Privacy Policy

1. Data Controller

HACCP Hyve is the data controller for personal data processed through haccphyve.com. For questions about your data, contact us at privacy@haccphyve.com.

2. Data We Collect

We collect the following categories of personal data:

• Account information: name, email address, company name, role
• Employment data: department, position, contract type and dates (provided by your employer)
• Training data: test scores, training progress, certificate records
• Usage data: login timestamps, pages visited, device and browser information
• Payment data: processed securely by Stripe, we do not store card details

3. Legal Basis for Processing

• Contract performance: processing your data to provide the training and certification service
• Legitimate interest: improving our service, preventing fraud, and ensuring security
• Legal obligation: maintaining compliance records as required by food safety regulations
• Consent: sending marketing communications (you can opt out at any time)

4. How We Use Your Data

• Providing and personalizing the training and certification service
• Generating compliance reports for your employer
• Sending test results, certificate notifications, and retest reminders
• Processing payments and managing subscriptions
• Improving our platform and user experience

5. Data Sharing

We share personal data only with:

• Your employer (company admin and managers see training progress and test scores)
• Clerk (authentication provider)
• Stripe (payment processing)
• Resend (email delivery)
• Vercel and Supabase (hosting and database infrastructure)

We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Certificate records are retained for 5 years after issuance to comply with food safety audit requirements. You may request deletion at any time.

7. Your Rights

Depending on where you are based, you have rights over your personal data. These include the right to:

• Access or request disclosure of your personal data
• Correct inaccurate data
• Delete your data
• Restrict, suspend, or object to processing
• Data portability, where applicable
• Withdraw consent or opt out of marketing at any time

To exercise these rights, contact us at privacy@haccphyve.com. We respond without undue delay and within the period required by applicable law.

8. Data Security

We use industry-standard security measures including encryption in transit (TLS), encrypted databases, role-based access controls, and regular security reviews.

9. International Transfers

We use trusted service providers to run the platform, and your data may be processed by them in the European Union and the United States. These providers are Clerk (authentication), Vercel and Supabase (hosting and database), Stripe (payments), and Resend (email). Where personal data is transferred across borders, we apply the safeguards required by applicable law, including the GDPR and Japan's APPI.

10. Cookies

We use essential cookies required for authentication and security. We do not use tracking or advertising cookies.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or through our platform.

12. Contact

For privacy-related inquiries, contact us at privacy@haccphyve.com.