1. Data controller
FEYA, s.r.o., Pekná cesta 19, 831 52 Bratislava-Rača, Slovak Republic. Company ID (IČO): 47 887 541. Registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 100404/B. Tax ID (DIČ): 2024136169. VAT ID (IČ DPH): SK2024136169.
Data-protection contact: privacy@heabsy.com
"Heabsy", "we", "us" means FEYA, s.r.o. — operator of the Heabsy Platform and of the heabsy.com domain. We have not appointed a statutory Data Protection Officer; data-protection matters are handled at the address above. Our lead supervisory authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR).
2. Our two roles: controller and processor
For the heabsy.com website and account sign-in, we act as a data controller and decide how the personal data described below is processed.
For content you send to the Heabsy Platform inference API (your prompts and the resulting completions), we act as a data processor on behalf of you, the customer, who remains the controller of that content. Our processing of that content is governed by our Data Processing Addendum (GDPR Art. 28), which forms part of your agreement with us where you process personal data through the Service.
3. What data we collect
Automatically (when you visit heabsy.com)
- IP address (via Cloudflare logs)
- Browser type, operating system, device type
- Pages visited, time spent, referrer
- Cookies (see our Cookie Policy)
Provided by you
- When you sign in: email, name, profile picture (via Google or your organisation's single sign-on)
- When you use chat: conversation content
- When you use the Heabsy Platform API: organisation name, contact email, API key identifiers (keys are stored hashed)
We do not collect
- Payment card information (we don't take card payments directly)
- Special-category data (health, biometrics) or government IDs — do not send these to the Service
4. Heabsy Platform (inference API)
For API customers we record, as controller, usage metadata only: per request — model name, timestamps, token counts (including cached-token counts), request status, and the key that made the request. This metadata is the basis of billing. It does not include prompt or completion content.
We do not retain the content of prompts or completions processed on Heabsy infrastructure. For models served on Heabsy infrastructure (marked as such in the model catalog), request and response text is processed in memory on the inference node handling your request and is not written to durable storage or to our logs. A conversation may transiently reuse an in-memory prefix cache on the inference node that serves it, purely to accelerate generation; that cache is not persisted, and no output is ever served to one customer from another customer's request. Our records retain token counts and request metadata, not content.
Training. We do not use prompts or completions processed on Heabsy infrastructure to train, fine-tune, or improve models. For catalog models fulfilled by third-party inference providers (below), those providers are governed by their own data policies; where a no-training / no-logging routing option is available upstream, we request it. For partner-hosted models served through NanoGPT, no zero-data-retention routing is enabled: NanoGPT's and its downstream providers' policies govern retention and any use of content for training.
Third-party-fulfilled models. Some catalog models are not served on Heabsy infrastructure but fulfilled by third-party inference providers. Models marked as partner-hosted (on heabsy.com/models and in the dashboard, together with a “no ZDR” mark) are served through NanoGPT; other third-party-fulfilled models are routed via OpenRouter. For those requests, prompt and completion content is transmitted to the respective provider, which may pass it on to a downstream inference provider of its choice, and their data policies apply. Zero data retention does not apply to these models, and we do not promise processing in the EEA for them. If content residency or non-retention matters to you, use models served on Heabsy infrastructure.
5. Why we process data (legal bases, GDPR Art. 6)
| Purpose | Data used | Legal basis |
|---|---|---|
| Authenticate you | Email, password hash, OAuth tokens | Art. 6(1)(b) — contract |
| Provide the Service (incl. inference) | Account and usage metadata | Art. 6(1)(b) — contract |
| Security monitoring & abuse prevention | IP, User-Agent, access logs | Art. 6(1)(f) — legitimate interest in keeping the Service secure and available |
| Service communications | Art. 6(1)(b) — contract | |
| Optional marketing email | Art. 6(1)(a) — consent (withdrawable any time) | |
| Accounting & tax | Financial records | Art. 6(1)(c) — legal obligation |
Where we rely on legitimate interest, you may object at any time under Art. 21 (see §9).
6. How long we keep data
| Data | Retention |
|---|---|
| Account | Until you delete the account |
| Prompt / completion content (Heabsy-served models) | Not persisted — processed in memory only for the duration of the request |
| Prompt / completion content (partner-hosted and other third-party-fulfilled models) | Not stored by Heabsy; retained by the third-party provider and its downstream providers according to their own policies (no zero data retention) |
| Usage metadata & financial records | 10 years (Slovak accounting/tax law) |
| Application logs | 30 days |
| Security audit logs | 1 year |
7. Who sees your data (sub-processors)
| Recipient | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare | DNS, CDN, security, IP logging | Global | EU-US DPF / SCCs |
| Google (OAuth) | Optional sign-in | Global | EU-US DPF / SCCs |
| EEA GPU compute providers (incl. marketplace hosts) | Compute capacity for Heabsy-served inference — hosts process prompt & completion content in memory during inference; no durable storage of content by us | EEA | Within EEA |
| NanoGPT | Inference for catalog models marked as partner-hosted — prompt and completion content is transmitted to NanoGPT and the downstream inference provider it selects; no zero data retention | Global (downstream providers vary by model) | Provider's own policies; SCCs where applicable |
| OpenRouter | Routing for catalog models marked as third-party-fulfilled | US / global | Provider's own policies; SCCs where applicable |
Inference capacity is rented from third-party GPU compute providers (including GPU-marketplace hosts) located in the EEA; these providers' hosts necessarily process the prompt and completion content in memory while generating a response. For catalog models marked as partner-hosted, NanoGPT — and for other models marked as third-party-fulfilled, OpenRouter — in turn routes requests to further downstream inference providers that vary by model and are governed by their own policies; Heabsy does not individually control which downstream provider serves such a request. A current list of sub-processors is available on request. We will give advance notice of new sub-processors as set out in the DPA.
We never sell your data. We disclose to law enforcement only on valid legal process and will notify you where legally permitted.
8. International data transfers
Some sub-processors are outside the EU/EEA (see the table above). Where that is the case we rely on an adequacy decision, the EU-US Data Privacy Framework, or Standard Contractual Clauses with a transfer-impact assessment, as applicable. Inference on models served on Heabsy infrastructure is provisioned exclusively in data centres within the European Economic Area.
9. Your rights (GDPR Art. 15–22)
If you are in the EU/EEA you have the right to access, rectify, erase, restrict, port, and object to processing of your data, and to withdraw consent where consent is the basis. To exercise these rights, email privacy@heabsy.com — we respond within one month, extendable by up to two further months for complex or numerous requests (we will tell you if we need the extension). You may also lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk) or with your local supervisory authority. Where you are our customer and we act as processor for your API content, we assist you as controller in meeting these requests under the DPA.
10. Automated decision-making
The Service generates model output at your request; we do not use it to make automated decisions producing legal or similarly significant effects about individuals under Art. 22. If you build such decision-making on top of the Service, you are the controller and deployer responsible for it (see our Terms, AI Act allocation).
11. Security
We protect your data with TLS in transit, single sign-on (OIDC) authentication, least-privilege access control, encryption of backups, and an incident response plan with 72-hour breach notification.
12. Children
The Service is not directed at children under 16. The Heabsy Platform is a business-to-business service intended for users aged 18 or over. If you believe a child has provided us data, contact us to delete it.
13. Changes to this policy
We update this page when we make material changes and revise the effective date accordingly. Registered users may be notified by email.
14. Contact
FEYA, s.r.o., Pekná cesta 19, 831 52 Bratislava-Rača, Slovak Republic. IČO: 47 887 541. Data protection: privacy@heabsy.com.