registration is performed by Cloudflare Turnstile, which sets its own technical cookies.
  • Browser local storage keeps the language (hanc_lang) and the colour theme (hs-theme).

6. Who we share data with

We do not sell data. We use processors, each under an agreement meeting Art. 28 GDPR:

  • Microsoft (Azure OpenAI Service) — workflow generation, embeddings, reading attachments. Processed in the EU region; the provider does not train its models on API data.
  • Stripe Payments Europe — taking payment and issuing invoices.
  • Cloudflare — bot protection and traffic delivery.
  • MongoDB Atlas — storage of the Studio database in the EU.
  • A server operator in Germany — hosting of the application.
  • An email delivery provider — confirmation and notification messages.
  • HANC AI — publishing the agents you build, and signing in with HANC where you choose it.

A current list of processors is available on request at support@hanc.ai. We also disclose data where the law requires it.

7. Transfers outside the EEA

Data is processed in the European Union. Where an individual operation requires a transfer to a third country, it is covered by the EU Standard Contractual Clauses and supplementary technical measures. Details of a specific transfer are available on request.

8. Model training

Your material and your callers’ data are not used to train our models or anyone else’s. The reference workflow library is extended only with samples we author ourselves or receive with a customer’s explicit consent.

9. How long we keep data

  • Account and working material — for as long as the account exists, and up to 30 days after deletion in backups.
  • Technical logs — as a rule no longer than 90 days.
  • Payment records and invoices — 7 years, as required by § 132 of the Austrian Federal Fiscal Code.
  • Data collected by your agents is kept for as long as you decide, and is deleted earlier on your request.

10. Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to receive it in a portable format, to object to processing based on legitimate interest, and to withdraw consent. Write to support@hanc.ai; we answer within one month. You may also lodge a complaint with a supervisory authority — in Austria the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

11. Security

Traffic is protected with TLS. Passwords are stored only as scrypt hashes. The session cookie is HttpOnly. Administrative functions are restricted by role, the Studio database is isolated from those of other services, and secrets are held outside the code. We notify personal data breaches within the periods set by Art. 33 and 34 GDPR.

12. Children

The service is intended for professional use. We do not knowingly process the data of anyone under 16.

13. Automated decisions

We take no decisions about you based solely on automated processing that produce legal or similarly significant effects. Models are used to draft workflows, not to evaluate you as a person.

14. Changes to this policy

We update this policy as the service changes. Material changes are announced by email or in the interface. The date of the current revision is shown at the top of this page.

15. Contact

Good Point GmbH, Liechtensteinstraße 63/10, 1090 Vienna, Austria
support@hanc.ai

← Home