Privacy Policy

Last updated: 10/23/26

Hahanet lets people book appointments with small local businesses, either on our website or through an AI assistant. This policy explains what we collect, why, who we share it with, and the choices you have. Hahanet is run by Hagen Qian, 5350 Beeler St., Pittsburgh, Pennsylvania. Questions go to privacy@hahanet.ai.

Who this covers

• Business owners who list their business on Hahanet and use the owner dashboard.
• Customers who book, change or cancel an appointment, on our site or through an AI assistant.
• Visitors who browse hahanet.ai.

What we collect

From business owners

• Your name, email address and login details.
• Business details you enter: business name, address or service area, services, prices, hours, photos, and booking settings.
• Notification settings, including the push subscription your device creates when you allow alerts.
• If you connect Google Calendar: see Google user data below.
• Billing details. Your card is entered on Stripe's payment form and stored by Stripe, not by us. We keep the last four digits, card brand and billing history.
• If you take deposits: Stripe collects the identity and bank details needed to pay you. We receive your account status, not your bank details.

From customers

• Your name, email address, and phone number if you give it.
• The appointment: business, service, date and time, and any note you add.
• If a deposit is required: payment is handled by Stripe. We receive the payment status and the last four digits of your card.

When an AI assistant books for you

When you ask an AI assistant (such as Claude, ChatGPT, Gemini or Meta's Muse) to book with a business on Hahanet, the assistant sends us the details needed for the booking: your name, contact details, and the appointment you asked for. We also record which assistant or platform sent the request. Unless the platform is a verified partner, the booking stays pending until you click the confirmation link we email you.

Automatically

• Technical data such as IP address, browser or device type, and pages requested. We use it to run the service, prevent abuse and set rate limits.
• Cookies needed to keep owners signed in.

How we use it

• To make, change, cancel and remind people about bookings, and to tell the business about them.
• To send service emails: confirmations, reminders, receipts and account notices. We do not send customers marketing email.
• To work out where each booking came from (the business's own link, an AI assistant, or the Hahanet directory). This is how we bill businesses, since owners pay only for some booking sources.
• To prevent fraud, spam and abuse, including automated bookings that were never confirmed.
• To fix problems and improve Hahanet using aggregated statistics.
• To meet legal and tax obligations.

We do not sell personal information. We do not share it for targeted advertising. We do not use it to train AI models.

What's public

Business listings are public. That includes the business name, services, prices, hours, location or service area, and open times. They're published so that people, search engines and AI assistants can find and book them. That's the purpose of the service. Customer information is never public.

Who we share it with

• The business you book with gets your name, contact details, appointment and note.
• The AI assistant that made a booking gets back the booking result: confirmed, pending or declined, with the time and business. What the assistant does with your conversation is governed by that platform's own privacy policy, not ours.
• Service providers that run Hahanet for us, under contract and only for that purpose: Vercel and Railway (hosting and database), Resend (email), Stripe (payments and billing), Google (Calendar sync, only if the owner connects it), and Twilio (text messages, once offered).
• Legal and safety. We share information when the law requires it, or to protect people from fraud or harm.
• Business transfers. If Hahanet is sold or merged, this information may transfer under this policy. We will notify you first.

Google user data

Owners can connect a Google Calendar so Hahanet doesn't book over their existing plans.

• What we access: busy times on the calendars you choose, and the events Hahanet creates for your bookings.
• How we use it: only to hide times you're busy from your booking page, and to add, update or remove your Hahanet bookings in your calendar.
• What we store: your Google access tokens, encrypted, and the busy times needed to calculate open slots.
• Sharing: we never sell Google user data, use it for advertising, or let people read it except with your permission, for security, or as the law requires.
• Disconnecting: you can disconnect at any time in Settings, or at myaccount.google.com/permissions. We delete your tokens and stored busy times when you do.

Hahanet's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Text messages

Once Hahanet offers texts, we will send appointment confirmations, reminders and replies only to people who give their number for that purpose. Message frequency varies with your bookings. Message and data rates may apply. Reply STOP to opt out or HELP for help. We do not share mobile numbers or text-message opt-in consent with third parties or affiliates for marketing or promotional purposes.

How long we keep it

• AI-assistant request logs: 90 days. Email addresses and phone numbers in these logs are stored only in hashed form. We keep daily totals, which contain no personal information, indefinitely.
• Bookings and customer records: 3 years after the last appointment, then deleted or anonymized.
• Billing records: as long as tax law requires, usually 7 years.
• Owner accounts: if you close your account, we delete your listing and data within 30 days, except records we must keep by law.
• Unconfirmed bookings expire and are removed from the calendar automatically.

Security

All traffic to Hahanet is encrypted. Calendar tokens are encrypted at rest. Payment details stay with Stripe. Access to production data is limited to the people who run Hahanet. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.

Your choices

• See, correct or delete your information: owners can do most of this in the dashboard. Anyone can email privacy@hahanet.ai. We answer within 30 days.
• Customers: a business you booked with also keeps its own records of your appointments. Contact them about those records, or ask us and we'll pass the request on.
• Email: service emails are part of booking. Owners can change their alert settings in the dashboard.
• Push notifications: turn them off in your device or browser settings.

Children

Hahanet is not meant for children under 13, and we don't knowingly collect their information. An adult can book an appointment for a child. If you think a child has given us information, email us and we'll delete it.

Changes

If we change this policy, we'll post the new version here with a new date. For material changes, we'll also email business owners before the change takes effect.