Privacy Policy

The data controller is Samuele Cumani, Via Le Povere 22, 60044 Fabriano (AN), Italy. For any request regarding your data, write to info@heku.dev.

• Account: email address, name or display name, profile picture if any, registration date, password (which we never see: it is stored in encrypted form by the authentication service).
• Projects and chats: the messages you write to the assistant, the files you attach (images, logos, screenshots), the code and content of the generated sites, the saved versions, and the published sites.
• Technical logs: IP address, browser and device type, access times, pages and features used, application errors, and AI model usage metrics (tokens and cost per turn). They are needed to run and protect the service; we keep them for 90 days.
• Payments (once paid plans are active): payments go through Stripe, which processes card data as an independent data controller. We receive only the outcome, the amount, the plan chosen, and the data needed for the invoice. We do not store card numbers.
• Enterprise requests: if you fill out the form on the Enterprise page, we process your name, work email, company, team size, indicative budget, and message, solely to reply to you.

• To provide the service (creating your account, building and publishing sites, storing projects, charging credits): the legal basis is the performance of the contract, Art. 6(1)(b) of the GDPR.
• For security and abuse prevention (logs, usage limits, blocking of fraudulent activity): legitimate interest, Art. 6(1)(f).
• For legal obligations (accounting and tax on payments): Art. 6(1)(c).
• For service communications (confirmations, notices about your account, credits, changes to the terms): performance of the contract. We do not send promotional emails; if we ever do, we will ask you first (consent, Art. 6(1)(a)) and you will be able to say no at any time.

The content of your projects and chats is sent to the AI model providers listed in section 5 solely to generate what you ask for. We do not use it to train models.

• Account, projects, and chats: for as long as your account exists.
• Account deletion: at your request sent to info@heku.dev, we delete your account, projects, chats, and files within 30 days. Published sites are taken offline.
• Technical logs: 90 days, then deleted or anonymized.
• Billing data: for the time required by Italian law (as a rule, 10 years).
• Enterprise requests: up to 24 months from the last contact.

We do not run physical servers. We rely on the following providers, each appointed as a data processor (Art. 28 GDPR) for its own part:

• Vercel (United States): hosting of the application and of the published sites.
• Supabase, through Lovable Cloud (servers in the European Union): database, authentication, files, and backups.
• Anthropic and OpenAI (United States): AI models that generate code, text, and images based on your requests.
• E2B (United States): isolated environments in which the preview of the site runs while you build it.
• Resend (United States): sending of service emails.
• Hostinger (European Union): registration and management of the heku.dev domain.
• Stripe (once payments are active): collection of payments, as an independent data controller.

For providers based in the United States, data is transferred with the safeguards provided for by the GDPR: standard contractual clauses approved by the European Commission and, where the provider participates in it, the EU-US Data Privacy Framework. We do not sell or transfer your data to third parties for their own purposes.

At any time, you can ask to:

• know what data we hold about you and receive a copy of it (access and portability);
• have it corrected if it is wrong (rectification);
• have it deleted, by closing your account (erasure);
• restrict its processing or object to it, in the cases provided for by law;
• withdraw a consent you have given, without affecting what was done before.

An email to info@heku.dev from the address you registered with is all it takes: we reply within 30 days. If you believe the processing violates the law, you can turn to the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Heku is not intended for anyone under the age of 16. If we discover an account opened by a minor under 16 without the consent of the person holding parental responsibility, we close it and delete the data.

How we protect data is described on the Security page. We use only technical cookies and storage, with no tracking: the details are on the cookie page.

If we change anything substantial, we will tell you by email or with a notice in the service. The version and date at the bottom always say which text is in force.