Privacy Policy

The data controller is Vitali Lavau, an individual developer based in Poland. Haviko is not currently operated as a commercial service or registered business.

For privacy questions or requests, email vitali.lavau@gmail.com.

• Account data: email address, username, name, profile image, account identifiers, verification state, and authentication metadata managed through Clerk.
• Planning data: purchase items, descriptions, categories, priorities, budgets, currencies, statuses, quantities, uploaded images, saved store offers, and account preferences.
• AI data: the relevant item details, general shopping country, currency, measurement system, saved offers, generated output, and request timestamps needed for usage limits. Haviko does not intentionally send your name, email, Clerk identifier, or exact address to Gemini or Tavily.
• Technical data: IP address, browser and device information, request metadata, and security or error logs that hosting and authentication providers may generate when you use the service.

Most data comes directly from you. Technical and authentication data may also be supplied by Clerk, Vercel, or your browser.

• Creating your account and providing the purchase planning workspace: steps requested by you and performance of the service agreement.
• Generating AI advice and finding offers when you press the relevant button: performance of the service you requested.
• Preventing misuse, enforcing request limits, diagnosing failures, and protecting accounts: legitimate interests in operating a secure and reliable demonstration.
• Responding to lawful requests and complying with legal obligations: compliance with applicable law.

Haviko does not use your data for advertising, sell it, or send marketing messages. It does not make solely automated decisions that produce legal or similarly significant effects. AI output remains advisory and requires your action before any Haviko data is changed.

Haviko depends on the following external services. They may process data as a processor, subprocessor, or independent controller depending on the data and their applicable terms:

• Clerk — account creation, authentication, and profile management.
• Vercel and Vercel Blob — application hosting, delivery, security logs, and item images.
• Neon — managed PostgreSQL database hosting.
• Google Gemini API — AI-generated buying guidance and offer ranking.
• Tavily — web search used by Find offers.

Some processing may take place outside the European Economic Area, including in the United States. Depending on the provider and account terms, the relevant transfer mechanism may be an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses. Contact the controller if you need information about the mechanism applicable to a specific provider.

Gemini and Tavily queries must not contain personal, confidential, or sensitive information. Tavily may use portions of query data to improve its service under its terms. Review item descriptions before starting an AI request.

• Account, planning, preference, offer, image, and AI usage records are generally retained while your Haviko account exists or until you delete the relevant item or image.
• Using Delete account removes the Haviko database record, owned item images, and Clerk account. Deletion cannot be undone.
• Security logs, abuse-monitoring records, and backup copies controlled by external providers may remain for their limited retention periods or where law requires retention.

Haviko currently uses only storage needed to provide the requested service. No analytics, advertising, affiliate, or cross-site tracking technologies are installed by Haviko.

• Clerk uses necessary cookies and similar storage to create, secure, and maintain authentication sessions.
• Haviko uses browser local storage to remember interface preferences such as dashboard sidebar state and purchase table page size. These values do not identify you across other websites.

Because these mechanisms are necessary for authentication or functionality you request, Haviko does not display a cookie-consent banner. If optional analytics or advertising technologies are added later, they will remain disabled until any legally required consent is obtained.

Subject to GDPR conditions and exceptions, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may export planning data from Settings and delete the account there at any time.

Send other requests to vitali.lavau@gmail.com. Identity may need to be verified before a request is fulfilled. You may also lodge a complaint with the Polish President of the Personal Data Protection Office (UODO).

Haviko uses access controls, encrypted HTTPS connections, server-side secrets, user ownership checks, and managed infrastructure. No online service can guarantee absolute security, so do not store sensitive, confidential, or irreplaceable information in this portfolio project.

Haviko is not directed to children. You must be at least 18 years old to create an account. If you believe a child has provided data, contact the controller so it can be reviewed and removed.

This policy may be updated when Haviko changes providers or functionality. The effective date and version at the top of the page identify the current text. Material changes will be communicated in the application where reasonably possible.