App privacy

Last updated: 14 October 2026

This is a translation. The French version prevails.

This policy explains how the Heverly apps (Heverly CRM, and soon Heverly Marketing) process personal data. It supplements the website privacy policy.

Who is responsible?

Mathyssa Dorsainvil Potier, sole trader operating as Heverly Studio, 60 rue François 1er, 75008 Paris, France (RCS Paris 884 699 596). Contact: contact@heverlystudio.com.

We comply with the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP).

Two different roles

• For our customers' accounts (the businesses and their staff who use the app), we are the data controller.
• For the data our customers store in the app (their own clients, leads, appointments, invoices…), each business remains responsible for its data. We act as a data processor: we process it only to provide the service, on the business's instructions, and never for our own purposes.

What data, and why?

• User account: first and last name, email address, password (encrypted, never readable by us), team role, language, sign-in log. To let you sign in and to secure your account.
• Business information: name, address, contact details, legal numbers, billing details. To issue the business's invoices and quotes, and for our own billing.
• Data entered by the business: client and lead records, appointments, memberships, payments, documents, messages. To run the service the business uses.
• Technical data: IP address, device type, error and security logs. For security and proper operation.

We use no advertising cookies or ad tracking in the apps. Only cookies needed for signing in are used.

Connecting Facebook and Instagram (Meta)

If a business chooses to connect its Facebook Page to Heverly CRM to receive its leads:

• Data received from Meta: the list of Pages the business manages, the lead forms of those Pages, and the answers of people who fill in those forms (for example name, email, phone number and answers to questions), with the campaign and date.
• Use: only to create these leads in the workspace of the business concerned, so it can contact them. Nothing else.
• What we never do: sell this data, use it for advertising, share it with other businesses, or combine it with other sources.
• Access: the access token provided by Meta is stored encrypted and never displayed.
• Disconnecting: the business can disconnect its Page at any time in Settings › Lead sources, or remove access in its Facebook settings.

Where is data hosted, and who can access it?

We use technical service providers bound by confidentiality and security commitments:

• Supabase: database, hosted in the European Union (Frankfurt, Germany).
• Vercel: app hosting.
• Brevo (France): sending emails.
• Anthropic (Claude): automatic reading of documents you import (contracts, invoices, Excel files), only to suggest their content to you. They are not used to train the AI.
• Meta: only if the business connects its Facebook Page (see above).
• SMS provider: only if SMS sending is enabled.

Some providers may process data outside the European Union or Switzerland. In that case, the transfer is covered by the safeguards required by law (European Commission standard contractual clauses or an adequacy decision).

We never sell personal data.

How long?

• A business's data is kept for as long as its subscription is active.
• After the subscription ends, the business has 30 days to export its data. It is then deleted, except what the law requires us to keep (for example our invoices, 10 years).
• Technical logs are kept for at most 12 months.

Security

Encrypted connection (HTTPS), encrypted passwords, strict separation of each business's data, role-based access for each team member, and external service tokens stored encrypted.

Your rights

You can request access to your data, its correction, deletion or portability, or object to its processing.

• You use the app (business or team member): write to contact@heverlystudio.com.
• You are a client or lead of a business: contact that business first, as it manages your data. We will help it respond.

We reply within one month. You can also lodge a complaint with the CNIL (France) or the Federal Data Protection and Information Commissioner (Switzerland).

Data deletion

To request deletion of your data, including data received from Facebook:

1. Email contact@heverlystudio.com with the subject "Delete my data", stating the email address or phone number concerned.
2. If you connected Facebook, you can also remove the Heverly app in your Facebook settings (Settings › Apps and Websites). We then receive the request automatically, and a confirmation code lets you check its status.

Deletion is completed within 30 days.

Changes

We may update this policy. The date at the top shows the latest version. For significant changes, we notify users by email or in the app.