Privacy at Heilda

This notice covers what happens when someone signs up, signs in, joins a workspace, uploads supplier material, reviews suggested matches, or otherwise uses Heilda.

Heilda operates the account, authentication, security, and service-layer processing described below. Each workspace or business using Heilda remains responsible for deciding what files and business records it uploads and for making sure it has the right to use that data.

Heilda operates heilda.is, authentication, workspaces, and the service processing described on this page.

For account, privacy, security, or support requests, use the support route your workspace received when Heilda was set up. If you do not have that route, start with your workspace administrator or the person who invited you to Heilda.

The exact data depends on how the service is used. In practice, Heilda handles account information, workspace records, supplier-import materials, encrypted supplier sign-in session state when prices are connected, review activity, and the operational data needed to keep the product reliable and secure.

• Account and identity data such as email address, WorkOS or Google user identifier, sign-in state, and active workspace selection.
• If you grant Gmail sending access, Heilda handles the granted send permission, an encrypted Google refresh token, and a short-lived access token. Heilda does not read your Gmail inbox, drafts, contacts, or message history.
• Workspace and collaboration data such as workspace name, memberships, invitation emails, and assigned roles.
• Supplier, import, and review data such as source file names, checksums, content types, supplier names, imported rows, review outcomes, and audit events. When an administrator connects supplier prices, Heilda may also retain encrypted browser state, including cookies that can act as a sign-in credential. Supplier passwords are not stored.
• Operational and security data such as health checks, error summaries, limited runtime telemetry, and alerts about failed or incomplete workflows.

Heilda processes data to provide the service requested by you or your workspace, including authentication, workspace access, account-price retrieval from connected suppliers, supplier imports, review queues, and shared product-data workflows.

Heilda also processes limited data to secure the service, diagnose failures, prevent abuse, and meet legal obligations where they apply.

• To sign users in and out and keep workspace access working.
• To send a test message or a supplier order email from Gmail when the signed-in user explicitly initiates that send.
• To receive supplier files, store import artifacts, run imports, and display review and decision flows. When a workspace owner or admin connects prices, Heilda opens the supplier in an isolated browser to retrieve prices only; that connection does not place orders or change supplier account settings.
• To respond to security issues, service incidents, and product failures that affect users.
• To verify that critical operational flows completed and that retries, alerts, and support actions work.

When you first sign up with Google, you can choose to grant Heilda the narrow Gmail permission to send email on your behalf. Heilda uses that permission only for test messages and supplier order emails that you explicitly initiate in a visible Heilda flow. Heilda does not request permission to read your inbox, drafts, contacts, or message history.

The Google refresh token is encrypted in the database. Before workspace creation it is retained as a pending grant for no more than 24 hours, and expired pending grants are removed by a recurring cleanup. After connection, the token is retained for that user and workspace until the connection or related account is deleted. A short-lived Google access token is used only while a send is being performed and is not stored as a durable credential.

• Gmail data and permissions are not used for advertising, marketing profiles, or training general-purpose AI models.
• Disconnecting Gmail deletes the stored refresh token. When no other active Heilda connection relies on the same Google authorization, Heilda also asks Google to revoke it. You can always revoke access from your Google Account security settings.
• The recipient of an order email receives the sender address, message content, and the order details you approve before sending.
• Heilda does not sell Google user data and transfers it only to Google to provide Gmail sending, to recipients you choose, and to necessary service providers described in this notice.
• Heilda's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

On heilda.is, Google user data is protected in transit with HTTPS/TLS. Stored Google refresh tokens are encrypted at the application layer with AES-256-GCM before they are written to the database. Each encryption uses a fresh random initialization vector (IV) and an authentication tag so unauthorized changes are detected.

The token-encryption key is kept separately from database records in a managed secrets system. The database infrastructure also encrypts stored data at rest.

• Database row-level security and user/workspace checks restrict each Gmail connection to the signed-in user and active workspace.
• Heilda accepts only the `gmail.send` permission for this feature. Grants containing mailbox-reading scopes are rejected and are neither stored nor used. Heilda asks Google to revoke them when doing so will not interrupt another active Heilda connection; you can always revoke access in your Google Account settings.
• Short-lived Google access tokens are not stored as durable credentials. OAuth tokens are excluded from public browser responses and application logs; failure logs contain only bounded diagnostic metadata.
• Disconnecting removes the encrypted refresh token from Heilda and asks Google to revoke the authorization when no other active Heilda connection relies on it. If Google cannot confirm revocation immediately, Heilda blocks stale callbacks and requires a clean reconnect before storing a new authorization.

Heilda uses essential cookies and limited browser storage to keep sign-in and the Heilda-owned auth flow working. As of May 17, 2026, the public app does not include analytics or advertising cookies.

• `heilda_session` and `heilda_workos_session` keep the active sign-in session.
• `heilda_auth_flow` is a short-lived cookie used during WorkOS/Google sign-in and redirect handling.
• `heilda_active_org` remembers the active workspace.
• Short-lived browser `sessionStorage` keeps email, pending authentication token, and cooldown state while the Heilda-owned password and email-verification flow is in progress.

Heilda uses third-party providers to run authentication, database storage, file storage, background jobs, and domain infrastructure. For supplier price connections, Heilda uses Browserbase for isolated browser execution and Google Cloud KMS to protect the encryption keys for supplier sessions. Those providers process data only to the extent needed to operate the service for Heilda.

Access is limited through workspace separation, access controls, and the security measures available in the infrastructure Heilda depends on.

• WorkOS for password sign-in, SSO, and invitation flows.
• Google for Google sign-in and user-initiated Gmail API sending.
• Postmark for authentication and transactional email, including recipient addresses, message metadata, and message content, and for sender-domain verification.
• Neon for the primary database and workspace records.
• Cloudflare R2 for uploaded files, stored import artifacts, and database backups.
• Railway for web and API runtime hosting.
• Trigger.dev for background jobs and uptime/import monitoring.
• OpenStatus for the public status page and occasional browser-side status checks when Heilda has no fresh reading.
• OpenAI for the assistant's answers: chat messages and the workspace data the assistant reads to answer, such as orders and products. Heilda asks OpenAI not to store the conversations, and a workspace owner or admin can turn the workspace's AI off in its settings.
• Cohere for product search by meaning and for ordering search results in the assistant and the catalogue: the search words from the chat and the catalogue search box, and the names, packs and categories of products in the public catalogue. Catalogues that customers upload themselves are not sent to Cohere.
• Cloudflare for DNS and domain edge services.

Heilda aims not to keep data longer than needed. Auth-flow storage is short-lived, while workspace, import, and review records are generally kept while a workspace remains active or while operational, security, or legal needs still require them. An encrypted supplier sign-in session is retained for at most 7 days idle and 30 days total, unless it expires sooner at the supplier. A workspace owner or admin can remove the saved session at any time; prices already fetched remain available.

If you use Heilda through a business workspace, you should usually start with that workspace administrator. You can also request access, correction, export, or deletion through the support route your workspace uses. If you believe personal data has been handled unlawfully in Iceland, you may lodge a complaint with Persónuvernd.

• Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or export personal data.
• Heilda may ask for additional information to verify identity before fulfilling a request.
• You can delete your account in your account settings. It is deleted 30 days later, together with the workspaces only you were in and everything in them; until then you can sign in and keep it. Orders and records that belong to a shared business workspace stay there but are no longer linked to your name or email address. Database backups are kept for 30 days and then deleted automatically. If data is ever restored from a backup, we delete again whatever had been deleted after that backup was taken.