This Privacy Policy applies to How AI Assist Limited (operating in Hong Kong and Greater Bay Area) and HAA SYNERGY LIMITED (Company Registration No. SC886749, registered in Scotland at Office 400, 18 Young St, UNIT LGE, Edinburgh, EH2 4JB, UK) — collectively referred to as "How AI Assist", "HAA", "we", "us" or "our".

We are the Data Controller for personal data collected through this website (www.howaiassist.com). For enquiries: contact@howAIassist.com

We collect the following categories of personal data:

• Contact information: Name, email address, company name, country, and message content when you submit our contact form or register interest in our products.
• Newsletter subscriptions: Email address when you subscribe to our newsletter.
• Analytics data: Anonymised page views, device type, browser, and navigation behaviour via Google Analytics 4 (only with your consent).
• Technical data: IP address (anonymised), cookies and similar technologies (see our Cookie Policy).

We do not collect sensitive personal data (special category data) via this website.

We process your personal data on the following lawful bases under UK GDPR Article 6:

• Consent (Art. 6(1)(a)): Analytics cookies, newsletter subscriptions, and marketing communications.
• Contractual necessity (Art. 6(1)(b)): Processing enquiries and providing services you request.
• Legitimate interests (Art. 6(1)(f)): Website security, fraud prevention, and improving our services — balanced against your rights.
• Legal obligation (Art. 6(1)(c)): Compliance with UK law, including record-keeping obligations.

• Responding to enquiries and providing requested information about our services.
• Sending newsletters and updates (where you have subscribed and consented).
• Analysing website usage to improve our content and user experience (with consent).
• Maintaining website security and preventing fraudulent activity.
• Complying with our legal obligations under UK law.

We do not sell, rent, or trade your personal data to third parties.

We share data with the following trusted processors only as necessary:

• Google Analytics 4 (Google LLC) — anonymous usage analytics. Data is anonymised and subject to Google's privacy policy. You may opt out via cookie preferences.
• Resend — email delivery for transactional and newsletter communications. Processed under a Data Processing Agreement (DPA).
• Base44 (Wix) — our website platform and database infrastructure, operating within approved data centres under EU/UK standard contractual clauses.

Any international data transfers are subject to appropriate safeguards under UK GDPR Chapter V (adequacy decisions or standard contractual clauses).

• Contact form submissions: Retained for 24 months from the date of enquiry, then securely deleted.
• Newsletter subscriptions: Retained until you unsubscribe. You may unsubscribe at any time via the link in our emails.
• Analytics data: Retained for 14 months in Google Analytics (our configured data retention period).
• Cookie consent records: Stored in your browser's local storage; cleared when you clear your browser data.

You have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing (Art. 18): Request we limit how we use your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: Withdraw consent at any time without affecting prior processing.

To exercise any right, contact us at contact@howAIassist.com. We will respond within one calendar month as required by UK GDPR.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113.

We implement appropriate technical and organisational security measures including:

• HTTPS encryption for all data in transit (TLS 1.2+).
• Content Security Policy (CSP) headers to prevent cross-site scripting.
• X-Frame-Options and X-Content-Type-Options headers.
• Strict referrer policy and permissions policy to minimise data leakage.
• Regular review of access controls and third-party processors.

We use cookies and similar technologies on this website. Please see our Cookie Policy for full details on what cookies we set, their purpose, and how to manage them.

You can manage your cookie preferences at any time by clearing your browser's local storage or using the cookie preference link in the footer.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated policy on this page with the revised date. For significant changes, we will notify subscribers by email.

We encourage you to review this policy periodically.