Privacy Notice

Last updated: June 12, 2026

This Privacy Notice explains how Hasil ("Hasil", "we", "us") collects, uses, shares, and protects personal data when you use our website at hasil.io and our products, Hasil Pricing and Hasil Sync (the "Service").

1. Who we are

Hasil is the controller of personal data processed in connection with the Service. You can contact us at info@hasil.io.

2. Personal data we collect

  • Account data: name, email address, login credentials.
  • Merchant data: Shopify store URL, store metadata, catalog information you connect.
  • Support data: messages, attachments, and correspondence you send us.
  • Usage and telemetry: pages viewed, features used, errors, device identifiers, IP address.
  • Cookies: essential cookies required to operate the Service.

Payment card details are collected and processed by Paddle, our Merchant of Record (see Section 5). Hasil does not store full payment card numbers.

3. Purposes and legal bases

  • Create and operate your account — performance of a contract.
  • Provide, maintain, and improve the Service — legitimate interests.
  • Detect, prevent, and address fraud and abuse — legitimate interests and legal obligation.
  • Send service announcements and respond to support requests — performance of a contract.
  • Send marketing communications where required — consent (you may opt out at any time).

4. How we share data

We share personal data only with:

  • Service providers and subprocessors who host, monitor, or support the Service (cloud hosting, email delivery, analytics, error tracking).
  • Paddle.com Market Ltd., our Merchant of Record, for processing payments, managing subscriptions, calculating and remitting taxes, and issuing invoices.
  • Professional advisers (legal, accounting) under confidentiality obligations.
  • Authorities where required by law, court order, or to protect our rights.

5. Paddle as Merchant of Record

Our order process is conducted by our online reseller Paddle.com. Paddle is the Merchant of Record for all orders. Paddle handles billing, payments, fraud screening, sales tax, refunds, and related customer service inquiries. Paddle's processing of personal data is governed by its own privacy notice at paddle.com/legal/privacy.

6. International transfers

Personal data may be transferred to, and processed in, countries other than the one in which you reside. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

7. Data retention

We retain personal data only as long as needed for the purposes described above, to comply with our legal obligations, resolve disputes, and enforce our agreements. Webhook payloads and sync logs are purged after 30 days. QuickBooks-derived cache and mapping data is deleted when QuickBooks is disconnected. Account data is deleted within a reasonable period after account closure unless retention is required by law.

8. Security

We implement appropriate technical and organisational measures including encryption in transit, access controls, and audit logging. No method of transmission or storage is 100% secure.

9. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. Where processing is based on consent, you may withdraw it at any time. You also have the right to lodge a complaint with a supervisory authority.

To exercise these rights, contact info@hasil.io.

10. Cookies and analytics

We use essential cookies required to deliver the Service (for example, to keep you signed in). On our marketing site and merchant app we also ask, in a banner on your first visit, whether we may enable Google Analytics 4 and Google Ads measurement. Until you choose “Accept”, Google consent signals (analytics storage, ad storage, ad user data, ad personalisation) are set to denied and no Google script is loaded at all. Choosing “Decline” keeps them off; your choice is stored locally in your browser and we ask again after twelve months. Buyer portals and the public demo portal never load analytics and never show the banner.

11. Error reporting

When something breaks, we record a technical error report so we can fix it: the error name and message, the code stack trace, the page path with identifiers removed, your browser's user-agent string, and (where relevant) the store the page belonged to. We do not record page content, form values, request or response bodies, cookies, prices, or email addresses; access tokens, secrets and email addresses are stripped before the report is stored. Error reports are visible only to us and are deleted automatically after 30 days. This is necessary for the security and reliability of the Service (legitimate interests) and does not involve advertising.

12. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be announced via the Service or by email.

13. Contact

Questions about this notice: info@hasil.io.