Privacy Policy

Overview

This policy explains what personal data we handle on heysec.com and in our products, Prompt Firewall, heySec Shield, heySec Home and Bye Spy: why, for how long, who else is involved, and the rights you have under the GDPR.

heySec is run by Kempu OÜ (registry code 14643339), a company registered in Estonia, which is responsible for the data described here unless a section says otherwise. Our supervisory authority is the Estonian Data Protection Inspectorate. If a signed agreement or Data Processing Agreement (DPA) between us and your organisation says something different, that agreement takes precedence.

Our website

Visiting heysec.com

Cloudflare delivers our website and protects it from attacks, and NetiServer hosts it. Both receive what every visit sends, such as your IP address, your browser and the page you ask for, and keep it in their logs.

We count visits with our own analytics service, which sends its counts to cloud.slop.ee, a Kempu OÜ address. It sets no cookies and stores no IP addresses, and we see only totals: page views, referring sites, how long visits last and how many forms were sent, never what was typed into them. It also counts visits to Bye Spy and to the portal, except pages whose address names a household or organisation or carries a code, and leaves out every visit from a browser that sends Global Privacy Control or Do Not Track. Fonts and images come from our own server, and links to social networks load nothing until you click them.

Contact form

A message sent from our contact page is emailed to our team with your name and email address, your company if you give it, and your message. It stays in our mailbox for as long as we need it to deal with your request.

Waitlist

When you join a waitlist we store your name, email address, company if you give it, which products you chose, that you accepted this policy, whether you want our news, the time, and your IP address and browser details so we can spot fake sign-ups. With each sign-up we also store how your visit began: the campaign tags of the link you followed (utm_source, utm_medium, utm_campaign and utm_content), the name of the website that sent you, and the first page you opened. Until you sign up, your browser keeps these in the tab, not in a cookie, and forgets them when you close it. They tell us which posts and links bring sign-ups. Entries go to a separate database the website can add to but not read. We use them to invite you when places open, and to send you news only if you asked for it.

Spam protection

Our forms use no third-party CAPTCHA. Your browser solves a small puzzle before a form is sent, and the contact and waitlist forms are also checked by our own heySec Shield (see below). Our server counts recent requests from each network address, under a keyed hash rather than the address itself, until 10 minutes after the last one, and remembers each solved puzzle for an hour so it cannot be used twice.

Your account

Prompt Firewall and heySec Home share one account and one portal, my.heysec.com, and accounts are by invitation. We store your name, email address and timezone, your password only as a hash that cannot be reversed, the households or organisations you belong to with your role in each, and a billing email if you give one. For Prompt Firewall we also keep your plan, your usage and your API keys, only as one-way hashes.

You sign in with your password and a second step, a passkey or an authenticator app; authenticator secrets and recovery codes are stored encrypted. While you are signed in we keep your session with its IP address and browser details, and a list of the apps and devices signed in to your account. We remember the browsers you have used, so we can warn you about a sign-in from a new one, and a security log records sign-ins, failed attempts and changes, with the email addresses involved and the IP address they came from. Invitations record who sent them and, when sent by email, the invited person’s address, and expire within seven days. Sign-up, sign-in and password reset are checked by heySec Shield (see below).

Prompt Firewall

Prompt Firewall checks the content your AI is about to read for hidden attacks. This section covers our cloud service. When you run Prompt Firewall on your own servers or on disconnected devices, it sends nothing to us and every log stays on your systems; if we run it for you, our agreement with you sets out how data is handled.

Content you send

For each request we receive the text or files you send (text is also read from images, on our own servers), the files’ names and types, the request’s headers without cookies, the network address and user agent of the server that called us, a request ID, a timestamp and the result of the check. For personal data inside that content, your organisation is the controller and we process it on its behalf.

How we protect it

Before a request is saved, an automated step finds personal data and replaces each item with a neutral placeholder that cannot be traced back to it: names, postal and email addresses, phone numbers, ID, bank and payment numbers, network addresses and links, passwords and keys, and sensitive data such as health, beliefs or biometric information. It is tuned to remove too much rather than too little, but no automatic detector catches everything. Until then, the original content is held in an encrypted processing buffer and in the memory of the server that checked it; only the redacted version is stored.

That redacted log, with the request details above, is your request history and usage in the portal, a record for you and your auditors of what was checked and what we found, and material for improving our threat detection. We never use it to train general-purpose AI models.

Results you report

If you report a result as wrong, we store your report encrypted and pass it, with the redacted log of the request, to our detection team. The text you write in a report is not redacted, so please leave personal data out of it.

heySec Shield

heySec Shield tells people from bots on forms, sign-ins, comments and pages, without asking anyone to solve a puzzle. You may meet it as a visitor of a website or app that uses Shield, ours included, or as a customer who protects a site with it. For a site’s visitors, the site’s owner decides to use Shield and is responsible for their data, and we check visits on its behalf. We are responsible ourselves for keeping Shield secure and its detection accurate, as described below.

When you visit a protected page

Your browser loads Shield’s script and check from shield.heysec.com, or from shield.ee where the site uses that address. They receive what every visit sends, such as your IP address and browser details, and set no cookies. A short check then runs in your browser and sends us technical facts about the browser and device, not about you, such as its name, version, language and screen, whether it behaves like an ordinary browser, and numbers about how the page was used, such as timings and counts of pointer, touch, key and scroll events. Our server also notes how your connection was set up. We never receive what you type, which keys you press, where your pointer goes or the names of form fields.

From this we judge how likely it is that the visit is automated. The result goes into a sealed one-time token that only we can read. The form carries it to the site’s server, which sends it to us with your IP address to find out the outcome. The token expires within minutes and holds our verdict and your IP address, country and network. If the site switched on content checks, its server also sends the submitted text so we can check it for spam; we do that in memory, discard it at once and never keep it.

What we keep

For each check we keep a record for up to 400 days: the time, the site, the verdict, the risk score and its reasons, your country and network, and your browser and operating system. Your IP address is kept for at most a day and then erased. For at most 30 days, the record also holds a fingerprint of how your browser set up its connection and two codes, one made from your IP address and one from a few traits of your device, and then these are erased too. The codes are made with a secret key that we hold. Because we could recompute a code from a known address or device, they are pseudonymous, not anonymous, and we treat them as personal data. A second record, kept as long, notes when a site’s server used a token: the time, the site, a code for the token and the outcome. Short-lived counters in memory, under similar codes, help us spot one device or network hitting many sites.

How Shield stays accurate

Telling people from bots depends on knowing what people and bots look like today, and bots change all the time. So Shield keeps its detection current from the signals of the visits it checks and from what some of those visits later turned out to be. This is how the service works, and we use these signals to run and improve Shield’s detection across the sites it protects.

What a visit turned out to be reaches us from the sites themselves: a moderator marks a comment as spam that Shield let through, or a bot falls into a hidden page that no person can see or reach. On our own sites we also hear it from people: a visitor confirms their email address, signs in with a second step or has a comment approved, or we have invited them to try Shield. Each note carries the visit’s token, what the visit was and, at most, a code for the person; never what anyone typed. The signals of the visit are statistics about how your browser, device and connection behaved, including the timing and movement of pointer, keyboard, touch and scroll input, without your address, user agent text or anything typed. They are kept with that note for at most 90 days. After that, some of them are kept for as long as they are needed to keep detection effective, reviewed at least every 24 months, without any identifier that links them to you.

If you run Shield on your site

We keep your site’s settings and hostnames, your plan and how many checks it uses each month, and show your traffic and the reports you sent in the portal. Our WordPress plugin sends Shield only the token, the visitor’s IP address, the action and, with whole-page protection, the browser’s user agent; the submitted text only if you switched on content checks; and the reports above. It sets no cookies and keeps a comment’s token only for a few days. Because the visitors are yours, name Shield in your own privacy notice, and say that decisions you report, such as marking a comment as spam, help Shield’s detection. If we run Shield for you under an agreement, that agreement sets out how data is handled.

heySec Home

heySec Home, in private testing, turns phones, tablets and computers into sensors for your home. They recognise movement, people and sounds on the device itself and stream nothing to us. This is what reaches our servers:

• Your homes: name, timezone, address and map position, the areas and Wi-Fi networks that count as being at home, and floor plans. A room scan sends only the room’s name and its outlines, doors, windows and furniture positions as measurements, never a camera image or 3D model.
• Devices: name, model, operating system and app version, battery, when each last checked in and what it can sense. HomeKit and Home Assistant bridges also send their accessories’ names, rooms and readings.
• Events and alarms: what was noticed, such as a person or glass breaking, on which device and when, the alarms raised and who dealt with them.
• Photos: a still photo when there is movement or a person while the house is armed, or when an owner or admin asks for one.
• Video and sound around an alarm: while the house is armed, an alarm makes every watching camera send the 20 seconds of video around it, without sound, and a sound that sets off an alert makes every listening microphone send the 20 seconds of sound. Until then the last minute is held only in the device’s memory; no clip is made while the house is disarmed, and one cancelled during the entry delay is deleted on the device.
• Home or away: if you turn it on, your phone works out by itself whether you are home, from the home’s area, its Wi-Fi or a Bluetooth device you pick, and sends only “in” or “out”, what told it so, and the time. For this we store that phone’s name and the name and address of that Bluetooth device.
• Alerts: your phone’s push token, so Apple or Google can deliver them.
• Keys: the public keys of your phones, sensors and linked browsers, the home’s signed list of who and what may see its media, and keys we hold only in a form we cannot open.

Everyone invited to a home, viewers included, sees its alarms, photos, clips and floor plan, and who is home or away. Our support tools show accounts and devices, not photos or clips. If your sensors can see or hear other people, such as guests, a babysitter or the street, tell them, and follow the local rules for home cameras.

End-to-end encryption

Photos, video and sound are end-to-end encrypted: only you and your household can see or hear them — not even us. The sensor that records them encrypts them, and only your household’s heySec Home apps, and the browsers they link, can open them; our servers store and pass on the encrypted files only. Everything else listed above, such as alarms, what was noticed, who is home and the floor plan, stays readable by our servers, which need it to run the alarm.

A home created in heySec Home is protected from the start. An existing home, or one set up only on the website, is protected once an owner or admin turns it on in heySec Home; media recorded before then is not end-to-end encrypted, and is deleted within 30 days like all media.

Your keys are kept by your devices. iCloud Keychain can carry them to your other Apple devices, end-to-end encrypted, and on Android they go only into an end-to-end encrypted backup or straight to your new phone. If you save a recovery key, we keep a copy of your keys locked with it, which we cannot open. A browser you link opens media with code from our viewer site, view.heysec.com, so whoever controls that site’s code could read the media of homes where someone has linked a browser.

Bye Spy

Bye Spy, our free browser privacy test at byespy.heysec.com, runs in your browser and needs no account. To show what trackers can do, it plays one: a second site of ours, byespy.heysec.eu, acts as the tracker. Both receive what every visit sends, such as your IP address and browser details, and our server looks your address up in DNS to show you the name it resolves to.

During a test the two sites compare notes on our server under a random run ID, in a file that is deleted when the test ends, or after 15 minutes at most. The cookies and stored values the test tracker plants are random and made for that one test; the cookies last ten minutes, and all of them are cleared when the test ends. Your report, with your IP address and browser details, is made in your browser, and so are its PDF and Markdown copies; we keep none of them.

If you tick the box to test real ad and analytics servers, your browser contacts about 30 of them, and Cloudflare’s public STUN server, directly, without cookies or the address of the page. Those your browser does not block see your IP address, as they would on any website.

When a test finishes, we keep its result as an anonymous statistic: what each check found and the score, the names of your browser and operating system, your browser’s major version, and the month. Nothing else: no IP address, browser identification string, run ID or fingerprint, none of the values the checks saw, and no day or time. Results are filed under a random key, not in the order they arrive, so none can be traced back to a visit or a person. We use them for statistics about how well browsers protect privacy, and publish only totals for groups large enough that no one in them can be singled out.

Why we use it

• To provide what you signed up for: your account, Prompt Firewall checks, heySec Home’s monitoring and alerts, and support. Legal basis: our contract with you (GDPR Art. 6(1)(b)).
• To answer your messages and run the waitlists, because you asked us to (Art. 6(1)(b)).
• To keep our services and website secure and working: logs, spam and abuse protection, sign-in warnings and troubleshooting. Legal basis: our legitimate interest in security (Art. 6(1)(f)).
• To tell people from bots with heySec Shield, and to keep that detection accurate from the signals of the visits it checks and what they turned out to be. Legal basis: our legitimate interest, and our customers’, in keeping bots, spam and fraud out of forms and sign-ins (Art. 6(1)(f)); you can object.
• To run the Bye Spy test you start, and to turn its result into anonymous statistics about browser privacy. Legal basis: our legitimate interests (Art. 6(1)(f)); once stored, the statistics no longer identify anyone.
• To understand how our websites are used, from cookieless totals, and which links and posts bring waitlist sign-ups; and to improve our threat detection from redacted Prompt Firewall logs and the results you report. Legal basis: our legitimate interests (Art. 6(1)(f)); you can object.
• To send you news only if you asked for it (consent, Art. 6(1)(a)), which you can withdraw at any time.
• To keep accounting records when we bill you (legal obligation, Art. 6(1)(c)).

We do not sell personal data, use it for advertising or use it to train general-purpose AI models.

Storage & retention

Prompt Firewall, heySec Shield, heySec Home, our viewer site and Bye Spy run on our servers in the EU, and the website in Estonia. Data leaves the EU only through the providers in the USA listed under Sharing.

• heySec Home events, photos, video and sound are deleted after 30 days, or at once when you delete the home, together with its alarm history. Notifications and the security log are kept while your account exists, and past invitations while the household does.
• Content sent to Prompt Firewall is deleted from the processing buffer within 14 days and from the checking server’s memory when it restarts, and cached results within 72 hours. The redacted log has no time limit; we delete entries on request. Reports about results are kept for a year after our detection team receives them.
• Account records are kept while you have an account, and accounting records as long as the law requires.
• Bye Spy deletes a test’s run file when the test ends, or within 15 minutes. Its anonymous statistics have no time limit, as they identify no one.
• heySec Shield keeps your IP address for at most a day, the connection fingerprint and address and device codes of a check for at most 30 days, the rest of the record of each check and of each token’s use for at most 400 days, and the signals of a check with what it turned out to be for at most 90 days; after that some signals are kept, without any identifier that links them to you, for as long as they are needed to keep detection effective, reviewed at least every 24 months. Tokens and counters in memory are short-lived.
• Server logs are kept for a limited time for security and troubleshooting, the portal’s for 14 days.
• Waitlist entries are kept until we invite you or you ask us to remove them, and contact messages as long as we need them for your request.

When you close your account or ask us to erase your data, we delete it or anonymise it permanently, except what the law requires us to keep. Our encrypted backups roll over within two years, so deleted data can remain in them until then.

Sharing & sub-processors

We work with as few providers as possible:

• Hetzner (Germany) runs the servers, storage and backups of Prompt Firewall, heySec Shield, heySec Home, our viewer site and Bye Spy in its data centres in the EU.
• NetiServer (Estonia) hosts our website, our email, the waitlist database and our visit counts.
• Cloudflare (USA) delivers and protects heysec.com.
• Apple (USA) delivers heySec Home’s alerts to iPhones and iPads, and its maps in the portal and apps see the area you look at and, except on Android, the addresses you search for.
• Google (USA) delivers heySec Home’s alerts to Android, for which the app gives it an installation ID, and on Android looks up the addresses you search for and helps your phone find its location. Alerts carry the home’s name and what happened on which device, or the name of the person or phone involved.

Cloudflare, Apple and Google may process data outside the EU. Those transfers are covered by the EU’s Standard Contractual Clauses, and for Cloudflare and Google also by the EU–US Data Privacy Framework.

Photos, video and sound from heySec Home, and content sent to Prompt Firewall, never go to any analytics or advertising company. We disclose data only when the law or a valid legal order requires it, and tell the affected customer whenever we are allowed to. We will update this list when our providers change.

Your rights

Under the GDPR you can ask to access, correct, erase, restrict or port your personal data, and object to how we process it. Where we rely on your consent, you can withdraw it at any time. Write to [email protected]; we reply within one month.

Closing an account and downloading your data are not in the portal or apps yet, so write to us and we will do it. Deleting a home deletes its events, photos and clips at once, and you can leave a household you were invited to at any time. Photos, video and sound from a protected home reach us only encrypted, so we can export them only in that form.

For personal data inside content sent to Prompt Firewall, your organisation is the controller, so those requests go through your organisation and we help it answer them. Because we remove personal data before storing that content, we can only export the redacted version.

For visits to a site that uses heySec Shield, you can also ask the site’s owner. Shield keeps visits under codes made from the IP address, so to find yours we need the IP address you used. Signals kept without any identifier that links them to you may, after a time, no longer be found by person, so we may be unable to find them to answer a request about them.

You can also complain to the Estonian Data Protection Inspectorate ([email protected]) or the supervisory authority where you live.

Cookies

heysec.com sets no cookies for visitors; it keeps the campaign tags of the link you followed in the tab’s storage until you sign up or close it. The portal at my.heysec.com sets only the cookies it needs: one that keeps you signed in, one that protects its forms against cross-site request forgery, one that recognises your browser so we can warn you about sign-ins from new ones, kept for up to five years, and, only if you tick “remember me”, one that keeps you signed in for longer. Our viewer site, view.heysec.com, sets no cookies: a linked browser keeps its keys in its own storage until you unlink it, and your sign-in only until you close the tab. During a Bye Spy test, its test tracker sets cookies the way a tracker would, to see whether your browser lets it read them back: they hold random values made for that test, last ten minutes and are cleared when the test ends. heySec Shield’s servers set and read no cookies. We use no advertising or tracking cookies, and our apps contain no analytics or advertising trackers.

Children

Our services are not meant for children, and we do not knowingly create accounts for anyone under 16. heySec Home’s cameras and microphones can capture anyone in a home, children included; the household decides where its sensors go and who can see what they send.

Contact & DPO

For questions about this policy or your data, contact our Data Protection Officer:

When we change this policy we update the date at the top, and we tell customers before a significant change applies to them.