Privacy Policy

2. Data we collect

We collect information submitted through our forms, technical request data and website usage data:

• Contact form: first name, last name, email address, and the message body you write.
• License request form: full name, company name, business email, phone number (E.164 format), and the requested sub-domain.
• Google reCAPTCHA token: generated by Google to help us distinguish real users from automated bots.
• Server logs: IP address, user-agent, and request timestamps, retained for standard operational and security purposes.
• Retailer application: name, company, email, phone and an optional message.
• Google Analytics 4: page views and interactions, traffic sources, browser and device information, and cookie identifiers used to measure website usage.

3. Hashentic mobile app

The Hashentic mobile app for iOS and Android lets anyone check whether a product is genuine and lets staff of organizations that use Hashentic manage products and program NFC tags. The app processes the following data:

• Product checks: when you check a product, the app sends the identifier read from the NFC tag, QR code or barcode to our servers. We record the result, the time and an approximate location (country, region or city) derived from your IP address to detect counterfeits and to give the brand statistics about scans. Checks do not require an account and are not linked to your identity.
• Staff accounts: if your organization gives you an account, we process your username, email address, role and the product data you create or edit. Sign-in tokens are stored only in the secure storage of your device.
• On-device only: camera frames used to scan codes, NFC data read during a scan, and Face ID, Touch ID or fingerprint unlock stay on your device. We never receive biometric data.
• Diagnostics: the app keeps a diagnostic log on your device. It is sent to us only if you choose to share it.
• No advertising or tracking: the app contains no advertising or third-party analytics SDKs and does not track you across other companies' apps or websites.

Staff accounts and product data are processed on behalf of the organization that issued the account. Product check records are kept for as long as the brand's service agreement requires. Staff account data is kept while the account is active and deleted at the organization's request. To request access to or deletion of your data, contact [email protected] or your organization's administrator.

4. How we use your data

We use the data you provide strictly to:

• Respond to your enquiry or demo request.
• Issue, validate, or manage a Hashentic license.
• Protect our site against spam and abuse (via Google reCAPTCHA).
• Comply with our legal obligations.
• Understand which pages and content visitors use and improve the website with Google Analytics 4.

5. Legal basis

We rely on your explicit consent (Article 6(1)(a) GDPR) for processing form submissions. We rely on our legitimate interest (Article 6(1)(f) GDPR) for anti-abuse measures such as reCAPTCHA. For product checks in the mobile app, we rely on our legitimate interest and that of the brands we work for in detecting counterfeit products (Article 6(1)(f) GDPR). Staff account data is processed on behalf of the organization that issued the account.

6. Service providers

We use the following service providers to operate the site and measure its usage:

• Google reCAPTCHA — bot detection on form submissions.
• Telegram — delivery of contact messages and notifications containing licence and retailer application details to our team.
• Hashentic SLV API — the service that receives licence and retailer applications.
• Google Analytics 4 — measurement of website traffic and visitor interactions.

7. International transfers

Some of our service providers (notably Google and Telegram) may process data outside the European Economic Area. Where this occurs, transfers are covered by Standard Contractual Clauses or an equivalent safeguard under Chapter V GDPR.

8. Retention

Enquiry records are kept for up to 24 months from the last interaction, after which they are deleted unless a contractual relationship has been established. Server logs are retained for up to 90 days.

9. Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data.
• Request restriction of processing.
• Request data portability.
• Object to processing based on legitimate interest.
• Withdraw your consent at any time.
• Lodge a complaint with a supervisory authority in your country of residence.

10. How to exercise your rights

Email us at [email protected] with a clear description of your request. We will respond within 30 days as required by GDPR.

11. Cookies

The site stores your theme preference in browser local storage. Form protection uses Google reCAPTCHA, which sets an anti-abuse cookie when it runs and may involve other Google cookies. Google Analytics 4 uses analytics cookies, including _ga and _ga_*, to distinguish browsers and measure visits and interactions.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page.