1. INTRODUCTION AND SCOPE

This Privacy Statement ("Statement") describes how HAKU APP CORPORATION ("haku," "we," "us," or "our"), located at 1221 Brickell Ave, Suite 1700, Miami, FL 33131, collects, uses, discloses, and protects Personal Data in connection with the Services. This Statement applies to all users of the Services and the haku website. By accessing or using the Services, you acknowledge that you have read and understood this Statement. This Statement is incorporated by reference into haku's Terms of Service (for Organizers and Customers) and haku's Participant Terms of Service (for Participants), each available at https://www.hakuapp.com/legal. Where Customer has entered into a separate written agreement with haku that references or governs privacy and data protection, the terms of that agreement apply to the extent they address the same subject matter.

To the extent of any conflict between this Statement and the applicable agreement, the applicable agreement controls, except that this Statement controls with respect to haku's collection, use, and disclosure of Personal Data to the extent required by applicable data protection law.

1.1 User Categories and haku's Data Processing Roles. haku serves three categories of users, and its data processing role differs for each:

1. Organizers: Event organizers who use the Services to create and manage events. haku acts as the data controller for Organizer account data, billing information, and related service administration data.
2. Participants: Individuals who register for events, make donations, or purchase merchandise through the Services. haku acts as the data processor for Participant data collected on behalf of Organizers. haku also independently processes certain Participant data as a data controller for its own purposes, as described in Section 1.2 below.
3. Visitors: Individuals who browse the haku website without registering for an event or creating an account. haku acts as the data controller for Visitor data.

1.2 haku Controller Data and the Dual-Role Framework. "haku Controller Data" means information that haku processes as an independent data controller for its own business purposes, including: account information, contact information, billing and payment information, service administration data, call and meeting recordings, transcripts, summaries, notes, related metadata, and usage data. haku Controller Data is governed by this Statement and is not subject to any Data Processing Addendum between haku and an Organizer. Where haku processes Participant data as a processor on behalf of an Organizer, that processing is governed by the applicable Data Processing Addendum. Where haku processes the same or related data as an independent controller (for example, product analytics or AI-enabled processing), that processing is governed by this Statement.

2. DEFINITIONS

The following terms, when capitalized in this Privacy Statement, have the meanings set forth below. Terms not defined here have the meanings assigned to them in haku's Terms of Service, available at https://www.hakuapp.com/legal.

4. "Customer Data" means information submitted by or collected from Customer, Participants, or Authorized Users through the Services on Customer's behalf. Customer Data excludes aggregated, de-identified, or anonymized data.
5. "haku Controller Data" means Customer information processed by haku for its own business purposes, including: account information, contact information, billing and payment information, service administration data, call and meeting recordings, transcripts, summaries, notes, related metadata, and usage data. haku Controller Data is governed by this Privacy Statement and not by any Data Processing Addendum.
6. "Organizer" means an event organizer that uses the Services to create, manage, or administer events. haku acts as a data controller with respect to Organizer account data.
7. "Participant" means an individual who registers for events, makes donations, or purchases merchandise through the Services. haku acts as a data processor on behalf of the applicable Organizer for Participant data collected through the platform, and as an independent data controller for haku Controller Data derived from Participant activity.
8. "Personal Data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable natural person.
9. "Security Incident" means any unauthorized access to, acquisition of, disclosure of, alteration of, or destruction of Customer Data that materially compromises the security, confidentiality, or integrity of Customer Data.
10. "Services" means haku's hosted software platform and related services as described in the Terms of Service.
11. "Visitor" means an individual who accesses haku's website without registering for an account or an event. haku acts as a data controller with respect to Visitor data.

‍‍

3. INFORMATION WE COLLECT

This Section describes the categories of Personal Data that haku collects in connection with the Services. The scope and type of data collected may vary depending on whether you are an Organizer, Participant, or Visitor.

3.1 Information You Provide. When you create an account, register for an event, or otherwise interact with the Services, you may provide: name, postal address, email address, phone number, financial and bank account information (for Organizers receiving payouts), taxpayer identification numbers, and event registration data.

3.2 Information Collected from Participants by Organizers. Organizers determine the data fields collected from Participants through the platform, which may include registration details and payment information. haku processes this data on behalf of the Organizer as a data processor. Organizers are responsible for ensuring an appropriate legal basis for such collection.

3.3 Information Collected Automatically. When you access the Services, haku automatically collects: IP address, browser type, device information, approximate geolocation, usage data, session data, page views, click patterns, navigation paths, and feature usage. haku uses product analytics tools, including Pendo, to collect this data.

3.4 Cookies and Similar Technologies. haku uses essential cookies (required for platform functionality), performance and analytics cookies (including Pendo), and functionality cookies. Analytics cookies require your consent under the GDPR. haku provides a cookie consent mechanism through which you may manage your preferences. 

3.5 Information from Third Parties. haku may receive Personal Data from payment processors, identity verification services, and publicly available sources.

3.6 AI Interaction Data (Calls and Meetings). haku may collect call recordings, video meeting recordings, transcripts, summaries, notes, and related metadata from communications with haku using AI-enabled tools. These tools support customer support, quality assurance, training, analytics, and operational purposes. haku provides notice of recording through meeting invitations, automated prompts, or statements by haku personnel at the start of a session. You may opt out of AI recording by: (a) notifying haku before or at the start of the call; (b) leaving the session when recording is announced; or (c) requesting an alternative communication method.

3.7 AI-Enabled Platform Features. haku may process event registration data, fundraising and donation data, and related event metrics using AI-enabled tools to generate analytics, insights, trends, and recommendations for Organizers (such as haku IQ Signals). haku may also provide AI-powered conversational tools that respond to platform-related inquiries (such as Ask Nacho). These features may process Personal Data from Organizers, Participants, and other users of the Services. AI-enabled platform features may be made available as generally available, beta, or early access, and may be modified, suspended, or discontinued at any time.

4. HOW WE USE YOUR INFORMATION

haku uses Personal Data for the purposes described below. Each purpose block identifies the applicable data, the processing activity, and the legal basis.

4.1 Providing the Services. haku processes registration data, account information, payment information, and event data to operate the platform, process event registrations, manage events, facilitate payments, and provide customer support. Legal basis: performance of a contract with you; legitimate interest in delivering and maintaining the Services.

4.2 haku Controller Data Processing (Product Analytics). haku independently processes behavioral and usage data from all user categories for product development, platform improvement, UX optimization, A/B testing, performance monitoring, and feature enhancement. Tools used include Pendo. Legal basis: legitimate interest. haku has conducted a balancing test and determined that these interests are not overridden by user privacy rights because the processing involves usage data that does not reveal sensitive information. You may object by contacting DPO@hakuapp.com.

4.3 AI-Enabled Processing.

Calls and Meetings. haku records, transcribes, summarizes, and analyzes calls, meetings, and support sessions using AI-enabled tools for customer support, quality assurance, training, analytics, service administration, security, and dispute resolution. Legal basis: legitimate interest.

Platform Analytics and Insights. haku uses AI-enabled tools to process event registration data, fundraising and donation data, and related event metrics to generate analytics, insights, trends, and recommendations for Organizers. These tools analyze data automatically and surface insights within the Services. AI-generated insights are provided for informational purposes only and do not constitute automated decisions that produce legal or similarly significant effects concerning any individual. Legal basis: legitimate interest in providing and improving the Services; performance of a contract.

Conversational AI. haku may provide AI-powered conversational tools within the Services that respond to platform-related inquiries. These tools generate responses automatically and may process Personal Data contained in user queries. Legal basis: legitimate interest; performance of a contract.

AI Model Training. haku may use de-identified or aggregated data derived from platform usage to improve AI-powered features, including models that support analytics and conversational tools. haku does not use identified Personal Data for this purpose.

‍

4.4 Security and Fraud Prevention. haku processes usage data, device information, and access logs to protect against unauthorized access, detect fraud, and maintain platform integrity. Legal basis: legitimate interest; legal obligation.

4.5 Communications. haku uses contact information to send transactional emails, event updates, and account notifications. Marketing communications are sent with consent where required by applicable law. Legal basis: contract performance; consent; legitimate interest.

4.6 Legal Compliance and Regulatory Reporting. haku processes Personal Data to comply with tax requirements, charitable solicitation laws (including California Attorney General Registry filings), and to respond to legal process. Legal basis: legal obligation.

4.7 Aggregated and De-Identified Data. haku may generate and use aggregated, de-identified, or anonymized data for analytics, benchmarking, service improvement, and product development. haku will not attempt to re-identify such data and will not use it to compete directly with Customer's Events.

5. HOW WE SHARE YOUR INFORMATION

haku may share Personal Data with the following categories of recipients for the purposes described in this Privacy Statement.

5.1 Organizers. Participant data collected through the Services is provided to the applicable Organizer on whose behalf haku processes such data. Organizers' use of Participant data is governed by their own privacy policies.

5.2 Payment Processors. haku shares transaction data with Stripe and other third-party payment processors to facilitate payments. haku does not directly store full payment card information.

5.3 Sub-processors. haku engages sub-processors to support the Services. A current list of haku's sub-processors, including each sub-processor's name, function, and location, is available at https://trust.hakuapp.com. haku may update this list from time to time in accordance with the applicable Data Processing Addendum.

5.4 DAFpay/Chariot. If an Organizer enables DAFpay (Chariot Giving, Inc.), haku may share donor information, transaction information, and nonprofit information with Chariot as necessary to operate the integration. Data received by Chariot is subject to Chariot's own terms and privacy practices.

5.5 Affiliates and Subsidiaries. haku may share Personal Data with its affiliates and subsidiaries consistent with this Privacy Statement.

5.6 Business Transfers. In connection with a merger, acquisition, reorganization, or sale of assets, Personal Data may be transferred to the acquiring entity.

5.7 Legal Requirements. haku may disclose Personal Data to comply with applicable law, legal process, or governmental requests; to enforce the Terms of Service; or to protect the rights, property, or safety of haku, its users, or the public.

5.8 Consent-Based Sharing. haku may share Personal Data with other third parties where you have provided your consent.

We do not sell your Personal Data. We do not share your Personal Data for cross-context behavioral advertising. Personal data collected through the SMS/short code program will not be shared, sold, or rented to unaffiliated or affiliated third parties for their own marketing purposes. haku will periodically review its data sharing practices to confirm these statements remain accurate under applicable privacy law definitions of "sale" and "sharing."

6. YOUR PRIVACY RIGHTS

6.1 Rights Available to All Users. Subject to applicable law, all users may exercise the following rights with respect to their Personal Data held by haku:

1. Right to access your Personal Data;
2. Right to correct inaccurate Personal Data;
3. Right to request deletion of your Personal Data;
4. Right to data portability;
5. Right to withdraw consent at any time;
6. Right to object to processing based on legitimate interests;
7. Right to restrict processing;
8. Right to lodge a complaint with a supervisory authority.

For Participants: Because haku processes Participant data on behalf of Organizers as a data processor, Participants should first direct requests to the applicable Organizer. For haku Controller Data (including product analytics and AI-enabled processing data), Participants may contact haku directly at DPO@hakuapp.com.

6.2 US State Privacy Rights. If you reside in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or another US state with a comprehensive consumer privacy law, you may have additional rights, subject to applicable law. These rights may include: the right to know what Personal Data we collect, use, and disclose; the right to delete or correct Personal Data; the right to opt out of the sale of Personal Data, although haku does not sell Personal Data; the right to opt out of sharing for cross-context behavioral advertising, although haku does not engage in this practice; the right to opt out of profiling that produces legal or similarly significant effects; the right to limit certain uses of sensitive Personal Data; the right to non-discrimination; and the right to appeal a denial of your request.

California Residents: Under the CCPA/CPRA, you may request disclosure of the categories and specific pieces of Personal Data collected, the sources from which it was collected, the purposes for which it is used, and the categories of third parties to whom it is disclosed. Submit a verifiable consumer request to DPO@hakuapp.com.

Connecticut Residents: See Section 4.3 for information about haku’s use of Personal Data in connection with AI-enabled processing and the use of de-identified or aggregated data to improve AI-powered features. 

Universal Opt-Out Preference Signals: haku honors Global Privacy Control (GPC) and other universal opt-out signals recognized under applicable state law. Authorized Agents: You may designate an authorized agent; we may require verification of authority. Sensitive Personal Data: haku does not use or disclose sensitive Personal Data for purposes beyond those permitted under applicable law.

6.3 European Economic Area, United Kingdom, and Switzerland. haku processes Personal Data under the following legal bases: (a) performance of a contract; (b) legitimate interests, as described in Section 4; (c) consent; and (d) compliance with legal obligations. You may lodge a complaint with your local data protection supervisory authority at any time.

EU and UK Article 27 Representative: Rickert Rechtsanwaltsgesellschaft mbH serves as haku’s representative under Article 27 of the EU GDPR and UK GDPR. Email: art-27-rep-haku@rickert.law.

For transfers from the EEA to the United States, haku relies on the EU-U.S. Data Privacy Framework or another lawful transfer mechanism. For transfers from the United Kingdom, haku relies on the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, the UK International Data Transfer Agreement, or another approved transfer mechanism under UK data protection law. For transfers from Switzerland, haku relies on European Commission’s Standard Contractual Clauses with modifications required under Swiss data protection law or another approved transfer mechanism.

6.4 How to Exercise Your Rights. Contact DPO@hakuapp.com. haku will respond within the period required by applicable law and may extend that period where permitted, with notice to you. We may verify your identity before processing your request. haku will not discriminate against any individual for exercising rights under this Section 6.

6.5 haku's AI-enabled platform features (such as haku IQ Signals) process event and fundraising data to generate analytics and insights for Organizers. These features do not produce decisions with legal or similarly significant effects concerning any individual and accordingly do not constitute profiling subject to opt-out under applicable state law. If you have questions about how your data is used in connection with AI-enabled features, contact DPO@hakuapp.com.