Privacy
Three domains. No key between them.
Three separate data domains, with no join key between anonymous activity and contact identity. Anonymous activity, voluntary contact identity, and what a customer configured are three separate systems. Configuration is read by both of the others; nothing is read across between them, because no identifier exists that would make such a read possible.
On this page
- What "no IP address kept" means, precisely
- What "no location" means, precisely
- What each of the three domains holds
- How the separation is drawn
- What the crisis path produces, which is nothing
- What the logs are for
- What happens to an enquiry you send us
- What happens when you use the chat on this site
- What the anonymous experience never stores
What "no IP address kept" means, precisely
The homepage says no IP address is kept. Here is exactly what that covers, because a claim you cannot check is not worth making.
HABLA™'s own application and data layer never writes an IP address. It is not stored, not recorded beside a topic, and not written to any log HABLA keeps. Nothing in the anonymous experience receives one.
A web request still carries an IP, and no server can un-receive it. Saying otherwise would be false. Two things on this site are rate-limited to stop abuse — the enquiry form on the contact page, and HABLA AI, the chat that opens from any page — and both counts happen inside HABLA's own processes, not at somebody else's network edge. What those processes hold is not your address: it is a keyed digest of it, computed under a random value the process generates when it starts and forgets when it stops, held in memory beside a count for the length of that window and written to no file and no database. Both run the same code, and that code is only ever handed a key and a clock, so the count is never recorded next to anything you selected or wrote.
That distinction is the honest one: what HABLA controls is whether an address is retained, and it is not.
What "no location" means, precisely
The same distinction applies, and it deserves the same plain answer.
HABLA never asks your device for its location, and never stores one.
There is no GPS permission prompt, no geolocation API call, and no location field anywhere in the anonymous experience.
To show you the right language, the network edge reads a country code from your connection.
It is used to pick English or Spanish when your device has not already made that clear, and it is discarded in the same breath — never stored, never written to a log HABLA keeps, and never recorded beside a topic you selected.
HABLA counts that country code as a location attribute, which is exactly why it is never kept. It would be easy to argue that a country is too coarse to matter — that it does not narrow you to a city, a building, or a campus — and to treat it as harmless on that basis. HABLA does not make that argument. What is controlled here is retention, not the category: the code is read, used once, and gone.
Separately, HABLA records which placement was used — a specific poster, QR code, or link. That is a property of the material, not of you: it does not establish that you were physically anywhere.
What each of the three domains holds
Separation is only worth anything if you can see what is on each side of it. These are the three, in the order a person meets them.
- Anonymous activity
- What HABLA counts: which deployment, which placement, which audience pack, which topic, and how often — nine values on one row, with two more records kept beside that row rather than on it. The time it keeps is a whole hour, never an exact moment, because an exact time is the value that would let one record be paired with another. Every value on that row is about an interaction. None of them is about a person, and the full list is at the foot of this page.
- Voluntary contact
- This domain is empty until somebody decides to leave anonymous mode and ask to be contacted. It then holds what that person chose to give and the recipient they chose to reach. Nothing they selected on the anonymous side travels with it, and the recipient, the expected response window and the fact that this is not an emergency channel are all on screen before anything is sent.
- Platform configuration
- What the customer set up: sites, audience packs, placements, the topic library, the resources on offer, the named recipients a contact request can reach, and the administrator accounts that manage all of it — which now means their sign-in secrets as well: a password hash, a second-factor secret, single-use recovery codes, a session record and a counter of failed attempts. That counter is kept against the account rather than against a network address, so the one thing this page says HABLA never keeps does not arrive through the side door that usually brings it. It holds no audience-member identity of any kind. Administrator identity lives here and has no path into the person’s experience — administrators are staff rather than the people the product is for, and the two never meet.
Configuration is read by the other two. Nothing is read across between the first two. And beyond all three sit the cross-organization layer and the sealed store, each its own separate database and neither of them a fourth domain: the first receives what a deployment sends it and never queries a customer’s own data; the second keeps the already-suppressed figures of a closed reporting period — figures derived from anonymous activity, kept so that a report goes on resolving to what it showed — with no row about a person in it and no way to reach one. How the separation is enforced in the database.
How the separation is drawn
Three domains, no join key
Anonymous Activity, Contact, and Platform Configuration are separate systems. No key exists to connect the first two.
-
Nine fields on one row, and two records kept beside that row rather than on it, both of them counters — the whole of what an interaction leaves behind. HABLA declares no identifier here — no session id, no device id, no address — and no key that joins this domain to the contact one. Two things that shape does not close, written here rather than argued away: the database engine stamps its own internal version numbers on every row, which HABLA does not declare and cannot drop, and a count in a very small cell still adds up. Reading either needs a table-level read on these tables, and no role holds one.
-
Held only because someone asked to be contacted, and only for that purpose.
-
What a customer configured, plus the administrator accounts that configured it. Reads into both planes; carries no audience-member identity.
-
Platform Configuration reads into the anonymous domain and into the contact domain, and it does so with a separate access to each. Nothing was declared that would match a row on one side to a row on the other. What the database engine stamps on its own rows is written into the anonymous record beside this drawing rather than argued away here.
Below the floor, nothing is shown
Two floors, not one. A count is suppressed below ten activity events, and the floor is applied to each topic in each hour of each day, before the month is added up; a placement or audience pack is only reportable on its own if it also covers at least fifty people.
-
Suppressed. Not rounded, not estimated, and never shown next to another number that could reveal it by subtraction.
-
A fixed threshold. It is not lowered for a larger contract — that refusal is the product.
-
Clears the activity floor. Reported as forty-two activity events — never as forty-two people.
-
The second floor. A placement or audience pack covering fewer than fifty people is not reportable on its own however high its count climbs — its activity rolls into the parent site.
What the crisis path produces, which is nothing
Opening a crisis resource is the one action in the product that most obviously invites an organization to want a number. There is none to want.
Reaching a crisis resource produces no organizational record: no count, no trend, no alert, no individual score, and no row in any report. Leadership is not silently notified, and nothing about it reaches the reporting side of the product in any form.
HABLA is not monitored in real time. Nobody is watching while somebody uses it, and nothing raises an alarm. An organization that needs someone watched in real time needs a different product, and saying so plainly is more useful to both sides than a reassuring sentence would be.
The resources HABLA ships, including 911 and 988, are in every plan and cannot be removed by a customer. A customer may add its own; it may not take these away.
What the logs are for
Every system writes logs, and a privacy claim that pretends otherwise is not worth reading. The rule HABLA holds itself to is about what a log may be combined into: telemetry exists so that infrastructure can be kept healthy, and a log that lets somebody reconstruct one person’s journey through the product is a defect whatever it was collected for.
Some things are never intentionally retained together — across application, server, proxy, CDN, database and error telemetry alike: an address alongside a sensitive topic, device information alongside a topic, and an exact timestamp alongside a topic and a placement. Each one is a pairing rather than a field, because a pairing is what makes a reconstruction possible.
And one requirement that is stronger than all three. The client address is not retained in any log HABLA controls, in any combination at all — which is the same boundary the top of this page draws, held across every surface rather than only the application. Nothing in the anonymous experience receives one.
Third-party services count as surfaces. A content network or an error tracker that keeps request-level detail is inside this rule, not outside it. What has been checked, and what has not.
What happens to an enquiry you send us
Everything above is about the product. This section is about this website: the form on the contact page is one of the two places where HABLA asks a real person for their details — HABLA AI, the chat, is the other, and it has its own section below — and a privacy page that covers three domains of a product and skips the form on its own site has answered the easy half.
Which of the three domains you are in: none of them. The enquiry form is the business enquiry channel — a buyer asking for a walkthrough — and it is a different system from the person-side contact handoff that runs inside a customer deployment. It is also outside the anonymous experience entirely. What you write there reaches no activity counter, no topic and no HABLA database of any kind, and no selection made on the anonymous side travels with it, because there is no identifier that could carry it.
What you send, and where it goes. Your name, your work email, your organization and your message; optionally your role, the kind of organization, and roughly how many people it would cover. The endpoint composes those into a single email and delivers it to the shared inbox at Pragmatic Business Solutions, the company behind HABLA, where a person reads it and replies. HABLA's own systems keep no copy: the process that sends it holds no database connection at all, and afterwards the message exists only as mail.
The retention rule for this path is a mailbox, and naming it is more honest than naming a period. Every other retention rule HABLA publishes is a column in a database that a deletion job can act on. This one has no table and no column, because the message was never in a HABLA store to begin with — so the accurate statement is the one that names the store it is actually in: a work inbox that people read and answer, kept for as long as the conversation is useful, with no automated deletion behind it.
What you can ask for, and what kind of promise it is. Write to the address in this page's footer, ask us to delete your enquiry, and we delete it and tell you when it is done. That is a commitment kept by people rather than a property of running code, and it is a weaker kind of guarantee than the rest of this page describes — an inbox is a place a person can copy something out of. Saying which kind it is, is the point of stating it here. There is no mailing list to add you to, no analytics on this site to attach you to, and no third party this form hands anything to. HABLA AI, the chat, is the one path on this site where that last sentence would not be true, which is why it has a section of its own rather than a clause inside this one.
What happens when you use the chat on this site
HABLA AI is the chat that opens from any page of this website. It is the one place on this site where something you write is sent to a company that is not HABLA, so it is stated here in full rather than only inside the chat window.
What it is for, and what it will not do. It answers questions about HABLA — the product, how it works, what it costs, and the company behind it — from HABLA's own published documents. It is not a support channel, not advice, and not a route to any service. If somebody writes about a personal, health, workplace or safety matter, the reply is a single fixed sentence written by HABLA rather than by the model: that the chat cannot help with that here, and that 988 and 911 are there. No message is sent and nobody is contacted.
What is sent, and to whom. To write each reply, the conversation and HABLA's product documentation are sent to Anthropic, the company that runs the Claude model. HABLA adds nothing of its own to that: no identifier, no cookie, no IP address, no device information and no page address — only the language of the page you are on, so that the reply comes back in the language you are reading. What is sent is what you typed. If you give a name and a work email in the chat, they are in the conversation, and the conversation is what is sent — which is why the chat asks you not to type personal, health or workplace details into it. Anthropic's own handling of what it receives is theirs to describe and not something this page can promise for them.
What HABLA keeps of a conversation afterwards. Once the reply is written, the conversation is gone from HABLA's side: there is no transcript store, no cookie is set, no identifier is kept, and no log line HABLA writes carries a turn of a conversation. The chat is rate-limited by address in exactly the way the enquiry form is, by the same code — a keyed digest under a random value the process generates when it starts and forgets when it stops, held in memory beside a count, written to no file and no database. The same reading, service by service.
If you ask the chat to have someone contact you. It takes the same four things the contact form does — a name, a work email, an organization and what you want to discuss — and shows you all four, and who they go to, on a card before anything moves. It goes only when you press send, and it goes to the same shared inbox the contact form reaches, so what holds it afterwards is that mailbox and the section above describes it. The chat cannot send it anywhere else: the recipient is set in the service's configuration and is not something a conversation can change.
What the anonymous experience never stores
- Name
- Phone
- IP address
- Device identifier
- Fingerprint
- Session identifier
- Cookie identifier
- GPS or location
- Free text
- Diagnosis
- Risk score
What it stores instead: which deployment, which placement, which audience pack, which topic, which date, which hour, which language, how many, and how much the statement fit — nine fields on one row, with two more records kept beside that row rather than on it, both of them counters: how many topics an interaction involved, and how often a topic was named the most important.
This page is the one to read adversarially.
If a claim here cannot be checked against the architecture, it should not be here. Ask about the parts that sound too strong — that is the conversation this page exists to start.