Legal

Privacy Policy

Effective date: August 10, 2026

This policy explains how Heplon UG (haftungsbeschränkt) i.G., Kolonnenstraße 8, 10827 Berlin, Germany ("Heplon", "we", "us", "our") handles personal data for which it is the controller, such as data about visitors to heplon.com and data about the people who hold or administer a Heplon account, including their name, email, and how they use the platform. Full provider details are in our legal notice.

It does not cover personal data that sits inside the systems you connect to the Heplon platform, such as names appearing in your source code or logs. We process that data only on your instructions, as a processor, and you remain the controller. That processing is governed by our Data Processing Agreement, and it is you, not us, who informs the individuals concerned.

1. Data we collect

Information you provide

  • Account information: Email address, name, and company name when you sign up or request early access.
  • Communications: Messages you send us via email or through the platform.

Information collected automatically

  • Usage data: Pages visited, features used, and interaction patterns.
  • Device data: Browser type, operating system, and IP address.

2. How we use your data

We use your personal data for the purposes below, each with its legal basis under Art. 6 GDPR:

  • To provide and maintain our service and manage your account (performance of a contract, Art. 6(1)(b) GDPR).
  • To communicate with you about your account or our services (performance of a contract, Art. 6(1)(b), and our legitimate interest in supporting and informing our users, Art. 6(1)(f) GDPR).
  • To improve and secure our service and develop new features (our legitimate interest in improving and securing the service, Art. 6(1)(f) GDPR).
  • To comply with legal obligations (Art. 6(1)(c) GDPR).

3. Data sharing

We do not sell your personal data. We may share data with:

  • Service providers who assist in operating our platform (hosting, analytics, email delivery), bound by data processing agreements.
  • Legal authorities when required by law or to protect our rights.

Where a service provider processes personal data outside the EU or EEA, we rely on an adequacy decision or the EU Standard Contractual Clauses, and you can obtain a copy of the safeguards by contacting us.

4. Data retention

We retain your data for as long as your account is active or as needed to provide our services. You may request deletion of your data at any time by contacting us.

5. Your rights (GDPR)

If you are in the European Economic Area, you have the right to:

  • Access, correct, or delete your personal data.
  • Object to or restrict processing of your data.
  • Data portability: receive your data in a structured, machine-readable format.
  • Withdraw consent at any time.
  • Lodge a complaint with a supervisory authority.

6. Cookies

We use the following types of cookies:

  • Essential cookies: Required for the operation of our website. These cannot be disabled.
  • Analytics cookies: We use Google Analytics to understand how visitors use our site. These cookies (such as _ga and _ga_*) collect anonymized data about pages visited and interactions. Analytics cookies are only set after you give your consent. Google Analytics is provided by Google, which may transfer data to servers in the United States; such transfers take place on the basis of the EU Commission's adequacy decision for the EU-U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses.
  • Embedded video: If you click play on the YouTube video embedded on our site, YouTube may set cookies or use similar local-storage technologies in your browser. No such cookies are set until you click play. See section 7 for details.

You can accept or decline analytics cookies when you first visit the site, and change your preference at any time via the "Cookie settings" link in the footer. If you decline, no analytics cookies are stored and no personal data is sent to any third party.

7. Embedded content (YouTube)

Our website embeds a video hosted on YouTube, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with its parent Google LLC located in the United States.

To minimise data sharing, we use YouTube's privacy-enhanced mode (youtube-nocookie.com) and a click-to-play mechanism: no YouTube iframe is loaded and no connection to Google's video servers is established until you actively click the play button. When you click play, your IP address, browser information, and referring URL are transmitted to Google, and YouTube may set cookies or use similar local-storage technologies in your browser. The video preview image is loaded from Google's servers (img.youtube.com) when the page loads, which also transmits your IP address to Google.

Because Google may transfer data to servers in the United States, such transfers take place on the basis of the EU Commission's adequacy decision for the EU-U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses.

Legal basis: our legitimate interest in presenting product information in video form (Art. 6(1)(f) GDPR) for the thumbnail preview, and your consent (Art. 6(1)(a) GDPR) for playback, given by clicking the play button. You can object to the processing or withdraw consent at any time; if you do not click play, no iframe is loaded.

Further information is available in Google's privacy policy at policies.google.com/privacy.

8. Security

We implement industry-standard security measures to protect your data, including encryption in transit and at rest.

9. Changes to this policy

We may update this policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the effective date.

10. Contact

If you have questions about this privacy policy or your data, contact us at hello@heplon.com.