Heft Privacy Policy

1. Controller and contact

Heft is a NameQuick product. The controller under the General Data Protection Regulation (GDPR) is:

Josef Moucachen
Overhoeksplein 3, 1031 KS Amsterdam, Netherlands
KvK (Dutch Chamber of Commerce): 94099660
Email: support@namequick.app

Write to the same address with any privacy question or to use your rights. We have not appointed a data protection officer, because the GDPR does not require one for us. More details are in the legal notice.

2. Two roles: your account and your company's data

Heft processes data in two roles, and the role decides who is responsible for what.

• As controller we process the data we need to give you an account and run Heft safely: your sign-in, your devices, security logs, messages to you and the proof that you accepted the terms. This policy covers that in full (section 3).
• As processor we process your company’s data: bank transactions, receipts, invoices, bookings and what you tell Heft about them in the chat. Your company is the controller of that data. We process it only on its instructions and under the data processing agreement (AVV, Art. 28 GDPR) the company accepts at signup. Section 4 describes what happens.

Receipts and bank statements also name other people, such as suppliers, customers or your company’s staff. If that is you and you want to know what happens to your data, please contact the company whose records Heft keeps. We help it answer you.

3. What we process as controller

Sign-in and account

We store your email address, your name, your language and when you last signed in. To sign you in we email you a code. We store the code, your address and your network (your IP address, cut down to the network) only as checksums, never in plain text, and delete them after two days. A code is valid for ten minutes.

For passkeys we store only the public part of the key, its ID and when it was last used. The private part stays on your device. For each session we store when it started and was last active, and which browser and operating system it was (such as “Safari on Mac”), so you can see your devices in Settings and sign them out. We don’t store the full browser string or the IP address for this. A browser session ends after 7 days at most, an app session after 90 days.

The legal basis is performing our contract with you (Art. 6(1)(b) GDPR). The data is kept as long as your account exists.

Security and logs

Our servers write technical logs, for example of requests and errors. They can contain IP addresses and are deleted after 30 days. If the app crashes, it sends an error report to our own logs; email addresses, IBANs and access keys are removed first. When you sign in with an email code we send you a notice naming the device, and a new passkey is reported to you too; when a member or an access is added, we notify the directors. The legal basis is our legitimate interest in protecting Heft and your data from misuse (Art. 6(1)(f) GDPR).

Messages to you

We send you the emails that are part of the service: sign-in codes, sign-in notices, invites, Heft’s questions and notices about your connections. If you allow notifications, we also send them as push messages to your browser, and for that we keep the address your browser issues until you sign out. We don’t send advertising. The legal basis is Art. 6(1)(b) GDPR.

Accepting the terms

When you accept the terms and the AVV at signup, we record who did so, when, for which company, which versions, and with which passkey you confirmed. The same goes for everything you later confirm with your passkey in Heft. These entries are part of the company’s unchangeable records and are kept as long as those (section 9). The legal basis is Art. 6(1)(b) and (f) GDPR (proof of who agreed to what).

Support

If you write to us, we use your message and address to answer. Our support sees your company’s data only if a director grants it access in Heft, read-only and for 30 days at most.

4. What Heft does with your company's data

Here we act on your company’s behalf (section 2). Heft processes only what you connect or upload:

• Bank transactions from the accounts you pick when connecting, read-only, through Enable Banking: date, amount, counterparty with name and IBAN, payment reference and balances. When Heft reads the bank while you are in the app, Enable Banking passes your IP address and browser string to the bank, as the Payment Services Directive (PSD2) requires. The permission lasts 180 days at most, or as long as your bank allows.
• Receipts by email: mails you forward to your Heft address, with sender, subject and attachments.
• Gmail: if you connect your mailbox, Heft reads only mails that look like an invoice or receipt, and keeps only those that are one (section 6).
• Revolut Business: expenses and their receipts, read-only.
• Supplier portals: your logins, encrypted with their own key, and the invoices Heft fetches with them. Heft’s own browser on Google Cloud in Frankfurt does the fetching.
• What Heft makes of it: what it reads from receipts (amount, date, supplier), matches, bookings, your answers and your chat with Heft. Other members don’t see your chat.

Original files stay unchanged. Everything Heft changes in the records is kept as a new entry, with who, when and why, as German bookkeeping rules (GoBD) require. The data is stored encrypted on Google Cloud in Frankfurt.

5. Artificial intelligence

Heft uses AI models to read receipts, match payments, word its questions and answer in the chat. For each step the model gets only what that step needs, such as a receipt and the matching payment, or your chat question. IBANs are shortened. The models run on Google Cloud in the EU (Vertex AI) and on Amazon Web Services in Frankfurt (Amazon Bedrock). Neither we nor Google nor Amazon use your data to train AI.

Heft makes no decisions that have legal effects on you or affect you similarly significantly (Art. 22 GDPR). You can undo what Heft books until the month is locked.

6. Data from your Google account

If you connect Gmail, Heft asks Google for read access (gmail.readonly) and your email address. Heft has Gmail search for possible invoices, checks each match by subject, sender and file names, and downloads only mails that look like an invoice or receipt from those. It keeps only the ones that are. Heft never sends, deletes or moves a mail. You can disconnect at any time in Heft or in your Google account.

Heft’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use this data only to bring your receipts into Heft, don’t share it with anyone except the service providers in section 7, and don’t use it for advertising or to train AI models. People at Heft read it only with your consent, where security requires it, or where the law requires it.

7. Who receives data

These service providers process data for Heft, each under a contract according to Art. 28 GDPR. The list also has its own page: Sub-processors. If one is added, we tell the companies beforehand.

Besides them, data goes to:

• Services you connect yourself: your bank, Google (Gmail), Revolut and supplier portals. Heft asks them on your behalf; their own privacy policies apply.
• Your browser’s push service (such as Apple, Google, Mozilla or Microsoft), if you allow notifications. The content of a notification is encrypted.
• OpenStreetMap: to find a merchant’s location, Heft sends its name, town and country to the OpenStreetMap Foundation’s Nominatim search (United Kingdom, covered by an EU adequacy decision).
• Supplier websites: to show a supplier’s logo, Heft fetches the website’s icon. Only the supplier’s domain is sent.
• Authorities, where the law requires us to.

We don’t sell data or pass it on for advertising.

8. Transfers outside the EU

Heft processes your data in the EU. Google, Amazon and Resend are US companies. Should data be accessed from outside the EU, the transfers are covered by the EU-US Data Privacy Framework (Art. 45 GDPR) and by EU standard contractual clauses (Art. 46(2)(c) GDPR); section 7 says which applies to which provider. You can ask us for a copy of the standard contractual clauses.

9. How long data is kept

• Sign-in codes: two days.
• Technical logs: 30 days.
• Exports you download: seven days, then the file is deleted.
• Account, devices and passkeys: as long as your account exists. You can remove passkeys and devices yourself at any time.
• Login details for your bank, Gmail, Revolut and portals: until you disconnect or cancel, then they are deleted at once.
• Receipts and books: as long as the law of your company’s country requires. In Germany that is 8 years for receipts and 10 years for books, in the Netherlands 7 years, each counted from the end of the year. Heft protects every original file from change and deletion for 9 years, including from us.

If your company cancels, its connections end and their login details are deleted. Receipts and books stay readable and exportable until the legal period ends, then they are deleted. What concerns you as a person and isn’t part of those records, we delete when you close your account.

10. Cookies and browser storage

Heft sets a single cookie that keeps you signed in (__Host-heft_session). The app also keeps settings such as language, theme and the company you last picked in your browser’s storage. Both are strictly necessary for the service (Section 25(2) No. 2 of the German TDDDG). Heft uses no analytics or advertising cookies, no trackers, and loads no fonts or scripts from other servers.

11. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• have wrong data corrected (Art. 16),
• have data erased where no retention duty prevents it (Art. 17),
• have processing restricted (Art. 18),
• receive your data in a common format (Art. 20); you can export your company’s data yourself in Heft at any time,
• object, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21).

Write to support@namequick.app. You can also complain to a data protection authority, such as the one where you live or the Dutch Autoriteit Persoonsgegevens, which is responsible for us (Art. 77 GDPR).

12. Do you have to provide data?

Without an email address you can’t open an account, and without your company’s details Heft can’t keep its records. Every connection (bank, Gmail, Revolut, portals) is optional.

13. Changes

When the way Heft processes data changes, we update this policy and the date at the top. If a service provider is added, companies hear about it beforehand.