HapNex Privacy Policy

Version 1.6 · Prepared 2026-10-06 · Effective upon publication

Company and publication status. The service provider is HapNex, Inc., a Delaware corporation. This revision takes effect upon publication, subject to the notice requirements for material changes. Mailing address: 56 Broad St STE 91263, Boston, MA 02109, United States

1. Who we are and what this covers

HapNex, Inc., a Delaware corporation ("HapNex," "we"), is the service provider running hapnex.ai, the event planner, customer and vendor accounts, and related messages. Our mailing address and current legal documents are publicly available at hapnex.ai/legal without signing in. This policy explains what personal information we collect through those services, how we use and share it, and your choices. It applies to customers, organizations' staff who book for them, vendors and their staff, prospective vendors contacted about participation, and visitors.

We collect only what we need to invite and administer vendor participation and to plan, book, coordinate and stand behind events, and keep it only as long as section 7 says. We provide the applicable privacy notice before collecting information through an invitation response or signing form; obligations for that collection do not wait for the first booking. Framework acceptance does not replace a separate consent required for sensitive information, optional marketing, connected services or tax-form delivery.

2. Information we collect

From customers

• Account details: name, email, phone number, and organization if you book for one.
• Event details: event type, date, times, guest count, address, budget, preferences, and anything you type into the planner.
• Event-day details: the day-of contact person and site access instructions.
• Dietary, allergy and accessibility requirements, only if you choose to provide them and agree to the purpose and necessary sharing explained at collection (section 5). You may skip these details or use human coordination.
• Messages and reviews you send through HapNex.
• Calls. HapNex does not record call audio or use automated call transcription unless we first notify all participants and obtain their consent. If you decline, you may use our message support. Before enabling recording or transcription, we explain its purpose, any service providers involved, and the applicable retention period. Recording and transcription must also comply with the sharing and retention limits in this policy.
• Payment information: payments are processed by Stripe. We receive the payment status and limited card details such as brand and last four digits, never your full card number. If we pay you compensation by bank transfer, we collect the bank details you confirm for that transfer.

From vendors

• Business legal and trading names, business contact details, service listings, prices and service area. For signing, we record the representative's name, role, authority confirmation and signature or explicit acceptance, the accepted document versions and identifiers, and the time. Technical records may include an IP address when available. A signature or agreement record is retained under the necessary legal agreement period in section 7; it is not consent to optional marketing.
• Availability. If you connect Google Calendar, we use it only to determine when you are available and to place HapNex bookings on it.
• Insurance certificates, endorsements and licenses.
• Payout and identity verification information, collected and held by Stripe. We receive relevant verification and payout status. When tax reporting requires it, we also collect or receive necessary tax classification, documentation or verification status through a designated secure process, restricted to authorized tax and compliance personnel.
• Arrival and completion records, work photos, and incident reports.

Google Calendar data. If you connect Google Calendar, HapNex reads only when you are busy or free, and creates, updates or removes the events for your HapNex bookings. HapNex does not read, store or share the content of your other events, and does not use Google data to train AI models. HapNex's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time in your HapNex settings or your Google account permissions; your accepted bookings remain due, and you then keep your availability current in the HapNex calendar.

Collected automatically

• Device and browser type, IP address, approximate location derived from the IP address, pages viewed and times of use.
• Cookies, as described in section 6.

From others

• Stripe: payment and payout status.
• Vendors: completion evidence and incident reports about your booking.
• Your organization, if it books for you.
• Public sources, to check or invite vendors: business registrations, license lookups, vendors' own websites and publicly listed business contact information. Published reviews may inform vendor checks where their source permits that use. Public availability does not remove applicable privacy or source-service restrictions.

3. How we use information

• To plan and book: interpret your request, build plan options from vendors' published availability and prices, show the total price, lock time slots, and take payment.
• To coordinate: share the details each vendor needs, send confirmations and reminders, track arrivals, and arrange replacements.
• To run the HapNex Guarantee: review problems and pay refunds and compensation.
• To keep performance records: we record how each booking was carried out, including arrival times, issues and replacements, to run the Guarantee, assess vendor reliability, and improve planning.
• To keep events safe and lawful: vet vendors, handle incidents, prevent fraud, and meet legal, tax and accounting obligations.
• To communicate: transactional emails about your account and bookings; booking text messages only when offered and separately opted into; and marketing to customers and account users only with separate consent. We may use publicly listed business contacts to invite prospective vendors to relevant participation where law and the sending service permit. Those commercial invitations identify HapNex and its mailing address and provide a simple method to stop all marketing emails. We honor opt-outs within ten business days or sooner if required and maintain a working opt-out method for at least thirty days after sending. We do not use the connected Google APIs to send unsolicited commercial mail prohibited by their policies. Existing opt-outs and stricter consent commitments remain effective.
• To improve HapNex: analyze how the service is used, mostly in aggregated form.

To promote HapNex: place search and contextual advertising, and, only with your consent, use controlled conversion measurement to understand whether advertising led to a visit or booking. We do not use cross-site behavioral targeting. Optional measurement is subject to section 6.

Automated planning. We use automated systems, including AI models run by service providers, to build plan options and assist with coordination using only event information, business records and permitted service requirements needed for those purposes. A booking requires your choice and confirmation. Requests that cannot be safely handled through this process are referred for human review. Decisions to suspend or remove an account, approve a replacement, or decide a Guarantee remedy are made by a person authorized by HapNex. AI and booking support do not provide emergency medical care.

4. How we share information

• With vendors in your booking, only what each needs for its item: your name, the event address, times, guest count, the day-of contact, and dietary or accessibility needs you disclosed. Vendors must keep it confidential and use it only for your booking.
• With customers, vendors' business names, listings, and the names of staff who will attend.
• With Stripe, to process payments, refunds and payouts.
• With service providers that host our systems, send email and, when offered, text messages, provide analytics, or support customer service, under terms that limit their use to providing services to HapNex. We do not send structured account contact fields, payment credentials or raw personal health information to AI model providers. Where needed for planning or coordination, models may receive non-identifying operational requirements, such as a count of vegetarian meals or a request for step-free access, without linking them to individual guests. We restrict customer information included in model requests and refer requests for human handling if they cannot be safely reduced to permitted information. General planning and chat text may contain personal information. Use the designated fields or contact us for human coordination if your request needs personal health information or another person's contact details.

With analytics or advertising measurement providers only if you first consent to optional measurement under section 6. Approved conversion measurement may use limited online identifiers or event data sent from your browser or from our server. It does not include raw dietary, allergy or accessibility information, other sensitive personal information, payment credentials, or information received through a connected Google API. We do not use that information for advertising. We do not enable optional measurement until its consent, withdrawal and signal controls are configured.

• With your organization, the details of bookings you make for it.
• With insurers, claims adjusters and legal advisers, when handling an incident or claim.
• With authorities, when the law requires it or to protect someone's safety.
• In a business transfer, to a successor in a merger or sale of HapNex, which must honor this policy.
• With your consent, in any other case.

We do not sell personal information, and we do not share it for targeted advertising across other companies' sites and apps.

5. Dietary, allergy and accessibility information

We collect dietary, allergy and accessibility information in designated fields only if you choose to provide it after we explain its specific purpose and the vendors or other necessary recipients and you agree to that use and sharing. You may skip the details, state that you prefer human coordination, or contact team@hapnex.ai. Before confirmation we explain any service limitation caused by missing information rather than treating silence as disclosure or consent. We use raw personal health information only to coordinate services that need it, share it only with the vendors that need it, and delete those designated records 90 days after the event, subject to a legally required hold or an open claim. We may use non-identifying operational requirements in automated planning without identifying the person concerned. We do not put raw personal health information in calendar entries or permanent booking history; those records may note that requirements were provided. If you give information about guests, we ask for the minimum needs without names where possible and you confirm their permission or another lawful basis to share it. Small-group counts or context can still identify someone; we do not assume a record is anonymous merely because names are omitted. Do not put personal health details in general free text; use the designated fields or human coordination. You may withdraw this consent through team@hapnex.ai; we stop optional use and sharing for future coordination, explain any effect on remaining services, and retain only what a necessary legal obligation or identified claim requires. General messages follow the separate retention period in section 7 and can be removed on request, subject to a necessary legal or claim hold. Information you put there is not automatically converted into a designated health record.

Consumer health data. The separate Consumer Health Data Privacy Notice at hapnex.ai/legal/v1.6/consumer-health-notice.html explains the categories, sources, necessary sharing, choices and rights for health-related event requirements. Washington statutory rights apply when that law covers HapNex and the consumer or processing concerned; a mailing address does not by itself determine coverage. Where separate collection and sharing consent is required, HapNex obtains each before the relevant action. Accepting general terms or an organizer merely checking an authority box does not replace the affected person's actual permission or other lawful basis.

6. Cookies

We use cookies needed for the site to work, such as keeping you signed in and remembering a plan. We do not currently enable optional analytics or advertising cookies, pixels or conversion measurement. Before offering any such measurement, we will explain its purposes and deploy affirmative consent, withdrawal and applicable Global Privacy Control and other required opt-out checks. Those controls must apply to browser technologies and any server-side measurement involving personal identifiers or visitor events; sending data from a server cannot bypass your choices. Optional measurement remains off until those controls work. You can also block cookies in your browser. Search and contextual advertising may be used without tracking you across other companies' sites or apps. We do not use sensitive personal information or connected Google API information for advertising. Traditional browser Do Not Track signals lack a uniform technical standard; we do not currently use them to change essential site functions. We do not permit third parties to collect information through HapNex for cross-site behavioral advertising.

7. How long we keep information

Deleted information leaves our backups as they are overwritten, within 35 days. Older records may need a controlled migration to remove private fields while preserving necessary financial or performance facts. Private fields in affected older records remain restricted during that process and are not used for AI or advertising. We may keep information longer only where the law requires it or an identified claim or dispute needs particular records. We document the reason and scope, restrict use to that purpose, review the hold and delete retained information when its basis ends. An unspecified possibility of a future dispute is not a blanket extension. We explain any remaining retention when answering your deletion request. We do not activate a new data-collection feature until its applicable retention and deletion controls are configured.

8. Your choices and rights

Wherever you live, you may ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong;
• delete your information;
• send your information to you in a portable format;
• withdraw a consent you gave, including for marketing and for dietary or accessibility information.

Send requests to team@hapnex.ai. We verify your identity before acting and respond within 45 days or sooner if applicable law requires; any legally permitted extension is explained within the original response period. Someone you authorize may make a request for you with written proof of that authority. If we cannot fully meet a request, for example because the law requires us to keep booking records or a claim is open, we explain why, and you may appeal by replying to our decision; we answer appeals within 45 days. We do not treat you differently for using these rights.

You can unsubscribe from marketing emails through the link or reply method stated in each email. You may also send a stop request to team@hapnex.ai. We keep only the minimal suppression information needed to honor the request. If you opt in to text messages when that service is offered, you can stop them by replying STOP or using the opt-out method provided with that service.

9. Security

We use administrative, technical and physical safeguards suited to the information we hold, including encryption in transit and access limited to people who need it for their work. Stripe handles payment card data, so we never store full card numbers. If a security breach affects your information, we notify you as the law requires.

10. Children

HapNex is for people 18 and older. We do not knowingly collect personal information from children under 13. If we learn we have, we delete it.

11. Where information is processed

HapNex operates in the United States. Our service providers may process information in the United States and other countries, under the contract terms in section 4.

12. Vendors' own practices

Vendors are independent businesses. When they handle your information for a HapNex booking, our contract limits them to using it for that booking. If you deal with a vendor directly outside HapNex, the vendor's own privacy practices apply.

13. Changes to this policy

We will email account holders and post a notice on hapnex.ai at least 14 days before a material change takes effect. The version and effective date at the top show which version applies.

14. Contact

HapNex, Inc., a Delaware corporation · team@hapnex.ai · Mailing address: 56 Broad St STE 91263, Boston, MA 02109, United States