Privacy
Last updated: October 9, 2026
This Privacy Notice explains how HappySupport UG (haftungsbeschränkt) ("HappySupport", "we", "us", "our") collects, uses, and protects your personal data when you visit our website or use our Service. We process your data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
1. Data Controller
HappySupport UG (haftungsbeschränkt)
c/o Campus Founders
Bildungscampus 11
74076 Heilbronn, Germany
Email: contact@happysupport.ai
Web: www.happysupport.ai
Legal representative: Niklas Gysinn
2. What Data We Collect
2.1 Account Data
When you create an account, we collect:
- First name and last name
- Email address
- Password (stored as a cryptographic hash, never in plain text)
- Company name (optional)
2.2 Service Usage Data
When you use the Service, we process:
- Help center articles, guides, and recordings you create
- Configuration settings (branding, widget setup, integrations)
- GitHub repository data, if you connect a repository: we read the repositories you select (read-only access to code and metadata) and keep a local copy of the default branch and the branches you link to a help center on our servers in Germany, to detect product changes and suggest documentation updates
- Widget interaction data (page views, clicks on guides, tour completions)
2.3 Technical Data
When you access our website or Service, our servers automatically collect:
- IP address (anonymized for analytics)
- Browser type and version
- Operating system
- Referring URL
- Pages visited and time of access
- Device identifiers
2.4 Communication Data
When you contact us via email or through the Service, we process the content of your messages, your email address, and any attachments you send.
2.5 Payment Data
Payment transactions are handled by our payment processor, Stripe. We do not store your credit card details or bank account information. Stripe processes and stores this data in compliance with PCI DSS standards. We receive from Stripe: transaction ID, subscription status, billing country, last four digits of the payment method, and invoice details.
3. Why We Process Your Data (Purposes and Legal Bases)
| Purpose | Data Categories | Legal Basis (GDPR) |
|---|---|---|
| Providing the Service (account creation, feature delivery, help center hosting) | Account data, service usage data, technical data | Art. 6(1)(b) Performance of contract |
| Processing payments and managing subscriptions | Account data, payment data | Art. 6(1)(b) Performance of contract |
| Sending service-related communications (account notifications, security alerts, service changes) | Account data, email address | Art. 6(1)(b) Performance of contract |
| Improving and developing the Service (bug fixes, performance monitoring, feature development) | Service usage data, technical data (aggregated/anonymized where possible) | Art. 6(1)(f) Legitimate interest (improving our product) |
| Ensuring security (fraud prevention, abuse detection, access logs) | Technical data, account data | Art. 6(1)(f) Legitimate interest (security of the Service) |
| Marketing communications (product updates, newsletter) | Email address, name | Art. 6(1)(a) Consent |
| Responding to your inquiries and support requests | Communication data, account data | Art. 6(1)(b) Performance of contract |
| Complying with legal obligations (tax records, regulatory requirements) | Account data, payment data | Art. 6(1)(c) Legal obligation |
4. Data Processing on Behalf of Customers
When our customers use HappySupport to create help centers, the HappyWidget may collect data from their end users (e.g., page views, guide interactions). In this case, our customer is the data controller for their end users' data, and we act as a data processor under Art. 28 GDPR.
Our Data Processing Agreement (DPA) governs this relationship. It is available upon request at contact@happysupport.ai.
5. Where Your Data Is Hosted
All Service data is hosted and stored in the European Union:
- Application servers: Germany (Nuremberg)
- Database: Germany (Frankfurt)
- File storage (images, recordings, exports): Germany (Frankfurt)
- AI processing: European Union (Microsoft Azure in Sweden, Amazon Bedrock in the EU)
Repository data, help center content, search queries and AI answers are processed exclusively in the EU. Only the following functions involve a transfer outside the EU (see section 7):
- Optional voice transcription: if you dictate while recording an article, the audio segments are transcribed by OpenAI in the USA. If you do not use voice recording, no transfer takes place.
- Transactional emails (invitations, verification, notifications) are sent via Resend.
- Payments are processed by Stripe.
6. AI Processing
We use AI models exclusively through business API access:
| Function | Provider | Region | Retention at the provider |
|---|---|---|---|
| AI search, AI answers, article generation and editing, translations, repository analysis | Microsoft Azure OpenAI | Sweden (EU) | Up to 30 days for abuse monitoring, stored in the EU region |
| Article generation and editing | Amazon Bedrock (Anthropic Claude models) | EU | None (zero data retention agreement with AWS) |
| Semantic search (embeddings) | Microsoft Azure OpenAI | Sweden (EU) | Up to 30 days for abuse monitoring, stored in the EU region |
| Optional voice transcription | OpenAI | USA | Up to 30 days for abuse monitoring |
None of the providers use your data to train their models. We do not use your content to train, fine-tune, evaluate or benchmark AI models either.
To analyse errors, we log AI inputs and outputs with Langfuse (Ireland, EU) and delete these logs after 30 days.
7. Sub-Processors and International Data Transfers
We use the following service providers to operate the Service:
| Provider | Purpose | Location of processing | Safeguards |
|---|---|---|---|
| netcup GmbH | Application hosting | Germany | DPA |
| Neon Inc. | Database (PostgreSQL) | Germany (Frankfurt) | DPA, EU-US Data Privacy Framework, SCCs |
| Amazon Web Services EMEA SARL | File storage (S3), AI models (Amazon Bedrock) | Germany (Frankfurt) / EU | DPA, zero data retention for AI, EU-US Data Privacy Framework, SCCs |
| Microsoft Ireland Operations Ltd. (Azure) | AI models (Azure OpenAI) | Sweden | DPA, EU Data Boundary, EU-US Data Privacy Framework, SCCs |
| Langfuse GmbH | Logging of AI processes for error analysis | Ireland | DPA, deletion after 30 days |
| OpenAI Ireland Ltd. | Optional voice transcription only | USA | DPA, SCCs, no training on customer data |
| Plus Five Five, Inc. (Resend) | Transactional emails | USA | DPA, EU-US Data Privacy Framework, SCCs |
| Stripe Payments Europe, Ltd. | Payment processing, invoicing, subscription management | EU / global | DPA, EU-US Data Privacy Framework, SCCs, PCI DSS |
If you choose to connect your GitHub repository, your repository data is processed by GitHub (Microsoft) under your own agreement with GitHub. We access your repository data through the GitHub API based on the permissions you grant.
We only engage sub-processors who provide sufficient guarantees for appropriate data protection measures. Customers with a Data Processing Agreement are notified of changes at least 30 days in advance.
Where data is transferred outside the EU/EEA, we ensure adequate protection through the EU-US Data Privacy Framework certification of the recipient and/or Standard Contractual Clauses (SCCs) approved by the European Commission. You can request a copy of the relevant transfer safeguards by contacting us.
8. Data Retention
| Data Category | Retention Period |
|---|---|
| Account data | Duration of the account + 30 days after deletion |
| Customer Data (articles, guides, recordings) | Duration of the account + 30 days for export after termination |
| Search queries and AI answers | Not stored in our database; AI logs are deleted after 30 days |
| Server logs (incl. IP addresses) | 30 days |
| Backups | Up to 35 days |
| Payment/invoice records | 10 years (German tax law, § 147 AO) |
| Support correspondence | 3 years after resolution (limitation period) |
| Marketing consent records | Duration of consent + 3 years after withdrawal |
| Widget interaction data | As defined by the customer (data controller); default 12 months |
After the retention period expires, data is permanently deleted or irreversibly anonymized. Deleted data is removed from backups within 35 days at the latest.
9. Cookies and Analytics
9.1 Essential Cookies
We use cookies that are strictly necessary for the operation of our website and Service, such as session cookies and authentication tokens. These are required for the Service to function and do not require consent under the GDPR.
9.2 Analytics
We use Umami to understand how our website is used. It sets no cookies, stores nothing on your device, and reads nothing from it. To tell one visit from another it uses an identifier calculated on the server from your IP address, your browser's user agent and a secret value that changes every day. Because that value changes daily, the identifier cannot be used to recognise you the next day, and we cannot build a profile of you over time.
What is recorded for each page view is the page address, the referring address, your browser, operating system and device type, your approximate location at country level, and any interaction we count as a conversion, such as clicking through to sign up. Your IP address is used only to calculate the identifier described above and to derive the country, and is never stored.
Because nothing is stored on or read from your device, section 25 TDDDG does not require your consent for this. The processing itself rests on our legitimate interest in measuring and improving our website (Art. 6(1)(f) GDPR). You can object to it at any time under section 10.
Data is processed on our behalf by Umami Software, Inc. We do not use the data for advertising and we do not share it with advertising networks.
Until 5 August 2026 we used Google Analytics for this purpose.
9.3 No Third-Party Advertising
We do not use third-party advertising cookies or sell your data to advertisers.
10. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
| Right | Description | GDPR Article |
|---|---|---|
| Access | Request a copy of the personal data we hold about you. | Art. 15 |
| Rectification | Request correction of inaccurate or incomplete data. | Art. 16 |
| Erasure | Request deletion of your data ("right to be forgotten"), subject to legal retention obligations. | Art. 17 |
| Restriction | Request that we limit the processing of your data in certain circumstances. | Art. 18 |
| Data portability | Receive your data in a structured, machine-readable format or have it transferred to another controller. | Art. 20 |
| Objection | Object to processing based on legitimate interests, including profiling. | Art. 21 |
| Withdraw consent | Withdraw any consent you have given at any time, without affecting the lawfulness of prior processing. | Art. 7(3) |
To exercise your rights, contact us at contact@happysupport.ai. We will respond within 30 days.
Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for HappySupport is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart, Germany
Web: www.baden-wuerttemberg.datenschutz.de
11. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you (Art. 22 GDPR). Our AI features (such as AI-powered search and content suggestions) assist in content creation but do not make decisions about individuals.
12. Security
We implement appropriate technical and organizational measures to protect your data, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Access controls and role-based permissions
- Regular security assessments
- Employee access limited to what is necessary
- Incident response procedures
13. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach (Art. 33 GDPR). If the breach poses a high risk to you personally, we will also notify you directly (Art. 34 GDPR).
14. Children's Privacy
The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
15. Changes to This Privacy Notice
We may update this Privacy Notice from time to time. The "Last updated" date at the top of this page reflects the most recent version. We encourage you to review this page periodically.
16. Contact
For any questions about this Privacy Notice or our data processing practices:
HappySupport UG (haftungsbeschränkt)
c/o Campus Founders
Bildungscampus 11
74076 Heilbronn, Germany
Email: contact@happysupport.ai
Web: www.happysupport.ai