Privacy Notice

haas-lab is operated by an individual based in the Republic of Korea. That person decides why and how the personal data described here is processed, and is the point of contact for any question about it.

There is no company behind haas-lab yet — no incorporated entity of any kind. We would rather tell you that than name one that does not exist. If that changes, this section changes with it and the date at the top moves.

Write to privacy@haas-lab.com. We aim to respond within 10 working days.

We do not ask for a password. Everything in the first row arrives from the identity provider you choose at sign-in.

Firmware binaries are treated as your content. We do not inspect them beyond the automated safety checks needed to protect the hardware, described in the documentation. If you put personal data inside a firmware image or print it over the serial port, it lands in the job record like anything else.

We do not build a profile of you to predict or influence what you do, we do not make automated decisions with legal or similarly significant effects about you, and we do not use your data to train machine-learning models. If you turn analytics on, we count what happens in the product, under a random per-browser identifier that is not linked to your account, so we can see which features are used.

Until August 2026 the service ran from a single workstation in Korea. It no longer does, and that is the reason this notice exists in its current form.

We do not sell personal data and we do not share it for anyone else’s marketing. Data reaches the following companies because they run infrastructure on our behalf, and they process it only on our instructions.

Because these companies and their facilities sit outside the Republic of Korea, using haas-lab necessarily involves transferring your personal data overseas, for the whole time your account exists, for the purposes in section 3. The categories transferred are the ones listed above.

If you do not want your personal data transferred on these terms, do not create an account; if you already have one, write to us and we will close it and delete the data described in section 6. We cannot operate the service without these transfers, so refusing them and using haas-lab are not compatible.

We may also disclose data where the law requires it, and to professional advisers under a duty of confidence. If the business is ever sold or reorganised, we will tell you before your data moves to a different operator.

Being plain about this: no scheduled process deletes user data today. Deletion happens when you ask for it, or when we close your account. We would rather say that than publish a retention schedule nothing enforces.

When you close your account we delete your identity, jobs, firmware, serial logs, tokens, feedback and ledger. We may keep a minimal record that a given account existed and was closed, where we need it to resolve an outstanding damage report or to meet a legal obligation, and no longer than that requires.

You can ask us to:

• confirm whether we hold personal data about you, and give you a copy;
• correct anything inaccurate;
• export your data in a machine-readable form;
• delete your account and the data described in section 6;
• stop or restrict a particular use; and
• explain anything in this notice that is unclear.

Email privacy@haas-lab.com from the address on your account. If you write from a different address we will ask you to prove control of the account one, because acting on an unverified deletion request is its own kind of breach.

There is no button in the interface for these yet. A person receives the request and carries it out against the database. We would rather tell you that than imply an automation that does not exist. You can already revoke an individual API token yourself from your settings, and delete an individual job from its page.

If you are in Korea and are not satisfied with our response, you may contact the Personal Information Protection Commission or the Korea Internet & Security Agency’s privacy call centre (dial 118).

• No advertising, no advertising identifiers, no ad networks.
• We use one analytics service, PostHog, and only for people who turn it on. It tells us which pages are visited and which actions are taken; it does not record your screen, your keystrokes, what you type into forms, or what you copy. We do not share anything with anyone for their own marketing.
• No selling or renting of personal data.
• No use of your firmware, serial output or feedback to train machine-learning models.
• No accounts for children. haas-lab is a developer tool and is not directed at anyone under 14. If we learn that a child has created an account we will delete it.
• No health, payment-card, biometric or government-identifier data. Do not send it to us; if you do, we will delete it.

Access to production data is limited to the people who operate the service. API token secrets are stored only as one-way hashes. Traffic to the site is encrypted in transit. Administrator actions check a database-backed permission on every request rather than trusting the interface.

We are not going to tell you the service is “secure” or claim certification under any framework, because neither has been independently verified. If we ever discover a breach affecting your personal data, we will notify you and the relevant authority as the law requires.

When we change how data is handled — a new recipient, a new country, a new purpose — we will update this page and change the date at the top. For a change that materially affects you, we will tell you before it takes effect rather than after.

Two kinds of storage are used in your browser.

Necessary. Keeping you signed in and protecting the sign-in form. Without these you cannot use an account, so there is nothing to turn off. They are set when you sign in.

Analytics, only if you turn it on.PostHog stores an identifier in your browser's local storage and a cookie so that separate visits can be counted as one person rather than several. Nothing is stored and nothing is sent until you turn analytics on.

How to refuse. Analytics is off until you turn it on, so refusing means doing nothing. If you have turned it on, turn it off in your profile; we stop sending immediately and clear what is stored in your browser. You can also block or delete these through your browser's own settings, and you can use a tracker blocker — we do not route analytics through our own domain to get past one. Turning analytics off changes nothing else: every part of haas-lab works the same either way.