Welcome to Haku ("we" or "us"). This Privacy Policy is designed to help you understand how we collect, use, disclose, and safeguard your personal information when you use our website, our platform at hakulabs.app, and our browser extension.

This Privacy Policy describes how Haku Labs collects, uses, discloses, and protects Personal Data in connection with the provision of its services ("Services"). Haku Labs is committed to processing Personal Data in compliance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK Data Protection Act 2018, the California Consumer Privacy Act of 2018, as amended ("CCPA"), and other relevant privacy laws.

Our Services are intended for use by businesses and organisations only. We do not knowingly collect or process Personal Data relating to individuals under the age of 18. All customer data is stored within secure infrastructure, protected by strict access controls and encryption measures.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy.

Information We Collect

Haku Labs collects the following categories of Personal Data in connection with the provision of its Services:

1. Information you provide directly to us

• Account information: name, work email, company name, and job title.
• Authentication and integration credentials: passwords (stored hashed) and, where applicable, third-party integration credentials such as the LinkedIn session cookies handed off via our browser extension (see "Browser Extension" section below).
• Billing information: payment details processed by our third-party payment processor; we do not store full payment card numbers.
• Content you upload or generate within the Service: ICP definitions, prospect lists, custom signal descriptions, CRM data you connect, email and message templates, replies, and conversation history.
• Communications: messages you send to us via email, chat, or support channels.

2. Information collected automatically when you use the Service

• Usage data: pages and features accessed, actions taken, and timestamps.
• Device and connection data: IP address, browser type and version, operating system, and approximate location derived from IP.
• Cookies and similar technologies used to maintain sessions, remember preferences, and measure performance.

3. Information we obtain from third-party sources

To build buying signals and enrich prospect records, Haku queries publicly available sources and licensed data providers, including but not limited to LinkedIn, Companies House, Crunchbase, BuiltWith, PitchBook, news and press release feeds, and waterfall enrichment providers covering email, phone, and firmographic data. Personal Data about prospects (e.g. name, work email, employer, role) is processed under our customers' instructions, with Haku acting as a processor in respect of that data.

Browser Extension — Haku LinkedIn Connector

This section describes data handled by the Haku LinkedIn Connector Chrome extension, which is separate from data handled by the Haku web platform. The extension is offered solely to existing Haku customers.

What the extension does

The Haku LinkedIn Connector lets you connect your LinkedIn account to your Haku account via a secure cookie handoff. After installing the extension and logging into LinkedIn normally, you click the extension icon and confirm the connection in the popup. The extension reads your LinkedIn session cookies (set by linkedin.com on your own browser) and sends them over HTTPS to your authenticated Haku account at hakulabs.app. Haku then uses your LinkedIn session to run the outbound LinkedIn actions you have configured inside the Haku platform — for example, sending connection requests and messages on your behalf.

Data collected by the extension

• LinkedIn session cookies set on your browser by linkedin.com.
• The Haku account identifier you are signed into when you trigger the handoff, so the captured session is associated with the correct Haku user.

Data the extension does NOT collect or transmit

• LinkedIn page content, messages, profile information, search results, or any other DOM content from linkedin.com. The extension contains no content scripts and does not read page contents.
• Browsing history, open tabs, or activity on any site other than linkedin.com and hakulabs.app.
• Personal data, files, or settings stored elsewhere on your device.

Why each permission is requested

• cookies: Required to read the session cookies linkedin.com has set on your browser, so they can be handed off to Haku.
• Host permission https://www.linkedin.com/*: Required by Chrome to scope the cookies permission to linkedin.com.
• Host permission https://*.hakulabs.app/*: Required to send the captured session cookies over HTTPS to your authenticated Haku account.

How the data is used

LinkedIn session cookies are transmitted to Haku's servers over HTTPS, stored securely with access controls, and used exclusively to authorise the LinkedIn outbound actions you configure in the Haku platform. The cookies are never sold, shared with third parties, used for advertising or ad-targeting, used to determine credit-worthiness, used to train artificial intelligence or machine learning models, or used for any purpose unrelated to the LinkedIn integration you have set up.

Retention and deletion

Your LinkedIn session is retained on Haku's servers for as long as your Haku account remains active and the LinkedIn integration is enabled, or until the cookies expire on LinkedIn's schedule (whichever is sooner). Disconnecting the integration via your Haku account settings, deleting your Haku account, or emailing privacy@hakulabs.ai will cause the stored session to be deleted promptly, and in any event no later than 30 days after your request.

How to revoke or remove

• To stop the extension capturing new sessions: uninstall it via chrome://extensions in your browser.
• To delete the LinkedIn session currently held by Haku: disconnect the LinkedIn integration from your Haku account settings, or email privacy@hakulabs.ai.
• To invalidate the session immediately on LinkedIn's side: log out of LinkedIn — this expires the cookies LinkedIn issued, including the copy held by Haku.

Limited use and Chrome Web Store compliance

The Haku LinkedIn Connector does not access any Google APIs or Google user data. Haku's use of all data captured by the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements: we do not transfer extension data to data brokers, do not use it for advertising or ad-targeting, do not use it to determine credit-worthiness or for lending purposes, and do not permit humans to read it except (a) with the user's explicit consent for a specific issue, (b) where required to comply with applicable law, or (c) where strictly necessary to investigate and respond to abuse, security incidents, or violations of our terms.

Data Subject Rights

Depending on your jurisdiction, you may have the right to:

• Access your Personal Data
• Rectify inaccuracies
• Request erasure ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Lodge complaints with supervisory authorities

To exercise these rights, contact us at privacy@hakulabs.ai.

Anti-Spam Policy

Haku Labs enforces a strict Anti-Spam Policy to ensure compliance with applicable laws (including GDPR, CAN-SPAM Act, and similar regulations) and to protect the integrity of our Services.

a) Prohibition of Unsolicited Communications

Users of Haku Labs must not use the Services to send unsolicited commercial emails, bulk messages, or other forms of spam. All outreach conducted via our platform must be based on:

• Obtained consent from recipients; or
• A legitimate interest and a prior business relationship, as defined by applicable law.

b) Unsubscribe and Opt-Out Requirements

All communications sent through the Services must include a clear and functional opt-out or unsubscribe mechanism, enabling recipients to withdraw consent to further communications.

c) Monitoring and Enforcement

Haku Labs reserves the right to monitor usage of its Services for compliance with this Anti-Spam Policy. Accounts found in violation may be subject to suspension or termination, and offending content may be removed without notice.

d) Reporting Violations

To report suspected spam or misuse of our Services, contact us at support@hakulabs.ai.

Updates to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominently within the Services.

Contact Us

If you have any questions about this Privacy Policy, please contact us at support@hakulabs.ai, or for privacy-specific requests at privacy@hakulabs.ai.