Privacy policy

1. Two kinds of data, two roles

Workspace data is everything your team puts into Haven: people, companies, deals, notes, tasks, imported CSV files, call logs, call recordings and custom fields. Your company decides what goes in and why. For this data your company is the controller and CENTRALEGTM SARLAU is the processor: we store and process it only to run Haven for you, on your instructions.

Account data is what we need to run your account: your name, email address, password (stored only as a secure hash), time zone, email preferences, the workspaces you belong to and your role in them, and billing status. For this data CENTRALEGTM SARLAU is the controller.

2. What we collect

• Account details you give us when you sign up or are invited: name, email address and password.
• Workspace details: workspace name, team size, what you sell, default currency and country.
• Workspace data your team adds, imports or creates by calling (see section 1).
• Call data: the numbers dialled and received, who made or took the call, when it started and ended, its duration, the outcome and notes your rep adds, and, when your admin turns recording on, the audio recording.
• Billing status from our payment provider: plan, trial dates, renewal dates and whether a payment succeeded. We never see or store your full card number.
• Product usage: pages viewed and actions taken (for example "import completed" or "call completed"), browser type and approximate location from your IP address, so we can fix problems and improve Haven.
• Messages you send us through the Help page, including any screenshot you attach.

3. Why we use it

• To provide Haven: store your workspace, connect calls, keep your timeline, run imports and exports, and send the emails the product depends on (sign-up confirmation, invitations, task reminders, export links, trial and payment notices).
• To bill your company and keep track of included and purchased call minutes.
• To keep Haven secure: rate limits, an audit log of sensitive actions, abuse prevention and fraud checks.
• To improve Haven, using product analytics and the feedback you send us.
• To send product news and offers, only where you have not switched them off in Settings > Profile. Every such email has a link to change your preferences.

Where the law asks for a legal basis, we rely on performing our contract with your company, our legitimate interest in running and securing a reliable service, your consent where we ask for it (for example browser notifications), and our legal obligations (for example tax records).

4. Call recording and consent

Recording is off by default. Only a workspace admin can turn it on, in Settings > Calling. When recording is on, Haven can play a consent announcement to the other party before the call connects (for example "This call may be recorded for training and quality."). The announcement is on by default and admins can edit its wording.

Recording laws differ by country and by US state, and many require every party to agree. Your company is responsible for deciding whether to record, for keeping the announcement on where it is needed, and for having a lawful reason to record. Recordings are stored in your workspace, can be played only by the rep on the call and workspace admins, and are deleted after 365 days. Once a recording is safely stored with us, the copy held by our telephony provider is deleted.

5. Who processes data for us

We use a small number of service providers (subprocessors). Each one only gets the data it needs:

• Supabase: database, file storage (imports, exports and recordings), sign-in and background jobs.
• Vercel: hosting for the Haven website and app.
• Twilio: phone numbers, connecting calls from your browser, and call recording before the file is moved to our storage.
• Whop: checkout, subscriptions, payment processing and receipts.
• Resend: sending transactional and product emails.
• PostHog: product analytics.

Some of these providers process data outside your country, including in the United States. Where that happens we rely on the safeguards the law provides, such as standard contractual clauses. We do not sell personal data, and we do not use your workspace data to train AI models.

6. How long we keep it

• Workspace data: for as long as the workspace exists. Deleted people, companies and deals stay in the bin for 30 days so admins can restore them, then are removed for good.
• Call recordings: 365 days, then deleted.
• Export files: 24 hours. The download link stops working after that and the file is deleted.
• Deleted workspaces: removed for good 30 days after deletion.
• Account data: until you delete your account. Billing records are kept as long as tax law requires.

7. Export and delete

Admins can export people, companies, deals, calls or everything as CSV files from Settings > Data at any time, including after a plan has ended. The owner can delete the workspace in Settings > Workspace. You can delete your own account in Settings > Profile; if you are the only owner of a workspace with other members, you will first be asked to hand ownership to someone else.

8. Security

Every workspace is isolated from every other at the database level. Data is encrypted in transit and at rest. Telephony credentials are encrypted and never sent to the browser. Webhooks from our providers are verified with signatures, and sensitive actions such as exports, deletions and role changes are written to an audit log that admins can read.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or move your personal data, and to object to some uses of it. If your data is in a workspace (for example you are a contact in a customer's CRM), please contact that company first, because they control it; we will help them respond. For account data, contact us directly. You also have the right to complain to your local data protection authority.

10. Cookies

We use cookies that keep you signed in and keep the app working. We also use analytics to understand how Haven is used. You can block cookies in your browser, but the app needs its sign-in cookie to work.

11. Children

Haven is a business tool and is not meant for anyone under 16. We do not knowingly collect their data.

12. Changes and contact

If we change this policy in a way that matters, we will tell workspace owners by email before the change takes effect. For any privacy question or request, use the Help page inside Haven or write to CENTRALEGTM SARLAU, Oasis Offices Latitudes, Route de l'Oasis, Bureau 304, Maarif, 20330 Casablanca, Morocco.