GDPR-first, EU-hosted by design. We do not train models on your customer data.
Account info you give us (name, work email, company), product telemetry (which features you use, when), and the data you submit to the platform (brand names, prompts, content, catalog data). On this website, the analytics described below, and what you send us through a form.
To provide the service, to bill, to support you, to improve the platform. We do not sell data, ever.
EU regions only by default. Enterprise customers may opt into specific regions per their order form. We do not transfer personal data outside the EEA without standard contractual clauses in place.
We do not train models on customer data. Where we use third-party LLMs (Anthropic, OpenAI, Google), we contractually require zero-retention modes and prohibit training on submitted content.
A current list of sub-processors is available in our documentation. We notify customers 30 days before adding a new sub-processor.
Nothing that measures your visit runs before you allow it. Google Analytics 4 and HubSpot tracking load only after you choose Accept in the cookie banner. If you choose Reject, or make no choice, neither is loaded and neither sets anything on your device.
The providers are Google (Google LLC or Google Ireland Limited, as applicable to your region) for Google Analytics 4 and Google Tag Manager, and HubSpot (HubSpot, Inc. or HubSpot Ireland Limited) for website tracking and our CRM, on HubSpot’s EU data centre. Both may process this data outside the EU and Türkiye, including in the United States, under their data processing terms and standard contractual clauses.
Google Analytics 4 does not log or store IP addresses. It uses the address at the moment of collection to derive an approximate location, down to city level, and your device model, then discards it. We do not use Google Signals, advertising features or remarketing on this site, and no advertising storage is ever granted.
| Name | Provider | Purpose | Type | Lifetime |
|---|---|---|---|---|
__client_uat* | Clerk (app sign-in) | keeps you signed in on app.henneth.ai | strictly necessary | session |
henneth-cookie-consent-v2 | Henneth (browser storage) | remembers your cookie choice | strictly necessary | 12 months |
henneth_internal | Henneth | marks Henneth team browsers so their visits are excluded from statistics, set only via ?internal=1 | strictly necessary (team only) | 12 months |
_ga | Google Analytics | distinguishes visitors | analytics (consent) | 13 months |
_ga_D6KXG4897G | Google Analytics | keeps session state | analytics (consent) | 13 months |
hubspotutk | HubSpot | recognises returning visitors and links a form submission to its source in our CRM | analytics and CRM (consent) | 6 months |
__hstc, __hssc, __hssrc | HubSpot | visit statistics | analytics (consent) | 6 months / 30 min / session |
__hs_opt_out, __hs_do_not_track | HubSpot (only if present) | record that you refused HubSpot tracking | strictly necessary | up to 13 months |
We keep the analytics data in Google Analytics 4 for 14 months. HubSpot data is kept for our CRM retention period.
Use the Cookie settings link in the footer of any page. It reopens the banner, and choosing Reject deletes the Google Analytics and HubSpot cookies from your browser and stops both trackers. Source information already attached to a request you sent stays with that request in our CRM until you ask us to delete it. We ask again once a year in any case.
The forms on this site are hosted by HubSpot, and what you submit is stored as a contact in our HubSpot CRM: your details, the date, which form you used and a follow-up status, so our team can respond. If you accepted cookies, HubSpot also records which channel you arrived through, so we know which campaign produced the request. If you did not accept, it does not.
Analytics cookies and equivalent browser storage, and the attribution of your request to the channel you came from, run on your consent under Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive, and on açık rıza under Article 5(1) KVKK. You may withdraw that consent at any time, which does not affect processing that already happened. Handling the request you send us rests on taking steps at your request before entering into a contract, Article 6(1)(b) GDPR and Article 5(2)(c) KVKK.
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form (Articles 15 to 22 GDPR; Article 11 KVKK). You may withdraw consent at any time without affecting earlier processing. You may also lodge a complaint with a supervisory authority: the authority of your country of residence in the EU (Article 77 GDPR), or the Kişisel Verileri Koruma Kurulu in Türkiye.
Kişisel verilerinize erişme, düzeltilmesini veya silinmesini isteme, işlenmesini sınırlama veya işlenmesine itiraz etme ve verilerinizi taşınabilir biçimde alma haklarına sahipsiniz (KVKK md. 11; GDPR md. 15 ile 22 arası). Verdiğiniz onayı dilediğiniz zaman geri çekebilirsiniz; bu, geri çekme anına kadar yapılan işlemeyi etkilemez. Ayrıca Kişisel Verileri Koruma Kurulu’na veya AB’de ikamet ettiğiniz ülkenin denetim makamına şikâyette bulunabilirsiniz (GDPR md. 77).
Henneth’s legal entity. Data Protection Officer: [email protected].