Privacy policy

This policy explains how Haijahr Limited ("we", "us"), the operator of Attestamo, collects and uses your personal data, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018). Haijahr Limited is the data controller for the personal data described here.

What we collect

• Account data: your name, email address and a securely hashed password.
• Organisation profile: the control statements and evidence details you record about your fraud-prevention procedures, for one or more organisations on your account.
• Questionnaire content: the questionnaires you paste in or upload, and the responses generated from your profile.
• Team data: if you invite colleagues to your account, we process their email address (and their name once they join) to send the invitation and give them access.
• Enquiry data: the name, email, company and message you submit through our request-access form.
• Payment data: if you subscribe to a paid plan, your billing details and any VAT number are handled by our payment processor, Stripe. We do not see or store your full card number.
• Usage and technical data: a session cookie to keep you signed in, your two-factor authentication settings if you turn them on, and standard server logs. We also keep privacy-friendly, cookieless analytics of visits to our public pages (a hashed value derived from your IP address and browser, the page visited and the referring site) to understand traffic.

How we use it, and our lawful basis

• To provide and operate the service for you (performance of a contract, and our legitimate interest in running Attestamo).
• To take payment for paid subscriptions and meet our tax and accounting obligations (performance of a contract, and our legal obligations).
• To respond to your access request or enquiry (your consent, which you may withdraw at any time).
• To understand how our website is used and to improve it (our legitimate interest, using cookieless analytics).
• To keep the service secure and prevent misuse (our legitimate interests).

Sub-processors

We use a small number of trusted providers to run Attestamo on our behalf, under data-processing agreements: an AI inference provider (to extract questions and draft responses), a hosting provider, a payment processor (Stripe, for paid subscriptions) and an email provider (for account, login, team-invitation and renewal-reminder emails). We do not use your content to train third-party models.

Where AI processing happens. Your questionnaire text is processed by an AI provider hosted in the European Union (EEA). Where any sub-processor processes data outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK extension to the EU Standard Contractual Clauses.

How long we keep it

We keep your account and organisation data for as long as your account is active. When you delete your account, we delete your organisations, their control profiles, evidence, questionnaires and responses, and remove your team's access. Enquiry data is kept only as long as needed to deal with your request.

Your rights

You have the right to access, correct, erase, restrict or object to our processing of your personal data, and to data portability. You can download your data or delete your account and all its data at any time from your account settings. To exercise any other right, email us. You also have the right to complain to the Information Commissioner's Office (ICO).

Contact

Haijahr Limited. Email hello@haijahr.com for any privacy matter or to exercise your rights.