Privacy policy
Last updated 5 October 2026
This policy explains what personal data Haba Social collects, why we collect it, who we share it with, and the rights you have over it.
1. Who we are
Haba Social is operated by HABA GROUP LIMITED, a company registered in England and Wales with company number 16671643, whose registered office is at 86-90 Paul Street, London, England, EC2A 4NE. In this policy, "Haba", "we", "us", and "our" mean HABA GROUP LIMITED.
We are the data controller for the personal data described in this policy, except where section 9 says otherwise. You can reach us about anything in this policy at [email protected].
2. The data we collect
We collect the following categories of personal data.
- Account data. Your name, email address, a hashed password, your role within an organisation, and your notification and appearance preferences.
- Organisation and brand data. The organisations, brands, and teams you create, including the names and email addresses of people you invite and of clients you send approval or report links to.
- Content you create. Posts, captions, comments, approval notes, and the images and videos you upload to the media library.
- Connected channel data. Access tokens, refresh tokens, account identifiers, handles, and profile images for the social accounts you connect, together with the engagement and reach metrics we retrieve from those platforms to build your reports.
- Vault entries. Credentials and notes you choose to store in the Vault. These are encrypted at rest using a dedicated key that is separate from the application key.
- Billing data. Your plan, subscription status, billing email, and invoice history. Card details are entered directly with Stripe and are never stored on our servers; we only ever see a card's brand and last four digits.
- Support correspondence. Messages you send us and our replies.
- Technical data. IP address, browser and device information, pages visited, and diagnostic information captured when something goes wrong.
3. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Create and run your account, publish your posts, and deliver the features of your plan | Performance of a contract |
| Take payment, manage subscriptions, and issue invoices | Performance of a contract |
| Send service emails such as verification, invitations, approval requests, and billing notices | Performance of a contract |
| Keep the service secure, prevent abuse, and investigate faults | Our legitimate interests in running a safe and reliable service |
| Understand how the product is used so we can improve it | Our legitimate interests, or your consent where cookies are involved |
| Analytics and advertising cookies, and marketing email | Your consent, which you can withdraw at any time |
| Keep accounting and tax records | Compliance with a legal obligation |
4. Cookies and similar technologies
We use strictly necessary cookies to keep you signed in and to protect forms, functional cookies to remember preferences such as your theme, and, with your consent, Google Analytics and the Meta Pixel. Our cookie policy sets out each cookie, what it does, and how to change your mind.
5. Who we share data with
We do not sell personal data. We share it with the service providers below, each of which processes it only on our instructions and under a written contract.
| Provider | What they do for us | Where they process data |
|---|---|---|
| Hetzner Online GmbH | Hosting and object storage for the application, database, and uploaded media | Germany |
| Cloudflare, Inc. | DNS, CDN, and protection against malicious traffic | UK/EU and USA |
| Stripe, Inc. | Payment processing, subscriptions, and invoices | USA and Ireland |
| Resend (Plus Five Five, Inc.) | Transactional email such as verification, invitations, and approval links | USA |
| Post for Me | Publishing posts to connected social platforms and retrieving their analytics | USA |
| Google Ireland Limited | Google Analytics, used to measure how our website and app are used | Ireland and USA |
| Meta Platforms Ireland Limited | Meta Pixel, used to measure and target our advertising | Ireland and USA |
| Functional Software, Inc. (Sentry) | Error and performance monitoring so we can diagnose faults | USA |
When you connect a social account, we also send your content and publishing instructions to that platform (for example Meta, X, LinkedIn, TikTok, YouTube, Pinterest, or Bluesky). Those platforms act as independent controllers for what they then do with that data, under their own privacy policies.
We may also disclose data to our professional advisers, or where we are required to by law, by a court, or by a regulator. If our business is sold or reorganised, data may transfer to the acquiring entity, subject to this policy.
6. International transfers
Our application and your uploaded media are hosted in Germany. Some of our providers process data in the United States. Where personal data leaves the UK, we rely on UK adequacy regulations where they apply, and otherwise on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, backed by an assessment of the transfer. You can ask us for details of the safeguards used for a particular provider.
7. How long we keep it
- Account, organisation, brand, and content data: for as long as your account is open, and for 30 days after deletion so the account can be restored if deletion was a mistake, after which it is permanently erased.
- Uploaded media: deleted alongside the brand or asset it belongs to; unfinished uploads are purged automatically within 24 hours.
- Connected channel tokens: until you disconnect the channel or close the account, whichever is first.
- Billing and invoice records: six years from the end of the financial year they relate to, as UK tax law requires.
- Server logs and error reports: up to 90 days.
- Support correspondence: up to two years after the conversation ends.
8. Security
All traffic is served over TLS. Passwords are hashed and never stored in readable form. Vault entries and connected channel tokens are encrypted at rest. Access within an organisation is governed by the roles and permissions you configure, and administrative access on our side is limited to the people who need it to operate and support the service. No system is perfectly secure, so we also keep logging and monitoring in place to detect problems quickly, and we will tell you and the ICO about a qualifying personal data breach within the time limits the law sets.
9. When we act for you rather than for ourselves
Haba is built for agencies and freelancers who manage social accounts on behalf of other people. For your own account data we are the controller. For the personal data you bring into the platform about your clients, their customers, and their audiences, you are the controller and we act as your processor, handling that data only to provide the service to you.
If you need a data processing agreement for your records, email [email protected] and we will provide one.
10. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- ask us to delete your data, where we have no overriding reason to keep it;
- ask us to restrict how we use your data while a concern is resolved;
- receive your data in a portable, machine-readable format, or have it sent to another provider;
- object to processing we carry out on the basis of legitimate interests, and to direct marketing at any time; and
- withdraw consent you have given, without affecting anything we did before you withdrew it.
To exercise any of these, email [email protected]. We will respond within one month. If the request concerns data we hold as a processor for one of our customers, we will pass it to them and support them in answering it.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
11. Children
Haba Social is a business tool and is not intended for children. You must be at least 18 years old to create an account. We do not knowingly collect data from children, and we will delete it if we discover we have.
12. Changes to this policy
We update this policy when our processing changes. The date at the top always reflects the current version. If a change materially affects your rights, we will tell you by email or in the app before it takes effect.