Haystar Privacy Policy

Last Updated: October 11, 2026

1. Purpose and Scope

Haystar ("we," "us," or "our") respects your privacy. This policy explains how we collect, use, and safeguard the information we receive via our website (the "Site") and our business productivity platform (the "Services").

As a UK-based entity, we process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Important Note: This policy applies to the information we collect about our users (e.g., account holders). It does not apply to the data our customers upload into Haystar (e.g., their leads and contact lists), which is governed by our Data Processing Agreement (DPA) and the customer's own privacy policy.

2. Information We Collect

We collect information you provide directly to us:

  • Account Information: Name, email address, company name, and password.
  • Billing Data: For paid plans, we use a PCI-DSS compliant third-party processor. We do not store full credit card details on our servers.
  • CRM Integration: If you choose to import Google Contacts or sync your email, we collect metadata (subject lines, timestamps) and content necessary to display your communications within the CRM.
  • Haystar AI Assistant: We collect prompts and feedback you provide to the AI. This is used to generate insights and automate tasks. Note: Haystar AI is not HIPAA-compliant; do not input sensitive health data.

3. How We Use Your Information

We process your data under the following legal bases:

  • Performance of a Contract: To provide the CRM services you signed up for.
  • Legitimate Interests: To keep the service secure and operate Haystar. Optional marketing-site analytics is separate and requires consent, as described in section 7.
  • Consent: For optional marketing-site analytics and for marketing communications. You can reject or withdraw analytics consent at any time from Analytics preferences in the site footer.

4. How We Share Your Information

We do not sell your personal data. We share information only with:

  • Service Providers: Such as Nylas (for email integration) or cloud hosting providers, under strict confidentiality agreements.
  • Legal Requirements: If required by UK law enforcement or regulatory bodies.
  • Business Transfers: In the event of a merger or sale of Haystar.

5. Data Retention & Security

  • Retention: We keep your data for as long as your account is active or as required by UK tax and legal obligations.
  • Security: We are SOC 2 compliant and use industry-standard encryption (TLS for data in transit and AES-256 at rest).
  • AI Data: Your data is never used to train publicly available third-party AI models.

6. Your Rights (UK & EEA Users)

Under the UK GDPR, you have the following rights:

  • Access: Request a copy of the data we hold about you.
  • Correction: Ask us to fix inaccurate information.
  • Erasure: Request that we delete your data (the "right to be forgotten").
  • Portability: Request a transfer of your data to another service.
  • Objection: Object to processing based on legitimate interests.

To exercise these rights, please contact [email protected]. We will respond within 30 days.

7. Cookies and Tracking

Haystar does not use Google Analytics. Optional analytics on this marketing site is first-party Website Intelligence. It stays off until you accept it.

  • Essential cookies: Required for the site to function, including a cookie that remembers whether you accepted or rejected analytics.
  • Analytics cookies: Only after you accept. These store random identifiers so we can count pages, clicks, and signup starts. They do not store your name, email address, or IP address.
  • Retention: Raw analytics events are kept for 90 days. Daily statistical totals, which do not identify a visitor, are kept for 13 months. Collection for a session stops after 30 minutes of inactivity, and in any case within 24 hours. The session record is then kept with the raw events.
  • Withdrawal: Use Analytics preferences in the footer to reject analytics. Withdrawing consent stops further tracking from this browser and requests deletion of the stored events and sessions for its analytics identifier. If a supporting service is temporarily unavailable, that deletion is queued and retried. If the request cannot be stored, it is not queued. This browser keeps a retry for 7 days. If that retry is lost, the records remain until you withdraw again. Anonymous daily totals are updated while the raw records still exist.
  • Do Not Track: Like most platforms, we do not currently respond to "Do Not Track" signals. Analytics still requires the explicit choice above.

8. International Transfers

As a UK company, if we transfer data outside the UK/EEA (for example, to a US-based server), we ensure a similar degree of protection by using Standard Contractual Clauses (SCCs) or relying on the UK Extension to the EU-U.S. Data Privacy Framework.

9. Supervisory Authority

If you feel we have not addressed your privacy concerns adequately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator (www.ico.org.uk).

10. Contact Us

For questions regarding this policy or our data practices: