Privacy policy

In brief

Wonder Technologies AS is the company behind Heyroes and is responsible for personal data about visitors, prospective customers, customers and users of the app.
When we work for a customer, for example with enquiries from the customer's website, the customer decides. We are then a processor under the data processing agreement.
We never sell personal data, and customer data is not used to train AI models.
Statistics and ad measurement on the website only happen if you say yes in the cookie banner. The exception is statistics for visitors in the United States, which run until they say no.
You can ask for access, correction, deletion and more by writing to hello@heyroes.com. We reply within one month.

Who is responsible

The controller is Wonder Technologies AS, org. no. 929 267 834, Oreliveien 8, 0580 Oslo, Norway. Heyroes is the name of our services.

Privacy questions: hello@heyroes.com
Security vulnerabilities and incidents: security@heyroes.com
Phone: +47 904 87 297

We are not required to have a data protection officer, but one person in our company is responsible for privacy and answers enquiries. We are established in Norway, which is part of the EEA, and therefore do not need a separate representative in the EU.

This notice covers heyroes.com and our other websites, the app where the heroes work, and the work we do for our customers. It is written in Norwegian and English.

When we are controller and when we are processor

2.1 Controller

We decide ourselves why and how the data is used when we run our websites, answer enquiries and chats, contact businesses, enter into and follow up agreements, invoice, give you an account in the app and keep it secure.

2.2 Processor for the customer

When we work for a customer, we process data on the customer's behalf. This includes enquiries from the customer's website and ads, sales data from the customer's CRM, comments on the customer's social media pages, contact lists the customer uploads for ads, and the content of websites we operate. The customer is then the controller, and we follow the customer's instructions and the data processing agreement.

If you have been in contact with one of our customers, that business is responsible for your data. Ask them first. If the question comes to us, we pass it on and help them respond.

What data we process

3.1 When you visit the website

The server records your IP address, browser, device, the time and which pages you request, in order to deliver the page and stop attacks. The forms are protected against spam by Cloudflare Turnstile, which looks at technical signals from the browser.

Statistics (Google Analytics and Microsoft Clarity) and ad measurement (Google Ads and Meta) only happen if you have said yes in the cookie banner. In the United States, Google Analytics runs until you say no, see section 12. Read more on the cookie page.

3.2 When you chat with us

The chat on the website is an AI assistant provided by Chatbase. It only loads when you open it. We store what you write, and your name, email and phone number if you provide them, so that we can reply to you. Do not write sensitive information in the chat.

3.3 When you use the free tools

If you check a website with the SEO check, the AEO test or the website check, we send the address and the content of the public page to Anthropic and Google PageSpeed Insights to produce the analysis. If you ask to have the report sent to you, we store your email address and the report as an enquiry.

3.4 When you contact us or book a call

Name, company, email, phone and what you write to us. If you have said yes to statistics, we also record which page, campaign or ad you came from. If you book a call, we store the time, the meeting link and the notes from the call.

3.5 When you are a customer

contact persons, organisation number, address and billing contact
quotes, agreements, orders, invoices and payment status. If you sign a quote digitally, we store the time and IP address as evidence of the signature
emails, meetings, notes and messages with our team
phone calls and text messages with the team, with number, time and duration. We do not record calls
whether newsletters from us are opened, and which links you click, see section 9

3.6 When you use the app

Your account: name, email, phone, job title, profile picture, language, time zone and when you last logged in. Passwords are not stored in readable form. If you are invited by your employer, we receive your name and email address from them.
Security logs: logins, logouts and changes, with IP address, approximate location (city and country) and whether you used a browser or a mobile device.
Conversations with the heroes: what you write, the files you upload and what the heroes remember about the business to do a better job.
Images and brand: product images, logos and other material you upload so that the heroes can create ads, images and video. If an image shows people, it is personal data.
Notifications: if you turn on browser notifications, we store the address the browser gives us for the notifications.

3.7 When we contact businesses

We find businesses in the Brønnøysund Register Centre (Brønnøysundregistrene), through Byndle, which provides company information, and in public directories. We may store company information, the name and role of the managing director or another contact person, the business's phone number and email address, and a summary of the business's website. If we have obtained data about you from someone other than you, we give you this information at the latest the first time we contact you, and within one month.

3.8 Sensitive data and children

We do not ask for special categories of personal data, such as health, religion, political opinions or trade union membership, or for national identity numbers. Do not send us such data in forms, emails, chat or conversations with the heroes. The services are designed for businesses and not for children, and we do not knowingly collect data about persons under 18.

3.9 When you connect a Google account

If you connect a Google account to Heyroes, we only get the access you approve on Google's own screen: Google Analytics (read-only traffic and conversions), Search Console (search performance and sitemap submission), Google Ads (campaign results, creating and editing campaigns in your own account, and sending your leads back as conversions), YouTube (channel name and publishing videos you have approved), Google Calendar (free time, and creating, moving and cancelling meetings in the calendar you connect) and the email address of the account.

We use this data only to provide and improve the features you see in the app. We do not sell it, use it for advertising other than your own, or use it to train generalized AI models. Numbers and text may be sent to Anthropic to produce analysis and suggestions for you. People at Heyroes see the data only because you have asked us to work for you, when you ask for help, when needed for security, or when required by law.

Google sign-in tokens are stored encrypted. You can disconnect in the app at any time or at myaccount.google.com/permissions. We then stop fetching new data. What we have already fetched is deleted when you ask, and at the latest by the deadlines in this policy.

Heyroes' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we use the data for and for how long

The table shows what we use the data for, which legal basis in the General Data Protection Regulation (GDPR) we rely on, and how long we store it.

Purpose	Legal basis	Retention period
Delivering and securing the website	Legitimate interest in a secure and functioning website, Article 6(1)(f)	Server logs for a short period, according to Hostinger's standard routines
Statistics and ad measurement on the website	Consent, Article 6(1)(a), and the Norwegian Electronic Communications Act (ekomloven) section 3-15. For visitors in the United States, see section 12	Until you withdraw consent, and at most as long as stated on the cookie page
Responding to enquiries, chats and bookings and following up sales	Contract when you ask for a quote, Article 6(1)(b), otherwise legitimate interest, Article 6(1)(f)	12 months after the last contact, unless you become a customer
Free tools	Legitimate interest in responding to what you ask for, Article 6(1)(f)	The analysis is not stored. If you ask for the report, the rules for enquiries apply
Entering into and following up agreements, delivering the services and providing support	Contract, Article 6(1)(b). For the customer's employees: legitimate interest, Article 6(1)(f)	For as long as the customer relationship lasts, and after that as described below
Invoicing and accounting	Legal obligation under the Norwegian Bookkeeping Act (bokføringsloven), Article 6(1)(c)	Five years for accounting records, three and a half years for agreements and correspondence, counted from the end of the financial year
Account in the app	Contract, Article 6(1)(b), and legitimate interest, Article 6(1)(f)	For as long as the customer relationship lasts. Deleted no later than 60 days after it ends
Security, troubleshooting and preventing misuse	Legitimate interest, Article 6(1)(f)	Security and audit logs for up to two years
Documenting consent to cookies	Legal obligation to be able to demonstrate consent, Article 7(1) and Article 6(1)(c)	Two years
Contacting businesses and marketing	Legitimate interest, Article 6(1)(f). Email to named individuals only with consent under the Norwegian Marketing Control Act (markedsføringsloven) section 15, or to customers about services similar to those they have bought	12 months after the last contact. If you say no thanks, we only store what is needed to leave you alone
Improving the services	Legitimate interest, Article 6(1)(f)	Only aggregated and anonymised figures

When the customer relationship ends, the customer has 30 days to export its data. No later than 30 days after that, we delete or anonymise the accounts and all data we have processed for the customer. What we must keep under the Bookkeeping Act, or to defend a legal claim, we keep for as long as necessary. Database backups are stored for seven days and are then deleted automatically.

Where we rely on legitimate interest, we have assessed that our interest outweighs the disadvantage to you, partly because the data relates to your job and not your private life. You can ask to see the assessment.

You do not have to give us any data. Without contact details we cannot reply to you, and without the data in an agreement we cannot deliver the services.

Artificial intelligence

The heroes in the app, the chat and the free tools use AI models from other companies:

Anthropic: the language models that write, analyse and suggest, and web search
OpenAI: images, and speech to text and text to speech
Higgsfield: images and video for ads
ElevenLabs: voice for video
Chatbase: the chat on the website

The models receive only what is needed for the task. When the heroes sort enquiries and comments, the text is sent without names, email addresses and phone numbers. Under the terms of the services we use, the data is not used to train the models. The providers may store the requests for a short period to detect misuse, normally up to 30 days.

No decisions that have legal effects for you, or that similarly significantly affect you, are made automatically. By default, the heroes suggest, and the customer approves before anything is published or changed.

If you talk to the chat or a hero, you are talking to AI and not a human. Images, video and speech created by the heroes are marked as AI-generated where the rules require it. The customer is responsible for labelling content the customer publishes, see clauses 21 and 22 of the terms of service.

Who we share data with

6.1 Service providers

Our service providers process data on our behalf and may only use it to provide their service to us. We have data processing agreements with them. The most important are:

websites and hosting: Hostinger
the app and the database: Vercel and Supabase
AI: Anthropic, OpenAI, Higgsfield, ElevenLabs and Chatbase
email: Twilio SendGrid, and Brevo for newsletters and email campaigns
security and operations: Cloudflare (Turnstile), Sentry (error monitoring), Upstash (rate limiting) and Google Cloud (website backups and encryption keys)
statistics and ads on the website, subject to consent: Google, Microsoft (Clarity) and Meta
work tools: Google Workspace, Slack and Telavox (phone and SMS)
accounting and invoicing: Unimicro and DNB Regnskap
company information: Byndle and the Brønnøysund Register Centre

The full list, showing what each provider does and where the data is processed, is in clause 16 of the data processing agreement.

6.2 Advertising platforms

When we measure our own ads, Google and Meta may receive hashed contact details and click IDs, but only when you have said yes to marketing. For our customers, this happens in the customer's own ad accounts and under the customer's agreements with the platforms.

For the collection through the Meta pixel, we and Meta Platforms Ireland are joint controllers, and Meta is itself responsible for how it uses the data afterwards. Microsoft is itself responsible for the data Clarity collects. Cloudflare also uses the signals from Turnstile to improve its bot detection, and is itself responsible for that use.

6.3 Others we may share data with

If an invoice is not paid, the data may be shared with Kravia for payment reminders and debt collection. We may share data with our auditor and lawyer when needed, and we disclose data when the law requires it.

6.4 If the business is sold

If the business is sold or merged, the data may be transferred to the new owner, who must comply with this notice.

We never sell personal data, and we do not give it to others for their own marketing.

Transfers to countries outside the EEA

The app's database is in Ireland, and the app runs on servers in Stockholm. Error monitoring is in Frankfurt, and website backups and encryption keys are in Finland. The websites we operate are hosted by Hostinger in the United Kingdom, which the EU has recognised as providing an adequate level of protection.

Some providers are US companies, process data in the United States or have access from there for support and operations, including the AI, email and statistics providers. The transfers are based on the European Commission's decision on the EU-US Data Privacy Framework for certified companies, and otherwise on the EU standard contractual clauses (SCCs) with supplementary measures where needed. The basis that applies to each provider is set out in clause 16 of the data processing agreement, and you can ask for a copy of the standard contractual clauses.

The validity of the Data Privacy Framework has been challenged before the Court of Justice of the European Union. If it falls away, we will switch to standard contractual clauses or to a provider in the EEA.

Cookies and tracking

The website only uses necessary cookies until you have chosen otherwise in the cookie banner. The exception is visitors in the United States, see section 12. You can say no as easily as yes, and change your choice whenever you like. If your browser sends the Global Privacy Control signal, we record it as a no to statistics and marketing. Which cookies we use and how long they are stored is set out on the cookie page.

The app only uses cookies needed for login, security and connecting services, and has no analytics tools.

Newsletters and marketing

We only send marketing emails to named individuals when they have consented, or when they are customers and the email concerns services similar to those they have bought. Every email states who it is from and has a simple way to unsubscribe. If you unsubscribe, we stop within ten business days at the latest.

We send newsletters and email campaigns with Brevo, provided by Brevo SAS in France. There we store your email address, your name, the company you work for and its website. Brevo is our processor and states that the data is stored in the EU. We use Brevo only for our own mailings, so Brevo is not a sub-processor under the data processing agreement.

When we send with Brevo, it records whether the email was delivered and opened, and which links you clicked. This is linked to you as the recipient. We use it to see what is useful and to follow up our customers, and the legal basis is legitimate interest. You can object by writing to us, and if you unsubscribe, you will not receive more of these emails. The links to the website are tagged with the mailing they come from. We see that tag in the website statistics only if you have said yes in the cookie banner.

How long we keep the data is stated in the table in section 4. If you unsubscribe, we keep only what is needed to stop sending to you.

Your rights

You have the right to

access the data we hold about you and get a copy of it
have inaccurate data corrected
have the data erased when the conditions are met
have the processing restricted
object to processing based on legitimate interest, and always object to marketing
receive data you have given us in a machine-readable format
withdraw consent, without affecting what was done before
complain to the Norwegian Data Protection Authority (Datatilsynet), Postboks 458 Sentrum, 0105 Oslo, Norway

Write to hello@heyroes.com. It is free of charge. We may ask you to confirm your identity before we reply, and we reply within one month. If the request is extensive or complex, we may take two more months, and if so we will tell you within the first month. If it concerns data we process for a customer, we forward the request to the customer and help them respond.

If you live in the United Kingdom or Switzerland

For people in the United Kingdom, the UK GDPR applies, and for people in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies. You have the same rights as above. You can complain to us first, and we will acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office in the United Kingdom or to the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland.

If you live in the United States

We are a Norwegian company that sells to businesses. This section gives you what US state privacy laws ask for, and you have these rights whether or not a particular law applies to us.

The data we collect is described in section 3: identity and contact details, information about your business and your job, commercial information, use of the website and approximate location based on your IP address. What we use it for is in section 4, and who receives it is in section 6. The only data some of these laws treat as sensitive is the login to your account, which we use only to give you access and keep the account secure.
If your device is set to a time zone in the United States, Google Analytics runs from your first page view. We use the time zone and not your IP address to decide this. Say no with Necessary only in the cookie banner, and statistics stop and the cookies are deleted. If your browser sends Global Privacy Control, statistics do not start. Microsoft Clarity, Google Ads and Meta still wait for your yes.
We do not sell personal data. We only share data with advertising platforms for cross-site advertising if you have said yes in the cookie banner, and we honour Global Privacy Control.
You can request access, correction and deletion, and opt out of such sharing, including through someone you have authorised. You will not be treated differently because you exercise your rights. If we say no to a request, you can appeal by replying to our answer, and you can contact your state's attorney general.
We do not respond to Do Not Track signals, because there is no common standard for them. Global Privacy Control works as described above.
Under California's Shine the Light law, California residents can ask once a year whether we have shared personal data with others for their own direct marketing. We do not do that.

If you live in another country

This notice applies to everyone, wherever you live. You have the rights in section 10 and can use them in the same way. If the law where you live gives you more rights, we follow it.

Security

We protect the data with encryption in transit and at rest, role-based access, separation between customers in the database, logging of logins and changes, and daily backups. Access credentials for services such as Google Ads and Meta are stored encrypted with AES-256-GCM. Read more on the security page (in Norwegian).

In the event of a personal data breach, we notify Datatilsynet within 72 hours when the law requires it, and the people affected when the risk to them is high. When we are a processor, we notify the customer without undue delay.

Changes to this notice

We update this notice when our services or the rules change, and the date at the top shows when it was last changed. We notify customers of material changes by email or in the app before they take effect. This version applies from 6 November 2026, and you can get earlier versions by asking us.

Contact

Wonder Technologies AS, Oreliveien 8, 0580 Oslo, Norway. Email hello@heyroes.com, phone +47 904 87 297.