Privacy Policy

This is an English translation of the Polish Privacy Policy, provided for convenience. If the two versions differ, the Polish version prevails.

1. Who is responsible for your data

The controller of your personal data is Maciej Czuper, a sole trader who runs the Heuriso service at heuriso.com (“Heuriso”, “we”).

For any matter related to personal data, email contact@heuriso.com. We reply without undue delay and no later than within one month.

2. What data we process and where it comes from

Account. The email address and password you provide when you sign up. We don’t know your password: it is stored by our authentication provider (Supabase) only as a cryptographic hash. We also save the date you accepted the terms, your decision on marketing consent and your username, if you set one.

Team. If you invite other people to your account, we process their email addresses so they can sign in and work on your projects.

Payments. Payments are handled by Stripe. We don’t see or store your card details. On our side we store your Stripe customer ID, the plan you chose, the subscription status and the renewal date. The details needed for a receipt or invoice (such as company name, address and tax ID) are provided to and stored by Stripe.

Projects. What you enter when you create and manage a project: brand name, website address, country, language, description of your offer, topics, prompts and the list of competitors. Plus the measurement results: the answers AI assistants give to your prompts, the sources they cite, and the content of publicly available web pages (your website and pages cited by the assistants) that we fetch for the site audit and the action plan. This is mainly data about companies, not people. It may include personal data, for example if a company is named after its owner.

Google connections. If you connect a Google Analytics or Google Search Console account, we process the data described in section 4.

Correspondence. When you write to us, we process your email address and the content of your message.

Technical data. Our servers log IP addresses, the time and URL of requests and error messages. We use these logs only to run and secure the service.

Visit statistics (Google Analytics). Only if you agree in the cookie banner: which pages you view, how you found us, your device and browser type, your approximate location (country, city) and key actions in the service (creating an account, completing setup, starting a measurement, going to checkout). After you sign in, we attach a random account identifier so the same person on several devices is counted once. We don’t send your email address, company name or the names of the brands you monitor.

Heatmaps and session recordings (Microsoft Clarity). Only if you agree in the cookie banner, and only on the public pages of the service (home page, pricing, blog, sign-up): mouse movements, clicks and scrolling, which are used to build heatmaps and replays of a visit, as well as your device and browser type and approximate location. Text typed into form fields is masked. We don’t record the dashboard after you sign in or the project setup; their content is masked.

We don’t collect data for advertising purposes and don’t use advertising pixels.

3. Purposes and legal bases

• Creating and running your account and providing the service (monitoring, reports, audit, action plan, integrations): performance of a contract, Article 6(1)(b) GDPR.
• Handling payments and subscriptions: performance of a contract, Article 6(1)(b) GDPR.
• Issuing and keeping sales documents, tax settlements: legal obligation, Article 6(1)(c) GDPR.
• News about features and tips (newsletter): your consent, Article 6(1)(a) GDPR. You can withdraw it at any time.
• Visit statistics, heatmaps and session recordings (Google Analytics, Microsoft Clarity): your consent, Article 6(1)(a) GDPR. You can withdraw it at any time using the “Cookie settings” link in the page footer.
• Replying to your messages: our legitimate interest in communicating with you, Article 6(1)(f) GDPR.
• Security of the service, detecting abuse and errors, establishing and defending legal claims: our legitimate interest, Article 6(1)(f) GDPR.

We don’t make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you, and we don’t profile you. The language models we use analyze AI assistants’ answers and web content about your brand, not you as a person.

4. Data from Google (Google Analytics and Google Search Console)

Connecting Google is optional and you start it yourself on the Apps screen. We request read-only access only.

What we fetch:

• Google Search Console (scope webmasters.readonly): the list of Search Console properties you have access to and, for the selected website, search queries from the last 28 days with impressions, clicks and average position. This is aggregated data about the website, not about individual users.
• Google Analytics 4 (scope analytics.readonly): the list of Analytics properties you have access to and, for the selected property, aggregated statistics on traffic from AI assistants (sessions and users, conversions, landing pages).
• The email address of your Google account, so we can show which account the integration is connected with.
• A refresh token issued by Google that lets us fetch this data without you signing in again. We store it encrypted (AES-256).

How we use it: only for the features you see in your dashboard. From Search Console queries we prepare prompt suggestions for monitoring, which you approve yourself. Analytics statistics are shown as traffic from AI assistants to your website.

Who we share it with: to rewrite Search Console queries as questions for AI assistants, we send their text (without any data identifying you) to OpenAI via its API. OpenAI processes it as our processor and, under its terms, does not use data sent through the API to train its models. Apart from that, we don’t share Google data with anyone except the infrastructure providers listed in section 5 whose servers run the service.

What we don’t do: we don’t sell Google data, don’t use it for advertising or credit assessment, don’t use it to train or improve general-purpose artificial intelligence models, and don’t allow humans to read it unless you consent (for example when reporting a problem), it is necessary for security reasons, or the law requires it.

Heuriso’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to disconnect Google: click “Disconnect” on the Apps screen. We then revoke access on Google’s side and delete the stored token. You can also revoke access in your Google account settings: myaccount.google.com/permissions. Prompt suggestions previously prepared from Search Console stay in the project until you delete the project or your account. You can also ask us to delete them.

5. Who processes data on our behalf

We use providers that process data on our behalf and according to our instructions:

• Supabase Inc.: database and authentication. Data stored in Stockholm (Sweden, EU).
• Vercel Inc.: hosting of the website and dashboard (rendering in the Stockholm region, EU).
• Railway Corporation: application server (backend).
• Contabo GmbH (Germany): the server that runs measurements in AI assistants.
• OpenAI: analysis of AI assistants’ answers, generating prompts and action plan content.
• Stripe Payments Europe Ltd. (Ireland): payments and sales documents.
• Resend Inc.: sending system emails (address confirmation, password reset).
• Google Ireland Ltd.: sign-in for Google integrations (OAuth) and the interface icon font, loaded from Google Fonts servers. When the font loads, your browser connects to a Google server and sends it your IP address. With your consent, also Google Analytics 4: the visit statistics described in section 2.
• Microsoft Ireland Operations Ltd.: with your consent, Microsoft Clarity, the heatmaps and session recordings described in section 2.

Measurements in AI assistants. To check whether AI assistants mention your brand, we send the text of your prompts to these services: ChatGPT (OpenAI), Gemini and Google AI Overviews (Google), Perplexity, Microsoft Copilot and Claude (Anthropic). We do this from our own accounts, without any data about you. Prompts concern services and categories of companies. Don’t put personal data in them.

We don’t sell data. We may disclose it to public authorities where the law requires it.

6. Transfers outside the European Economic Area

Some providers (Supabase, Vercel, Railway, OpenAI, Resend, Google, Microsoft) are based in the United States, so data may be transferred outside the EEA. This happens on the basis of the European Commission’s adequacy decision (EU–US Data Privacy Framework), where the provider is certified under it, or on the basis of standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR). You can get a copy of these safeguards by emailing contact@heuriso.com.

7. How long we keep data

• Account and projects: until you delete your account. Deleting your account (My account → Delete account) first cancels your Stripe subscription and then deletes the account, projects, measurement results and Google connections.
• Database backups: deleted data disappears from them after 7 days.
• Sales documents and billing data: 5 years from the end of the year in which the tax obligation arose, as tax law requires. They are stored by Stripe.
• Marketing consent: until you withdraw it.
• Correspondence: until the matter is resolved, then for the limitation period of any possible claims.
• Server logs: up to 30 days.
• Google Analytics statistics: 14 months from collection.
• Microsoft Clarity: session recordings 30 days, heatmaps and statistics up to 13 months.

8. Your rights

You have the right to:

• access your data and receive a copy of it,
• have inaccurate data corrected,
• have your data erased (the “right to be forgotten”),
• restrict processing,
• data portability, meaning to receive your data in a machine-readable format,
• object to processing based on our legitimate interest,
• withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise these rights, email contact@heuriso.com. You can do most of this yourself in the dashboard: edit your account details, disconnect integrations and delete your account.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

9. Cookies and browser storage

Strictly necessary items that don’t require consent:

• sign-in session cookies (Supabase): keep you signed in; deleted when you sign out or the session expires,
• lang: remembers your chosen interface language, valid for one year,
• browser storage (localStorage): remembers your last selected project and view settings. It stays on your device and isn’t sent anywhere.

With your consent, also the analytics cookies of Google Analytics (_ga, _ga_*, valid for up to 2 years) and Microsoft Clarity (_clck: one year, _clsk: one day). Without consent, none of these scripts load. We remember your choice in browser storage, and you can change it with the “Cookie settings” link in the page footer. When you withdraw consent, we delete the analytics cookies.

We don’t use advertising cookies. You can delete cookies in your browser settings. Without session cookies you can’t sign in.

10. Security

Connections to the service are encrypted (HTTPS). Access rules in the database let each account read only its own projects, and tables with payment data and Google connections are accessible only to the application server. Access tokens for Google services are stored encrypted, and passwords only as cryptographic hashes. Each project is available only to the account that created it and the people invited to that account.

11. Do you have to provide data?

Providing an email address is required to create an account and use the service. Connecting Google and giving marketing consent are optional. The service is intended for businesses and adults, not for children.

12. Changes to this policy

When we change the way we process data, we’ll update this page and the date at the top. We’ll notify you of significant changes by email before they take effect.