Effective date: 2026-10-01 · Hooly BV

Privacy Policy

This Policy explains which personal data Haily processes, why it is used, who receives it, how long it is kept, and how people can exercise their rights.

These documents explain Haily’s standard position. An order form, data processing agreement, or negotiated agreement may add to or override them where it says so.

1. Who is responsible?

Hooly BV, trading as Haily, is the controller for account, billing, website, sales, and service-management data. Contact: haily@hooly.be, +32 474 74 46 59, Grote Negenbundersstraat 69, 3500 Hasselt, Belgium.

For documents and personal data uploaded by a customer for its clients, suppliers, staff, or dossiers, the customer normally acts as controller and Haily acts as processor under the customer’s instructions and the applicable data processing agreement.

2. Data we process

• Identity and contact data, such as name, email, telephone, company, role, and preferred language.
• Account and security data, such as authentication events, device/session information, permissions, OTP status, and audit logs.
• Commercial and billing data, such as plan, usage, invoices, VAT details, payment status, and Stripe customer references. Haily does not store full card details.
• Customer Data, including documents, emails, accounting records, extracted fields, matches, booking proposals, reports, instructions, and connected-folder metadata.
• Technical and support data, such as IP address, browser, error diagnostics, actions, support messages, and integration status.

1. Website choices and optional Clide activity data, including page paths, visit/activity events, random visitor/session identifiers, campaign parameters, referrer origin and configured page-activity measurements. The Cookie Policy explains Cancel, Partial and All, browser storage and the data sent to Clide.

3. Purposes and legal bases

Haily processes account, Service, billing, support, and security data to perform the contract and take requested pre-contractual steps. It processes records required for tax, accounting, sanctions, and legal compliance because the law requires it.

Haily uses proportionate logs, product diagnostics, fraud prevention, service improvement, and relevant business communication based on legitimate interests, after balancing those interests against individual rights. Optional website analytics, marketing, and external website services rely on consent where required. Consent can be withdrawn at any time.

4. Accounting documents and AI processing

Customer Data is processed to perform requested import, OCR, classification, validation, reconciliation, booking, reporting, search, support, and controlled execution. Depending on configuration, selected content may be sent to contracted AI model providers for these tasks.

Customers must give appropriate notices to their clients and other data subjects, choose lawful instructions, avoid unnecessary sensitive data, and configure access and retention appropriately. Haily does not use customer accounting documents for unrelated advertising.

5. Recipients and international transfers

Data is shared only as needed with authorized Haily personnel and contracted providers for European cloud infrastructure, AI processing, email delivery, security, support, Google reCAPTCHA, Google Calendar when permitted, and Stripe billing. Customer-selected integrations receive data under the customer’s instructions.

Haily prefers European processing where available. If a provider processes data outside the European Economic Area, Haily uses an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism and assesses supplementary safeguards where required.

6. Retention

Account and Customer Data is kept while needed to provide the Service and for the export, deletion, backup, and dispute periods stated in the contract or data processing agreement. Billing and company records are kept for the statutory retention period. Security logs are kept only as long as reasonably needed to investigate and protect the Service.

Trial and sales records are periodically deleted or anonymized when no longer relevant. Browser consent and visitor identifiers have the lifetimes described in the Cookie Policy. These lifetimes do not establish server-side deletion deadlines. Contact haily@hooly.be for the applicable server retention and deletion arrangements. Marketing preferences are retained until withdrawal and enough suppression data may be kept to respect an opt-out. Cookie choices are stored for up to six months.

7. Security

Haily uses role-based access, authentication controls, encryption in transit, scoped integrations, activity logging, backups, and organizational safeguards appropriate to the risk. No system is completely secure, so customers must also protect accounts, devices, credentials, and local systems and report incidents promptly.

8. Your rights

Depending on the processing, individuals may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent without affecting earlier lawful processing. A request can be sent to haily@hooly.be. Haily may verify identity and will respond within the period required by law.

Where Haily processes data for a customer, the request should normally be directed to that customer. Individuals may also complain to the Belgian Data Protection Authority at dataprotectionauthority.be or to their local supervisory authority.

9. Communications and cookies

Haily sends operational messages needed for accounts, security, trials, billing, and support. Optional marketing can be declined during registration or unsubscribed later. Important service and legal notices cannot always be disabled while an account remains active.

The website uses Clide to manage optional analytics choices. Registration uses Google reCAPTCHA for security. The current Cookie Policy describes actual identifiers, measurement modes, external requests and withdrawal; following an external booking link is subject to the destination provider’s rules.

10. Updates and contact

Haily may update this Policy when processing, providers, or law changes. Material changes will be highlighted appropriately. Questions and requests may be sent to haily@hooly.be or by post to Hooly BV, Grote Negenbundersstraat 69, 3500 Hasselt, Belgium.

AI processing clarification — 1 October 2026

This clarification supplements the Privacy Policy and takes precedence over general wording on the matters below. Privacy and security contact: Kristof Beenders, Hooly BV, haily@hooly.be.

Haily uses the OpenAI API for configured document and assistant functions. Depending on the function, inputs include document text, page images, extracted fields, prompts, relevant accounting context and screenshots of connected applications. A page image or screenshot may include personal data beyond the requested fields. Submit only necessary data and review AI output before accounting entries, filings or decisions.

For customer documents, Haily processes data under the customer’s instructions. The customer may be a controller or itself a processor, in which case Haily is a subprocessor and the relevant controller’s authorization is required. Haily is separately controller for its own account, billing and website activities. A privacy acknowledgement does not constitute consent on behalf of everyone named in documents or replace the required processing agreement, lawful basis or subprocessor authorization.

Haily’s verified OpenAI project uses Global geography and Standard Retention. Voluntary sharing of API inputs/outputs, evaluation data and feedback is disabled. European-only processing and Zero Data Retention are not currently promised. OpenAI’s standard DPA provides for international-transfer safeguards; applicable contractual and GDPR transfer requirements remain necessary.

Since the privacy release of 1 October 2026, ordinary OpenAI Responses requests disable response storage. Assistant conversations retain stored response continuity. Disabling response storage does not remove OpenAI’s separate abuse-monitoring retention: its documented default is up to 30 days, subject to stated exceptions. Stored Responses state is ordinarily retained for at least 30 days under the provider’s documented default. Changing settings for future requests does not erase historical data.

New import AI diagnostics omit raw responses and assistant JSON diagnostics omit raw prompt/response payloads. Functional screenshots and OCR files can still contain personal data. Application records, temporary files, provider records and backups have separate deletion paths; deletion of one record does not establish immediate erasure of all copies. Contact haily@hooly.be for requests and the applicable contractual arrangements. Haily does not use customer document content for unrelated advertising or opt it into OpenAI’s voluntary training/data-sharing programmes.