Privacy Policy

Last updated: January 30, 2026

1. Introduction

ERIENTA ("we", "our", or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform at heras.app (the "Platform"), in compliance with the General Data Protection Regulation (GDPR - EU 2016/679) and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is ERIENTA Platform. For questions about this policy or your personal data, contact us at:

Email: privacy@heras.app
Data Protection Officer: dpo@heras.app

3. Data We Collect

3.1 Data You Provide

Account data: name, email address, phone number, date of birth
Profile data: bio, avatar, languages spoken, timezone, country
Session data: booking details, chat messages, session notes, uploaded photos
Payment data: billing information (processed securely by Stripe)
Expert application data: qualifications, experience, identification documents

3.2 Data Collected Automatically

Technical data: IP address, browser type, device information, operating system
Usage data: pages visited, features used, session duration, timestamps
Cookie data: session cookies, preference cookies (see our Cookie Policy)

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contract performance: to provide our services, manage bookings, and process payments
Legitimate interest: to improve our platform, prevent fraud, and ensure security
Consent: for marketing communications, cookie usage, and optional data processing
Legal obligation: to comply with tax, accounting, and regulatory requirements

5. How We Use Your Data

Providing and managing your account and sessions
Processing payments and payouts to experts
Matching you with appropriate service providers
AI-assisted features (session summaries, suggestions) -- using anonymized data where possible
Communicating service updates, booking confirmations, and reminders
Improving platform functionality and user experience
Preventing fraud and ensuring platform security
Complying with legal and regulatory obligations

6. Data Sharing

We share your data only with:

Experts: your name, booking details, and session notes (necessary for service delivery)
Payment processors: Stripe (for secure payment processing)
Cloud services: Supabase (database, storage), Vercel (hosting)
AI services: OpenAI (anonymized session data for AI features)
Email services: Resend (for transactional emails)
Legal authorities: when required by law or court order

We never sell your personal data to third parties.

7. Data Retention

Account data: retained while your account is active, plus 30 days after deletion request
Session data: retained for 12 months after the session
Payment records: retained for 7 years (legal/tax obligation)
Audit logs: retained for 2 years for security purposes
Cookie data: varies by cookie type (see Cookie Policy)

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

Right of Access (Art. 15)

You can request a copy of all personal data we hold about you.

Right to Rectification (Art. 16)

You can request correction of inaccurate or incomplete data.

Right to Erasure (Art. 17)

You can request deletion of your personal data ("right to be forgotten").

Right to Restrict Processing (Art. 18)

You can request that we limit processing of your data in certain circumstances.

Right to Data Portability (Art. 20)

You can request your data in a structured, machine-readable format (JSON).

Right to Object (Art. 21)

You can object to processing based on legitimate interest or for direct marketing.

Right to Withdraw Consent (Art. 7)

You can withdraw consent at any time for consent-based processing.

To exercise these rights, contact us at privacy@heras.app or use the data export/deletion features in your account settings.

9. Data Security

We implement appropriate technical and organizational measures including:

Encryption in transit (TLS/HTTPS) and at rest
Secure password hashing (bcrypt)
JWT-based authentication with token expiry
Rate limiting and IP-based throttling
Content Security Policy headers
Regular security audits and monitoring
Role-based access control for staff

10. International Data Transfers

Some of our service providers may process data outside the EEA. When this occurs, we ensure adequate protection through Standard Contractual Clauses (SCCs), adequacy decisions, or other approved transfer mechanisms under GDPR Chapter V.

11. Children's Privacy

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete such data promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice on our Platform. We encourage you to review this policy periodically.

13. Contact & Complaints

If you have questions, concerns, or wish to exercise your rights, please contact:

Email: privacy@heras.app
DPO: dpo@heras.app

You also have the right to lodge a complaint with a supervisory authority (Data Protection Authority) in your country of residence if you believe your data protection rights have been violated.