Privacy notice

What this notice covers

Haaalo is currently a limited development and testing service. Public paid customer registration and billing have not launched. The sample-file demonstration on the homepage is not a real cloud account. The working macOS application and sharing portal are separate features that can process actual personal data.

This notice covers visitors to haaalo.com, test-service users, recipients of shared files and people who contact us by email. The relevant framework is the General Data Protection Regulation (GDPR) and applicable Hungarian law, including Act CXII of 2011 (Infotv.).

We have chosen Backblaze B2 for file storage in the planned Haaalo service. While migration is being prepared, the development test environment continues to use Cloudflare R2. The 8 GB limit remains a shared platform testing ceiling, not a purchasable subscription.

Work on customer accounts, company workspaces, customer-account email authentication, subscriptions and recoverable trash does not establish that those features are live. Information at the relevant collection point must be updated before a new processing operation is activated.

Who is responsible for your data?

Controller: Xenomorph Group Kft.
Registered office: H-7400 Kaposvár, 48-as Ifjúság útja 44. 1. em. 5. ajtó
Company registration no.: 14-09-321617
Hungarian tax no.: 32818473-1-14
Representative: Török Ádám József
Privacy contact: rosenstockgroup@gmail.com

Service administration and customer content

The Haaalo operator is the controller for its own processing needed to operate the website, administer accounts and permissions, communicate with users, protect the service and meet legal obligations.

Where a business or organisational customer stores files containing other people’s personal data, that customer will normally decide the purposes and lawful basis for the content. Haaalo processes such content as a processor on documented instructions. This requires an Article 28 GDPR data processing agreement. This notice does not replace that agreement. Roles for private use depend on the actual processing; the household exemption does not generally exempt the service provider.

The person uploading files must have authority to store and share them and, where required, inform the people concerned. Haaalo does not supply a separate lawful basis for uploading other people’s data.

What we process and why

Current processing purposes
Data	Purpose and lawful basis	Providing the data
Connection and technical data: IP address, request time, requested resource, browser and protocol information, security signals.	Delivering the website and API; preventing attacks and misuse. Article 6(1)(f) GDPR: the legitimate interest in a functioning, secure service. Cloudflare can process technical data on its network.	Technically necessary to establish a connection and deliver the page.
Account identifier and display name; available preferences such as language, time zone and notification settings.	Managing the requested account and settings. Article 6(1)(b) for a contracting user; Article 6(1)(f) for organisational contacts and permission administration.	The relevant function needs an identifier and essential profile data; optional preferences can be changed.
Passkey public key, credential identifier, verification counter, backup-status flag, challenges and hashes of session identifiers.	Authentication, access control and session security. Article 6(1)(b), and Article 6(1)(f) for misuse prevention.	Required for features that need authentication. Haaalo does not receive the passkey private key or the device’s biometric template.
File names, folder structure, sizes, versions, modification times, checksums, transfer and storage-reservation status; uploaded file content.	Storage, streaming, synchronisation, versioning and sharing requested by the user. Article 6(1)(b) for our own service administration; the customer’s lawful basis and documented processor instructions for customer-controlled content.	Relates to content you select, upload or share; the corresponding file operation cannot run without it.
Share identifier and hash of the secret link value, permission, audience, expiry and revocation; invited email address, message/sending-job metadata, delivery state and a hash of the opening proof; legacy approval links also use recipient names, verification codes and approval state.	Implementing the owner’s requested share, identifying recipients and limiting access. Article 6(1)(b), or Article 6(1)(f): the owner’s and recipients’ legitimate interests in secure collaboration.	For email invitations the owner approves the recipient; possession of the complete private opening link grants the selected scope until expiry or earlier revocation. Registration is not required.
Contact email and a voluntarily sent message; for storage quotes, name and requested capacity; request or issue category, time and handling status; limited technical diagnostics where needed.	Answering enquiries and providing requested help: Article 6(1)(b) or (f). Complying with privacy duties: (c). Security investigations and legal claims: (f).	Provide only what is necessary. Do not send unsolicited files, access links, passwords or complete log files.

Our legitimate interests are service availability, protection of accounts and files, investigating misuse and handling legal claims. You may object on grounds relating to your particular situation. A new optional purpose requiring consent, such as a newsletter or marketing measurement, cannot be introduced merely by treating use of this notice as consent.

Advertising profiling of file content and training artificial intelligence models are not current service purposes. There is no implemented profiling-based, solely automated decision-making with the significant effects described in Article 22 GDPR. Quota, permission and link-expiry rules may operate automatically; you can request human review of a disputed access issue.

Providers and planned changes

Current services

Cloudflare, Inc. – 101 Townsend Street, San Francisco, CA 94107, USA. Website delivery and network security, Worker APIs, D1 metadata and current R2 file storage. Cloudflare can act as processor or subprocessor for customer data; its own privacy terms also apply to its independent service and security processing. Data processing terms · Current subprocessors · Privacy policy.

Google / Gmail – delivery and storage of messages sent to the published gmail.com contact mailbox. The email provider’s processing is also covered by Google’s privacy terms. Emailing us does not automatically provide access to your Haaalo account.

Resend — Plus Five Five, Inc. The email provider used for file-sharing invitations requested by the owner. It receives recipient and sender addresses, the shared item name, permission, expiry, private opening link and message, and may process delivery data. File contents are not attached; however, the invitation link can grant access to shared content and is confidential. Data processing terms · Privacy terms. When the storage-request form is enabled, Resend also processes the submitted name, email address, requested capacity and message to deliver the enquiry to our contact mailbox.

Planned, not currently active

Backblaze B2 Cloud Storage: the chosen service for Haaalo’s planned file storage, with EU Central (Amsterdam) as the intended region. Integration and migration are being prepared. Backblaze is a US provider, so an EU storage region alone does not rule out all international processing or access. Official region information · Backblaze DPA.

Payments, invoicing and public customer registration remain inactive. The current website does not request payment-card details.

Provider lists can change. A business appearing on a provider’s wider list does not mean Haaalo uses every listed product, including AI products. Changes must be assessed against the actual services and data flows.

Where processing takes place

We do not claim that all Haaalo data stays exclusively in the EU. Delivery, security processing, operations and support on Cloudflare’s global network can involve several countries.

Cloudflare configuration checked on 30 October 2026 currently reports Eastern Europe (EEUR) as the region for the D1 database and R2 file storage. Neither has an EU-only jurisdiction restriction configured. D1 and R2 jurisdiction restrictions are separate features; current regional placement does not replace them or provide a permanent EU-only guarantee for files or metadata. D1 data location · R2 data location.

Transfers outside the EEA require an applicable mechanism under Chapter V GDPR. Cloudflare’s published DPA refers to the applicable EU–US Data Privacy Framework (DPF), and to European Commission standard contractual clauses (SCCs) and supplementary safeguards for restricted transfers. Applicability depends on the current service, recipient and contract; DPF is not blanket permission for any transfer to the US.

Even after a future B2 EU-region migration, traffic through Cloudflare, account metadata, support and provider administration need separate assessment. Information must be updated before that migration is activated. You can contact us for information about the safeguards relevant to your data and how to obtain a copy.

Resend states that stored customer data is in the United States even when Ireland is selected for sending. Its published DPA includes standard contractual clauses. The sending region is not an EU-only storage guarantee. Resend processing locations and safeguards.

How long data is kept

Current technical validity periods
Item	Validity	What it means
Owner and recipient web sessions	1 hour	Validity of authenticated web access and the necessary session cookie.
Native application session	Up to 30 days	Native access-session expiry; not a deadline to erase cloud files.
Passkey authentication or registration challenge	5 minutes; single use	A short validity window for the authentication operation.
Native sign-in exchange code	1 minute; single use	The handover between browser sign-in and the application.
New sharing link	7 days by default; at most 30 days	The owner can choose a shorter validity period or revoke earlier.

Expiry is not the same as final erasure of every associated record. Expired sessions and challenges cannot authorise access; some development-system cleanup runs on subsequent requests or in background work. There is currently no uniform, automatically executed final-erasure deadline covering every account, passkey, sharing and operation record.

Files remain associated with the user’s storage purpose. Deletion in the current native system starts payload-removal work; technical deletion, version or accounting metadata can remain. The planned recoverable 30-day trash is not a feature of current native deletion. We do not promise immediate disappearance from every copy, backup or recipient device.

Email sharing invitations can be reused until the owner-selected expiry, up to 30 days, unless revoked or blocked sooner. Expired browser sessions are cleaned by background work. Invitation addresses and sending jobs become eligible for bounded background cleanup seven days after expiry or revocation; technical permission identifiers can remain. This is not immediate deletion from every provider copy.

Resend currently publishes 30-day email/log retention for Free, Pro and Scale plans, with separate backup and account-termination periods. The recipient mailbox is separate. Provider processing and retention information.

Correspondence and request records are kept to resolve the matter and for any necessary legal obligation or claim handling. Security and diagnostic retention depends on the needs of the particular investigation; provider logs and backups can have separate lifecycles. A precise, executable retention schedule must be finalised before a public paid launch.

You can request deletion or retention information by email. Accepting a request does not mean deletion is complete: you should receive a separate result and information about any lawfully retained categories.

Cookies, browsers and local Mac storage

Necessary session and device storage
Name / location	Purpose	Duration
`__Host-haaalo`	Owner web sign-in on the native backend’s own authentication origin.	At most 1 hour; cleared on sign-out.
`__Host-haaalo-recipient`	The sharing recipient’s passkey-authenticated web session.	At most 1 hour; cleared on sign-out.
`__Host-haaalo-mail-*`	Email-invitation browser access restricted to one share. It does not create a customer account.	At most 1 hour and never beyond share expiry; Close access revokes the browser session.
Homepage sample-file demonstration	Search, sample cache controls and predefined answers in page memory.	Until page reload; no connected cloud account or live AI conversation.
macOS Keychain, application data, cache, offline and pending local copies	Native sign-in, preferences, faster reads, offline access and preserving unsent modifications.	Until session expiry or as needed for the local function, followed by the appropriate application or user cleanup.

Device storage is subject to Section 155(4) of Hungarian Act C of 2003 (Eht.) and Article 5(3) of the ePrivacy Directive. The narrow exception for storage strictly necessary to provide an explicitly requested service must be assessed against the actual cookie purpose; not every convenience or security-labelled cookie automatically qualifies.

The session cookies are Secure, HTTP-only and same-site; they are necessary for the sign-in you request. Blocking them may prevent authenticated features. The website inspected for this notice does not load external marketing or visitor-analytics code, and fonts are served locally. Cloudflare may use additional necessary security cookies depending on the security features actually enabled.

New optional measurement or device storage requiring consent must have a prior choice that can be refused; browsing is not marketing consent. Cookies can be deleted in your browser. Mac cache, offline copies, modifications not yet confirmed in the cloud and independently copied files are distinct. Check cloud confirmation before deleting local data.

Security and incidents

Implemented measures include HTTPS, passkey authentication, short-lived web sessions, server-side account and permission checks, checksum-verified transfers and native-session storage in macOS Keychain. Provider encryption is not the same as end-to-end encryption.

The current Haaalo system is not a verified zero-knowledge or end-to-end encrypted service. The backend handles file metadata and content to operate the service. No system can be guaranteed absolutely invulnerable. Do not publish sharing links, sign-in material or recovery information in logs or support messages.

The native “Copy read diagnostics” action produces limited counters, timings, byte counts, controlled error codes and application-version information; it is not designed to export file names or content. Copying does not send it automatically. Share only the necessary, checked extract when requesting help.

If a personal-data incident occurs, the controller must assess the risk and take the appropriate action. Under Articles 33–34 GDPR, where required, the supervisory authority must be notified without undue delay and, where feasible, within 72 hours of awareness; high risk can also require notifying affected people. A processor must cooperate with the relevant controller.

Your rights

Information and access: ask whether your data is processed and obtain a copy of your personal data, with protection for other people’s rights.
Rectification: request correction of inaccurate data and completion of incomplete data.
Erasure: request deletion in the circumstances in Article 17 GDPR. This is not absolute; a legal obligation or necessary legal claim can justify retention.
Restriction: request limits on processing under the conditions in Article 18 GDPR.
Portability: where automated processing is based on consent or contract and the conditions apply, receive data you provided in a machine-readable form, or have it sent directly where technically feasible.
Objection: object to legitimate-interest processing on grounds relating to your situation. You can always object to processing for direct marketing.
Withdrawal of consent: where processing actually relies on consent, withdraw it at any time without affecting the lawfulness of earlier processing.
Complaints and judicial remedies: complain to a supervisory authority and seek a remedy in court.

Stopping use, revoking a share and exercising a privacy erasure right are different operations. An export or deletion screen under development is not evidence that a rights request has already been fulfilled.

Making a request

Write to rosenstockgroup@gmail.com or the controller’s registered office. Explain which service and right your request concerns and provide only enough identifying information to locate the matter securely. We do not ask for your password, passkey private key or complete sharing link.

If there are reasonable doubts about your identity, proportionate additional verification may be needed. Do not send an identity-document copy unsolicited. For a document controlled by a customer, we can help direct the request to that controller and assist with handling it as processor.

A response is due without undue delay, normally within one month of receipt. Complex or numerous requests can justify up to two further months; the extension and reasons must be communicated within the first month. Requests are normally free. The GDPR permits a justified exception for manifestly unfounded or excessive requests.

If a request is refused, you must receive reasons and information about remedies. You do not need to contact us first to exercise your right to complain.

Supervisory authority and courts

Supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Telephone: +36 (1) 391 1400
Email: ugyfelszolgalat@naih.hu
Official submission: NAIH online procedures

NAIH states that ordinary email cannot initiate an official authority procedure. Use the official electronic, postal or in-person channel applicable to your case. Current contact details and submission methods are on NAIH’s contact page.

You may also complain to another EEA supervisory authority at your habitual residence, workplace or the place of the alleged infringement. Judicial remedies under Article 79 GDPR and the possibility of compensation under Article 82 remain available independently.

Children, sensitive data and updates

The current development test is not a service directed to children and does not offer child-account registration. The age rules and any necessary parental-authorisation process for public registration must be determined before launch; this notice does not treat a child’s click as automatically valid consent.

Business storage of special-category data, such as health information, or criminal-offence data requires the uploading controller to address Articles 9–10 GDPR as well as an ordinary lawful basis. Do not upload such data to the current test environment without appropriate processing and security arrangements in advance.

This notice describes the dated state shown here. People must be appropriately informed before material new purposes, providers, data flows or retention practices begin. A later website text cannot retrospectively make earlier processing lawful.