GDPR-first, EU-hosted by design. We do not train models on your customer data.
Account info you give us (name, work email, company), product telemetry (which features you use, when), and the data you submit to the platform (brand names, prompts, content, catalog data). On this website, the analytics described below, and what you send us through a form.
To provide the service, to bill, to support you, to improve the platform. We do not sell data, ever.
EU regions only by default. Enterprise customers may opt into specific regions per their order form. We do not transfer personal data outside the EEA without standard contractual clauses in place.
We do not train models on customer data. Where we use third-party LLMs (Anthropic, OpenAI, Google), we contractually require zero-retention modes and prohibit training on submitted content.
When someone in your workspace connects a Google account on the Integrations page, Google asks them to approve what Henneth may read. For Google Analytics that is read-only access to Analytics reports (the analytics.readonly scope) and the email address of the Google account, so your team can see which account is connected. Where a Playbook needs Search Console, Sheets, Docs or Gmail, Google shows those permissions on the same approval screen, and Henneth uses them only for the Playbook steps you set up.
From Google Analytics we read the property you pick, and only that property: sessions, conversions and revenue by traffic source, to show how much traffic and revenue AI assistants send to your site. We never write to your Google Analytics account and never read a property you did not pick.
Google Sheets and Google Drive. When you connect Google Sheets and Google Drive on the Integrations page, Henneth asks Google for one permission, the drive.file scope. It gives Henneth access only to the files Henneth created for you and to the files you choose yourself in the Google Picker, Google’s own file chooser. Henneth cannot see, list or open any other file in your Drive. In the files it can reach, Henneth reads the file name, the sheet names and the cell values, to answer your questions and to run the steps you set up. It writes only what you ask for: a new spreadsheet, or rows and cells it adds, changes or clears in a sheet. In Ask, each change waits for your approval. When you disconnect Google Sheets and Google Drive on the Integrations page, Henneth’s access ends. Your files stay in your Google Drive, including the ones Henneth created.
For Google Analytics and for the Playbook permissions named above, the access tokens Google issues are stored encrypted (AES-256-GCM) in our EU database and are read only by our servers. For the Google Sheets and Google Drive connection on the Integrations page, the tokens are stored by Composio, the service provider that keeps the sign-in tokens of the tools you connect and runs Henneth’s requests to those tools, so the file requests described above pass through Composio. Data read from Google is shown to your workspace and is shared with no one except the service providers listed under “Who receives your data”, which process it only to run Henneth for you. We do not sell it, we do not use it for advertising, and we do not use it to develop, improve or train AI or machine-learning models, ours or anyone else’s. Henneth staff do not read it, except with your consent to resolve a support request, where the law requires it, or where it is needed for security.
To remove access, disconnect the account on the Integrations page: we delete the tokens we stored and, for the Google Sheets and Google Drive connection, the connection Composio holds. You can also remove Henneth at any time from your Google account at myaccount.google.com/permissions.
Henneth’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We protect the data you share with us from Google with these mechanisms:
drive.file scope, which covers the files Henneth created and the files you picked. Other Google permissions are requested only for the Playbook steps you set up.We share personal data only with service providers that run parts of Henneth for us, under contracts that limit their use to that job:
When you connect Henneth to an AI assistant, that assistant’s provider also receives the answers Henneth sends it (see below). We notify customers 30 days before adding a new service provider. We do not sell data.
Account and workspace data (your profile, brands, prompts, catalog data and the results we compute) stay for as long as your organisation uses Henneth. When the contract ends, or when you ask us to, we delete it within 30 days, except what the law requires us to keep, such as invoices. Technical request logs (time, request path, response status, IP address and user id) stay briefly on the application host: each service keeps a size-capped log (about 10 MB per container) and a redeploy replaces the container, so the log does not accumulate for a fixed calendar period. We are moving longer-lived security logs to a separate store; until then, treat retention as short-lived and size-limited. Website analytics and CRM retention are described under “Analytics and cookies” below.
You can connect Henneth to an AI assistant you already use, such as ChatGPT (OpenAI) or Claude (Anthropic), through our connector at mcp.henneth.ai. You sign in with your Henneth account, and the connector only works with the brands that account can access, under your Henneth role.
What we receive. When the assistant uses a Henneth tool, we receive only the inputs of that call: the brand, a date range, a topic or prompt filter and, when you ask for a task, its title, description and priority. We do not receive or store your conversation with the assistant, your other messages, files or memory.
What we send back and why. The tool’s answer: how AI engines present your brand by topic, competitor comparisons, the stored answers to the prompts you track, Playbook findings, product feed issues, and the confirmation of a task you created. We use it only to answer your request and to create the tasks you confirm. The assistant processes these answers under its own provider’s terms. Sign-in runs through Clerk. No one else receives connector data, and we do not use it to train models.
Retention. Each tool call leaves a technical request log entry on the connector host (time, path, status, IP and user id), never with the answer content. Those logs follow the same short-lived, size-capped host retention described under “How long we keep it”. Tasks you create are part of your workspace data. We keep no copy of the assistant conversation.
Your controls. Disconnect Henneth in the assistant’s settings at any time, and it can no longer call us. To revoke every connector sign-in for your account, write to [email protected]. Removing you from a Henneth workspace ends the connector’s access to that brand at once. Access and deletion requests work as described under “Your rights”.
Nothing that measures your visit runs before you allow it. Google Analytics 4 and HubSpot tracking load only after you choose Accept in the cookie banner. If you choose Reject, or make no choice, neither is loaded and neither sets anything on your device.
The chat widget in the corner is provided by Intercom (Intercom, Inc., United States) and loads under the same analytics choice. It knows nothing about you unless you write to us in it; if you withdraw the choice, the widget is closed and its cookies are deleted.
The providers are Google (Google LLC or Google Ireland Limited, as applicable to your region) for Google Analytics 4 and Google Tag Manager, and HubSpot (HubSpot, Inc. or HubSpot Ireland Limited) for website tracking and our CRM, on HubSpot’s EU data centre. Both may process this data outside the EU and Türkiye, including in the United States, under their data processing terms and standard contractual clauses.
Google Analytics 4 does not log or store IP addresses. It uses the address at the moment of collection to derive an approximate location, down to city level, and your device model, then discards it. We do not use Google Signals, advertising features or remarketing on this site, and no advertising storage is ever granted.
| Name | Provider | Purpose | Type | Lifetime |
|---|---|---|---|---|
__client_uat* | Clerk (app sign-in) | keeps you signed in on app.henneth.ai | strictly necessary | session |
henneth-cookie-consent-v3 | Henneth (browser storage) | remembers your cookie choice | strictly necessary | 12 months |
hn_consent | Henneth | the same choice and its reference number, so our server can honour it and prove it was given | strictly necessary | 12 months |
henneth_internal | Henneth | marks Henneth team browsers so their visits are excluded from statistics, set only via ?internal=1 | strictly necessary (team only) | 12 months |
_ga | Google Analytics | distinguishes visitors | analytics (consent) | 13 months |
_ga_D6KXG4897G | Google Analytics | keeps session state | analytics (consent) | 13 months |
hubspotutk | HubSpot | recognises returning visitors and links a form submission to its source in our CRM | analytics and CRM (consent) | 6 months |
__hstc, __hssc, __hssrc | HubSpot | visit statistics | analytics (consent) | 6 months / 30 min / session |
__hs_opt_out, __hs_do_not_track | HubSpot (only if present) | record that you refused HubSpot tracking | strictly necessary | up to 13 months |
intercom-id-irnncx42, intercom-device-id-irnncx42 | Intercom | recognises your browser in the chat widget so a conversation can be continued | analytics (consent) | 9 months |
intercom-session-irnncx42 | Intercom | keeps the chat session open | analytics (consent) | 7 days |
__oppref | OpenAI | the ad click you arrived from, so a later demo request can be matched to it | ad measurement (consent) | 30 days |
__obref | OpenAI | a random browser id used to match the same visit | ad measurement (consent) | 12 months |
__oaiq_consent | OpenAI | records your ad-measurement choice, including a refusal | strictly necessary | 12 months |
__oaiq_domain_probe | OpenAI | a technical check that the cookie can be written at all | ad measurement (consent) | 60 seconds |
hn_oppref | Henneth | our own copy of the ad click id, so the match survives browser restrictions | ad measurement (consent) | 30 days |
_gcl_au | links a conversion to the click that produced it | ad measurement (consent) | 90 days |
We keep the analytics data in Google Analytics 4 for 14 months. HubSpot data is kept for our CRM retention period.
We run ads, currently inside ChatGPT, and we want to know whether they lead to demo requests. If you allow Ad measurement in the cookie banner, the pages you view on this site and the forms you submit here are reported to OpenAI, OpenAI OpCo, LLC in the United States. The script that does this necessarily tells OpenAI your IP address, your browser’s user agent and the page you came from, as any third-party script on any website does.
When you submit a form we also send a one-way SHA-256 hash of your email address, so the ad click and the form can be matched without sending the address itself. A hash of this kind is pseudonymous and still personal data under the GDPR and the KVKK. Our own server may send the same event directly to OpenAI: the event reference, that hash, the ad click id and your country. It sends no IP address and no user agent. None of this happens without the Ad measurement consent, and we never ask OpenAI to personalise ads or to build an audience from you.
To withdraw, use the Cookie settings link in the footer. The ad cookies are deleted and the tracker is stopped. To have data already collected erased, email [email protected]: we delete the HubSpot record and pass the request to OpenAI’s advertiser data-deletion process. HubSpot keeps the ad click id on a contact only where Ad measurement was granted at the time of the visit, and it is removed on the same request.
Use the Cookie settings link in the footer of any page. It reopens the banner with its two switches, analytics and ad measurement, so either can be turned off on its own. Turning analytics off deletes the Google Analytics and HubSpot cookies and stops both trackers; turning ad measurement off deletes the OpenAI cookies and our copy of the ad click id, and stops that tracker. Source information already attached to a request you sent stays with that request in our CRM until you ask us to delete it. We ask again once a year in any case.
The forms on this site are hosted by HubSpot, and what you submit is stored as a contact in our HubSpot CRM: your details, the date, which form you used and a follow-up status, so our team can respond. If you accepted cookies, HubSpot also records which channel you arrived through, so we know which campaign produced the request. If you did not accept, it does not.
Both purposes in the banner, analytics and ad measurement, run on your consent under Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive, and on açık rıza under Article 5(1) KVKK. You may withdraw either at any time, which does not affect processing that already happened. The record of your choice itself, the hn_consent cookie and our server-side consent log, rests on our legal obligation to be able to demonstrate consent (Article 7(1) GDPR), so it is kept even after a withdrawal and needs no consent of its own. Handling the request you send us rests on taking steps at your request before entering into a contract, Article 6(1)(b) GDPR and Article 5(2)(c) KVKK.
Ad measurement means a transfer to OpenAI in the United States. The transfer mechanism and the essence of our arrangement with OpenAI are being finalised with counsel and will be stated here.
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form (Articles 15 to 22 GDPR; Article 11 KVKK). You may withdraw consent at any time without affecting earlier processing. You may also lodge a complaint with a supervisory authority: the authority of your country of residence in the EU (Article 77 GDPR), or the Kişisel Verileri Koruma Kurulu in Türkiye.
Kişisel verilerinize erişme, düzeltilmesini veya silinmesini isteme, işlenmesini sınırlama veya işlenmesine itiraz etme ve verilerinizi taşınabilir biçimde alma haklarına sahipsiniz (KVKK md. 11; GDPR md. 15 ile 22 arası). Verdiğiniz onayı dilediğiniz zaman geri çekebilirsiniz; bu, geri çekme anına kadar yapılan işlemeyi etkilemez. Ayrıca Kişisel Verileri Koruma Kurulu’na veya AB’de ikamet ettiğiniz ülkenin denetim makamına şikâyette bulunabilirsiniz (GDPR md. 77).
Reklam ölçümüne onay vermeniz hâlinde verileriniz yurt dışına, Amerika Birleşik Devletleri’nde yerleşik OpenAI OpCo, LLC’ye aktarılır. Google, HubSpot ve sohbet aracının sağlayıcısı Intercom da yurt dışında yerleşik alıcılardır. Aktarım yalnızca onayınızla gerçekleşir ve onayınızı Çerez ayarlarından dilediğiniz zaman geri çekebilirsiniz. Silme talepleriniz için [email protected].
Henneth is operated by HENNETH AI TEKNOLOJİ ANONİM ŞİRKETİ, Maslak Mah. AOS 55. Sk. 42 Maslak B Blok No:4 Daire:542, 34450 Sarıyer / İstanbul, Türkiye, the data controller for this policy. Privacy contact: [email protected].