Privacy Policy

Henad builds operations software for fashion brands: collections, products, tech packs, production, wholesale and finance in one workspace. This policy covers henad.work, the Henad application, and the public line sheets published from it.

Henad is established in Spain and operates under the EU General Data Protection Regulation and Spanish data-protection law. Write to henad.work@gmail.com for anything in this document.

The controller is Henad, a sole trader established in Spain. See the Legal notice.

Henad plays two different roles, and which one applies changes who decides what happens to the data.

• Henad is the controller for its own activities: creating and administering accounts, authentication, billing, support, security monitoring, and the narrow service telemetry we need to keep the product working.
• Henad is a processor for the business content a customer puts into its workspace, including personal data about that customer's buyers, suppliers, factories and staff. The customer decides what to collect and why; we act on its documented instructions under a data processing agreement.

If you are a buyer, supplier or employee and your data is in a brand's Henad workspace, that brand is the controller. Send your request to the brand. If you send it to us, we will pass it on and tell you we have done so.

Account and identity

Your name, email address, workspace membership and role, and either a password we store only as a hash or the identifier of the Google account you signed in with. We never receive your Google password.

Workspace content

Everything your team creates in Henad: products, collections, materials, suppliers, tech packs, boards, orders, invoices, uploaded files, comments and the notes you write. This can contain personal data about people outside your company.

Technical and usage data

IP address, browser and device characteristics, pages and features used, timestamps, error reports and performance traces. We use this to keep the service secure and to understand which parts of the product are used.

AI feature content

The text, images and workspace records you submit to an AI feature, and the output it returns. See AI features below.

Support

The messages, screenshots and files you send us when you ask for help, and our replies.

• To provide the service — performance of our contract with you or your employer. This covers accounts, authentication, storing and serving your workspace, and support.
• To keep it secure and available — our legitimate interest in protecting the service, its customers and their confidential information. This covers logging, backups and rate limiting.
• To improve the product — our legitimate interest in understanding how Henad is used, limited to aggregated and pseudonymised measurement. We do not build cross-customer benchmarks, lead lists or commercial reports from customer content.
• Non-essential storage on your device and any session recording — your consent. See the Cookie Policy.
• Billing, tax and answering lawful requests — compliance with a legal obligation.

Where we rely on legitimate interests you can object, and we will stop unless we can show compelling grounds that override your rights.

A Henad workspace holds prices, margins, costs, suppliers, capacity, launch calendars, designs and buyer pipelines. That information is commercially sensitive whether or not it is personal data, so we commit to a narrower use than the law alone would require. We process customer content only to provide, secure, support and exit the service.

We do not:

• sell customer content, or use it for advertising;
• use it to train or fine-tune machine-learning models;
• use one customer's content to inform, advise or supply another customer, or any fashion business connected to Henad or its founders;
• build cross-customer benchmarks, prompt corpora or example libraries from it;
• search across tenants. Each workspace is isolated at the database level, and application access is scoped to the workspace you are signed in to.

Some features send content to AI providers on your instruction: drafting and reading tech packs, generating flats and swatches, removing image backgrounds, taking product measurements, answering questions about your workspace, and retrieving public web results.

• An AI request carries what that feature needs — your prompt, the records in scope and any images you attached. It does not carry other customers' data.
• AI requests go to the providers listed under Who else processes data, under those providers' API terms. Henad itself does not use customer content to train models.
• AI output can be wrong. It is a draft for a person to check, not a decision. Nothing in Henad makes an automated decision about a person with legal or similarly significant effects.
• We keep a record of which feature ran and whether it succeeded, so a failed run can be diagnosed.

A brand can publish a line sheet as a private link and send it to a buyer. On that page, Henad acts as the brand's processor. The brand decides who receives a link and what the page contains.

When a buyer opens a line sheet link, we record for the brand:

• that the link was opened, and when;
• which items were viewed, and any quantities or notes entered;
• a visit identifier stored in a cookie so repeat visits from the same browser are recognised as one sitting;
• a one-way hash of the visitor's network address, not the address itself.

A line sheet page may also record the session: pointer movement, scrolling and what is typed into the page's fields, except passwords. The brand uses it to see how its offer was read. Recordings expire after 30 days. The Cookie Policy describes this recording.

A line sheet link is the only protection on that page, so treat it as confidential. Brands can revoke a link, set an expiry and require a password.

Henad uses Meta's official Instagram API. Data received from Meta is processed only as described here.

A brand's own Instagram account

A brand can connect its own Instagram professional account through Facebook Login. On the brand's instruction, Henad then:

• reads the account's profile and posts;
• reads post insights: views, reach, likes, comments, saves and shares;
• reads daily account figures;
• reads aggregated follower demographics by country, city, age and gender, top values only;
• publishes the content items the brand chooses to post;
• stores an access token for the brand's Facebook Page, encrypted.

For this data, Henad acts as the brand's processor.

Creators and competitors a brand tracks

A brand can list Instagram business and creator accounts to follow. Through Meta's official Business Discovery API, Henad reads the public profile of each listed account: username, name, biography, website, follower, following and post counts, and the likes, comments and views on recent posts. Each reading is kept with its date, so changes over time can be shown. Personal, private and age-gated accounts cannot be read this way. See If a brand tracks your public Instagram profile.

What Henad does not do

• post, comment or send messages unless a person chooses to;
• read private messages;
• sell or share Instagram data.

Disconnecting Instagram stops further reading. Data already read stays until it is deleted. See Data deletion to ask for that.

This section is for creators and other account holders whose public Instagram profile a brand follows in Henad. It gives the information required by article 14 GDPR, because the data does not come from you directly.

• Source: Meta's Business Discovery API, which returns public profile data of Instagram business and creator accounts.
• What is read: username, name, biography, website, follower, following and post counts, and the likes, comments and views on recent posts. Each reading is dated.
• Purpose: the brand evaluates and manages collaborations with creators.
• Legal basis: the brand's legitimate interest in finding and working with creators. Henad processes the data for the brand.
• Who decides: the brand is the controller. Henad is its processor.
• How long: while the brand tracks the account. When the brand stops tracking it, no further readings are taken. On request we delete the stored readings.
• Your rights and how to object: email henad.work@gmail.com. We pass your request to the brand, which decides whether to keep tracking the account. The rights in Your rights also apply.
• Complaints: you can complain to the Spanish Data Protection Agency (www.aepd.es).

We use a small set of subprocessors. Each one receives only what its function needs, under that provider's terms.

We also disclose data when the law requires it, and to professional advisers under confidentiality. We do not sell personal data.

We host the application, database, file storage and analytics in the European Union. AI, transcription, search and email providers may process data outside the EEA. Where that happens we rely on the European Commission's Standard Contractual Clauses together with an assessment of the destination country and additional technical measures such as encryption in transit, minimised payloads and no-retention instructions. Ask henad.work@gmail.com for the transfer mechanism that applies to a specific recipient.

• Workspace content and account records — while the workspace or account is active. We delete them on request, through the data deletion process.
• Line sheet session recordings — they expire after 30 days.
• Invoices and accounting records — as long as Spanish tax and commercial law require.
• Backups — database backups are kept for seven days and deleted files stay recoverable for 30 days, so deleted data can remain in backups for up to 30 days.

• Encryption in transit, and encryption at rest for file storage.
• Tenant isolation enforced in the database with row-level security per workspace, so a query in one workspace cannot reach another's rows.
• Role-based access inside a workspace.
• Tokens for connected integrations are stored encrypted.
• Encrypted daily database backups with point-in-time recovery.

If a breach affects your personal data we notify the Spanish Data Protection Agency as the law requires, and tell affected customers and individuals without undue delay. Report a suspected vulnerability to henad.work@gmail.com.

You can ask for access to your data, correction of what is wrong, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time, which does not affect processing that already happened.

Write to henad.work@gmail.com. We answer within one month and may extend that by two months for a complex request, telling you why. We may ask for enough information to confirm who you are.

If the data sits in a customer's workspace, we forward the request to that customer, who decides it as controller.

You can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the supervisory authority where you live. We would rather hear from you first.

We update this policy when the product or our processing changes. The version and date at the top always describe the current text. For a change that materially affects how we handle personal data we notify account administrators by email at least 30 days before it takes effect, and keep the previous version available on request.

• Privacy and data rights — henad.work@gmail.com
• Security reports — henad.work@gmail.com
• Data deletion — see Data deletion
• Contracts and DPAs — henad.work@gmail.com