Privacy policy

HEIP is operated by [Company legal name], [registered address]. Email: [privacy@ contact address].

Data protection contact: [name or role, and EU / UK representative if applicable].

This policy covers two groups of people, and our role is different for each.

• A. Visitors to websites that use HEIP. We process data on behalf of the website owner, our customer. We act as their processor.
• B. HEIP customers and visitors to this website. We decide how this data is used. We act as the controller.

Legal characterisation of these roles: [confirm with counsel].

• Interaction timing and coarse page state: how the page is being used, not what is on it.
• The network address of the connection, for security and rate limiting.
• The session and action identifiers our customer's server sends us, and any reference our customer adds.

We do not collect typed characters or which keys are pressed, form values, page content, names, emails, phone numbers, identity documents, faces, voices or other biometrics, cookies or cross-site identifiers.

We do not build profiles of people or track them across websites.

To help our customer protect important actions on their website, such as payments, logins and withdrawals, against automated abuse, and to keep our own service secure.

Legal basis: [for example, our customer's legitimate interest in preventing fraud, and contract; confirm with counsel].

• Account details for the HEIP dashboard: name, work email and a hashed password.
• Billing details: [describe once billing exists].
• Messages you send us, by email or through a contact form.

This website does not use analytics or advertising cookies. If you choose a light or dark theme, that choice is stored in your browser's local storage and never sent to us.

Legal basis: [contract and legitimate interest; confirm with counsel].

• With the customer whose website you visited: decisions and their reasons, not raw interaction data.
• With our subprocessors: [subprocessor list, with purpose and location].
• When the law requires it.
• We do not sell data.

[where data is processed, and the safeguards used for transfers; depends on hosting location]

Decisions are only ever returned to our customer's server, keys are domain-locked and stored hashed, and data from the browser is protected against tampering and replay. Details are on our security page.

Depending on where you live, you can ask to access, correct or delete your data, object to or restrict its use, receive a copy of it, and complain to a supervisory authority.

If you visited a website that uses HEIP, please contact that website first: they decide how HEIP is used, and we will help them answer you.

Applicable laws and authorities: [confirm with counsel].

HEIP is a service for businesses and is not directed at children.

If we change this policy, we will update the date at the top of this page and, for significant changes, tell our customers directly before the change takes effect.

[Company legal name], [registered address]. Email: [privacy@ contact address].