Heya is a builder for simple, responsive one-page websites, available at heya.page and in the builder at app.heya.page. Heya is operated by Bitgate, Inc. ("Bitgate", "we", "us"). This policy explains what personal information we collect when you visit heya.page, use the builder, or publish a site with Heya, and what we do with it.
It doesn't cover information that site owners collect from their own visitors. If you have a question about a site built with Heya, please contact the person who runs that site.
1. Information we collect
We only collect what we need to run Heya:
- Account details. Your email address, and your name if you add it. If you sign in with a provider such as Google, we receive the basic profile details that provider shares.
- Your sites. The text, images, links and settings you add to your sites, and the address you publish them at.
- Billing details. When you buy a plan, our payment provider, Stripe, processes your payment. We receive your plan, billing country, and your card's brand, last four digits and expiry date. We never see or store your full card number.
- Messages. What you send us when you email us or contact support.
- Form submissions. When visitors fill in a form on a Heya site, we process their submission on behalf of the site owner so it can be delivered.
- Technical data. Like most websites, our servers log basic request details: IP address, browser and device type, the pages requested, the referring page, and the time of the request.
While you edit in the builder, your work is saved in your own browser on your device. It isn't sent to us until you publish it or save it to an account.
2. How we use information
- To provide Heya: run the builder, host and publish your sites, and keep your account secure.
- To process payments and send receipts.
- To send service messages, such as security alerts and important changes to Heya. We only send marketing emails if you agree to receive them, and you can unsubscribe at any time.
- To answer your questions and give support.
- To prevent abuse, fraud, spam and phishing, and to enforce our Terms of use.
- To understand how Heya is used, using aggregated data, so we can improve it.
We don't sell your personal information, and we don't use it to build advertising profiles.
Where the GDPR applies, we rely on these legal bases: performing our contract with you, our legitimate interests in running and securing Heya, complying with legal obligations, and your consent where we ask for it.
3. Cookies and local storage
heya.page doesn't use advertising cookies or cross-site trackers. The builder stores your drafts and preferences in your browser's local storage, so your work is still there when you come back. When you sign in, we use a cookie or token to keep you signed in.
You can clear this data at any time in your browser settings. Drafts that haven't been published or saved to an account will be lost.
4. Sharing and service providers
We share personal information only when it's needed to run Heya, with service providers that process it for us under contract:
- Cloudflare, for hosting, content delivery, security and email routing.
- Stripe, for payments and billing.
- Google Firebase, for sign-in.
- OVHcloud, for database hosting in the European Union.
We may also share information when the law requires it, to protect the rights, safety and security of our users or the public, or as part of a merger, acquisition or sale of assets. In that case, this policy keeps applying to your information.
Sites you publish are public. Anyone with the address can see them, unless you protect a site with a password.
5. International transfers
Our database is hosted in the European Union. Some of our service providers process data in other countries, including the United States. When personal information leaves the European Economic Area, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.
6. How long we keep information
We keep your account and site data while your account is open. When you delete a site or close your account, we remove it from the live service and delete the remaining copies, including backups, within a reasonable time.
We keep some records longer when the law requires it, such as invoices for tax purposes. Server logs are kept for a short period for security and troubleshooting.
7. Your rights and choices
Depending on where you live, you have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw your consent at any time. You can update most details in your account. For anything else, email hello@heya.page and we'll reply within 30 days.
If you're in the European Union, you can also lodge a complaint with your local data protection authority. In the Netherlands, that's the Autoriteit Persoonsgegevens.
8. Security
We protect your information with encryption in transit, encrypted backups, and access limited to the people and systems that need it. No method of transmission or storage is completely secure, but we work hard to protect your data, and we'll notify you and the authorities of a breach when the law requires it.
9. Children
Heya isn't intended for children under 16, and we don't knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we'll delete it.
10. Changes to this policy
We may update this policy as Heya changes. We'll post the new version on this page and update the date at the top. If a change is significant, we'll also let you know by email or in Heya before it takes effect.
11. Contact us
Heya is operated by Bitgate, Inc. If you have questions about this policy or your personal information, email hello@heya.page.
Questions? We're here to help.