Privacy Policy — AhaFeed

Effective date: 9 July 2026 Last updated: 9 July 2026

This Privacy Policy describes how LUFTANALYTICS S.R.L., a company registered in Romania under no. J8/3253/2023, VAT RO49102453, with its registered office at Str. Tohanița nr. 83B, Zărnești, Brașov County, 505800, Romania (“AhaFeed”, “we”, “us”), collects, uses, and protects personal data in connection with the AhaFeed platform available at ahafeed.com (the “Service”).

AhaFeed is a business-to-business (B2B) software platform that helps multi-location brands manage their Google Business Profile presence and customer reviews, with analytics and AI-assisted response capabilities.

We are committed to processing personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Romanian law. Our AI management practices are certified under ISO/IEC 42001.

1. Who this policy covers

Visitors of ahafeed.com
Prospective customers who contact us or request a demo
Customer users — employees or contractors of our business customers who use the Service under a customer account
Data subjects in customer content — primarily authors of public Google reviews processed on behalf of our customers (see Section 6, where we act as a processor)

2. Data we collect

2.1 Data you provide

Contact and demo requests: name, business email, company, phone (if provided), message content
Account data: name, business email, role, authentication credentials (passwords are stored hashed; optional two-factor authentication data)
Billing data: company details, VAT number, billing address, payment references (payments are handled by our payment provider — we do not store full card numbers)

2.2 Data collected automatically

Log data (IP address, browser type, pages visited, timestamps)
Cookies and similar technologies (see Section 9)

2.3 Data from Google APIs (with your authorization)

When a customer connects a Google Business Profile account, we access, with the customer’s explicit OAuth consent:

Business location data (names, addresses, categories, attributes, business status)
Reviews and review metadata (author display name, rating, review text, timestamps)
Review replies and posting capabilities, used to publish responses on the customer’s behalf

3. Google API Services — Limited Use disclosure

AhaFeed’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

We only use Google user data to provide and improve user-facing features of the Service that are prominent in our user interface (managing locations, monitoring and responding to reviews, analytics).
We do not sell Google user data.
We do not use Google user data for advertising.
We do not allow humans to read Google user data unless (a) we have the customer’s affirmative agreement, (b) it is necessary for security purposes or to comply with applicable law, or (c) the data is aggregated and anonymized.
We do not use Google user data to train generalized artificial intelligence or machine-learning models. AI features operate on the specific customer’s data solely to deliver the feature to that customer (see Section 4).

Customers can revoke AhaFeed’s access to their Google account at any time via their Google Account security settings, and may request deletion of imported Google data as described in Section 8.

4. AI features

The Service uses large language model (LLM) technology (provided by third-party AI infrastructure providers, currently Anthropic) to generate draft responses to reviews and narrative analytics.

AI outputs are generated from the customer’s own connected data and customer-defined settings (e.g., brand voice).
We contractually require that our AI providers do not use data submitted through our accounts to train their models.
AI-generated review responses are published under the customer’s control and settings; customers remain responsible for the content they publish.
Our AI management system is certified under ISO/IEC 42001.

5. Purposes and legal bases (where we act as controller)

Purpose	Data	Legal basis (GDPR)
Providing and operating the Service	Account, log data	Art. 6(1)(b) — contract
Responding to inquiries and demo requests	Contact data	Art. 6(1)(b) / 6(1)(f) — pre-contractual steps / legitimate interest
Billing and accounting	Billing data	Art. 6(1)(c) — legal obligation
Security, abuse prevention	Log data	Art. 6(1)(f) — legitimate interest
Service communications and relevant product updates	Business contact data	Art. 6(1)(f) — legitimate interest, with easy opt-out; consent where required
Analytics on our website	Cookie data	Consent (Art. 6(1)(a)), where required

6. Our role for customer content (processor)

For business location data, reviews, and related content imported from a customer’s Google Business Profile, the customer is the data controller and AhaFeed acts as a data processor, processing such data only on the customer’s documented instructions, under a Data Processing Agreement (DPA) that forms part of our customer contracts. Review authors who wish to exercise data-subject rights over their reviews should primarily address the platform where the review was published (Google) and/or the business concerned; we will assist our customers with such requests as required by the DPA.

7. Recipients and sub-processors

We share personal data only with:

Sub-processors required to operate the Service, under data-processing terms: hosting and infrastructure (EU-based cloud infrastructure), database and storage providers, AI infrastructure (Anthropic), email delivery, error monitoring (e.g., Sentry), payment processing (Stripe).
Google, when publishing responses or syncing data at the customer’s instruction.
Authorities, where required by law.

A current list of sub-processors is available on request at razvan@luftanalytics.ro. We do not sell personal data.

International transfers: where a provider processes data outside the EU/EEA, we rely on adequacy decisions or Standard Contractual Clauses (SCCs), with supplementary measures where appropriate.

8. Retention and deletion

Account and customer content: for the duration of the contract; deleted or anonymized within 90 days after termination (backups purge on a rolling schedule of up to 30 additional days).
Contact/demo data of prospects: up to 24 months from last interaction.
Billing records: 10 years, as required by Romanian fiscal law.
Google-derived data: deleted upon disconnection of the Google account, upon customer request, or upon contract termination — whichever comes first.

9. Cookies

ahafeed.com uses strictly necessary cookies and, subject to your consent where required, analytics cookies. You can manage preferences via the cookie banner and your browser settings. (Strictly necessary: session/authentication. Analytics: only with consent.)

10. Your rights

Subject to the GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time (without affecting prior processing). To exercise these rights, contact razvan@luftanalytics.ro. We respond within one month.

You also have the right to lodge a complaint with a supervisory authority — in Romania: ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, www.dataprotection.ro).

11. Security

We apply appropriate technical and organizational measures, including encryption in transit, tenant isolation at the database level (row-level security), role-based access control, two-factor authentication, and logging/monitoring. No system is 100% secure; we notify affected parties and authorities of personal-data breaches as required by law.

12. Children

The Service is intended for business use and not directed at children under 16. We do not knowingly collect data from children.

13. Changes

We may update this policy; material changes will be announced on this page (and, for customers, by email). The “Last updated” date reflects the current version.

14. Contact

LUFTANALYTICS S.R.L. · Str. Tohanița nr. 83B, Zărnești, Brașov County, 505800, Romania · razvan@luftanalytics.ro