Privacy policy
Who is responsible
Inner Core Studios, [address] (KvK 73990744) is responsible for the personal data processed through Hawl. Questions or requests: [contact email].
If your accountant or bookkeeper uses the service for your business, they decide what happens with your data and we process it on their behalf under our data processing agreement. Ask them first.
What we store and why
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Name, email address, password (only as a salted hash), language, role in the workspace | Your login and account | Contract, art. 6(1)(b) |
| Businesses and zakat years: names, legal form, country, currency, zakat date, method, owners’ names and shares, trial balance lines (account codes, names, balances), values you add, results, payments you record and notes | Working out and keeping your zakat statements | Contract, art. 6(1)(b), and your explicit consent, art. 9(2)(a), because this data can reveal a religious belief |
| The time you gave that consent | Showing that you gave it | Legal obligation, art. 6(1)(c) |
| A trial balance file you upload | Reading its columns. Kept until you confirm them, and at most one day | Contract, and your consent |
| Stripe customer number, plan, subscription status, invoices | Billing; invoices are kept as tax law requires | Contract and legal obligation, art. 6(1)(b) and (c) |
| Emails we send: confirmation, password reset, invitations, zakat-date reminders, payment notices | Running your account. You can switch reminders off | Contract, art. 6(1)(b) |
| IP address (in rate-limit records), login cookies | Protecting accounts against abuse and password guessing | Legitimate interest in security, art. 6(1)(f) |
Explicit consent for religious data
Zakat is a religious duty, so the fact that you use this service, and your zakat figures, can reveal a religious belief. The GDPR treats that as a special category of data. We only process it with your explicit consent, which you give when you create your account. You can withdraw it at any time by deleting your businesses or your account; that doesn’t affect processing that took place before.
No tracking, no ads
There are no advertising, tracking or analytics scripts, and no third-party fonts or widgets. We never sell or share your data for marketing. The only cookies are functional:
- hw_session: keeps you logged in, for up to 30 days.
- hw_device: remembers that a browser has logged in to your account before, so password guessing elsewhere can’t lock you out; up to 180 days.
- hw_lang: remembers the language you chose.
Where your data is kept, and who helps us
- Cloudflare hosts the service. The database is located in Western Europe (EU); requests pass through Cloudflare’s worldwide network.
- Stripe handles payments. Your card or bank details go straight to Stripe and never reach us.
- Resend delivers our emails.
These processors are bound by data processing agreements. Where they process data outside the European Economic Area, they rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
Gold, silver and exchange-rate prices come from MetalpriceAPI, gold-api.com, the National Bank of Poland and the European Central Bank. We fetch those prices ourselves; no personal data is sent to them.
How long we keep it
- Account, business and zakat data: until you delete it or your account. It is then removed from the database straight away, and from backups and the database history within 30 days.
- Uploaded file contents: until you confirm the columns, and at most one day.
- Login sessions: 30 days after last use. Rate-limit records: two days.
- Invoices and payment records: seven years, as Dutch tax law requires.
- Records of reminders sent: two years.
- Read-only links you create: until you revoke them or they expire, then 90 days for our records.
Your rights
You can ask to see, correct, delete or receive a copy of your data, and object to or restrict its processing. Most of this you can do yourself in your settings; for the rest, email [contact email]. We answer within a month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority where you live.
Security
Connections are encrypted, passwords are stored as salted hashes, payment keys are encrypted, and access to your data is limited to you and the people you invite. If a breach puts your data at risk, we tell you without undue delay.
Changes
If we change this policy in a way that matters to you, we will email you before the change takes effect.