Hheedsy

Privacy policy

Last updated: 18 August 2026

1. Scope

This policy explains how Heedsy processes personal data in connection with the service available at heedsy.com: professional pages for local businesses, modules (forms, gallery, documents), ratings, audience statistics and account management.

It applies to dashboard users (merchants) and to visitors of published business pages.

2. Data controller

For processing related to operating the Heedsy platform (accounts, subscriptions, technical hosting, security, aggregated statistics), the data controller is:

  • Romain Lourenco — sole trader (micro-entreprise), trade name Heedsy
  • SIRET: 830 844 262 00030
  • Address: Aramon 30390, France
  • Email: contact@heedsy.com

For data collected through forms, ratings or other interactions configured by a merchant on their page, the merchant is generally the data controller (they define the fields, purpose and use of responses). Heedsy then acts as a processor under the GDPR, by hosting those data and making them available in the merchant’s dashboard.

3. Data we collect

Depending on how you use the service, the following categories may be processed:

  • User account: email address, name, password (stored hashed), language preferences.
  • Business page: business information (name, description, address, hours, contacts, social links), uploaded images and documents, configured modules and content.
  • Public forms: data submitted by visitors on merchant pages (see section 4).
  • Ratings: score (1 to 5), optional comment, and an anonymous technical identifier linked to the device (first-party cookie) to limit one rating per device and allow later edits.
  • Payment and subscription: billing and subscription data processed via Stripe (Heedsy does not store card numbers).
  • Technical and analytics data: logs needed for security and reliability; first-party page-view statistics for public pages (visit date/time, approximate device type, aggregated traffic source); and, only if you consent, audience measurement data collected via Google Analytics (pages viewed, traffic source, device type, technical browsing identifier). These statistics are not intended to identify you by name.

4. Forms on merchant pages

Merchants may add forms to their Heedsy page. Fields are defined by each merchant. In general, these forms may collect data such as name, email address, phone number, choices from lists, checkboxes, and any information you choose to provide in free-text fields.

Generic purpose: to allow the merchant to receive and handle visitor requests (for example contact, information, booking, quote or any other request related to their activity), depending on how the relevant form is configured.

Data controller: the merchant whose page displays the form. Heedsy stores the responses to make them available in the merchant’s workspace and to operate the service technically.

The merchant is responsible for informing visitors about the specific use they make of responses (including any additional information shown on their page or in the form) and for complying with their own data-protection obligations.

Heedsy does not use form response content for its own marketing purposes, nor to contact visitors on its own behalf.

5. Purposes and legal bases

  • Account creation and management, publishing the business page — performance of a contract.
  • Providing modules (forms, documents, gallery) and making responses available to the merchant — performance of a contract (with the merchant); for the merchant, processing of responses is generally based on pre-contractual steps or their legitimate interest in answering visitor requests, depending on context.
  • Displaying and managing ratings on pages — legitimate interest (transparency and service improvement for merchants and visitors) and, where applicable, performance of a contract with the merchant.
  • Payment processing and subscription management — performance of a contract.
  • Transactional emails (account creation, password reset, sign-in) — performance of a contract and legitimate interest.
  • First-party audience statistics, security, abuse prevention and service improvement — legitimate interest.
  • Google Analytics (audience measurement of the Heedsy site) — consent (cookie banner; you may refuse or withdraw your choice at any time).
  • Accounting and tax obligations related to payments — legal obligation.

6. Recipients and processors

Data is never sold. It may be shared with the following recipients only as needed:

  • IONOS — hosting of the site, domain name and technical infrastructure (server, database).
  • Stripe — payment processing and subscription management (Stripe privacy policy).
  • Google LLC — audience measurement via Google Analytics, only if you have accepted statistics cookies (Google privacy policy).
  • Heedsy merchants — recipients of data submitted by visitors through forms on their page (and, where applicable, ratings). They act as controllers for their own use of that data.

Some providers (notably Stripe and Google) may process data outside the European Union, in particular in the United States. In that case, appropriate safeguards are implemented by those providers (for example standard contractual clauses), as described in their own documentation.

7. Retention

  • Account and business page: while the account is active, then for a reasonable period after deletion or inactivity, in particular to meet legal obligations (accounting, disputes) or to secure the service.
  • Form responses: kept for as long as the module or merchant account exists so the merchant can review them; deleted when the module, page or related account is deleted, or earlier if the merchant deletes them from their workspace.
  • Ratings: kept while the relevant page remains active, unless deletion is requested or the feature is disabled.
  • Page-view statistics: kept for a limited period compatible with merchant audience analysis and service improvement.
  • Google Analytics: audience data is retained according to the period configured in Google Analytics (24 months by default), then automatically deleted.
  • Payment data: according to applicable rules and Stripe’s practices.

8. Cookies

Heedsy uses cookies or equivalent technologies. They fall into two categories.

Strictly necessary cookies — set without consent, because they are required for the service to work:

  • dashboard authentication and session;
  • essential preferences (for example language);
  • first-party visitor identifier for ratings (one rating per device, editable);
  • technical signals related to first-party audience measurement on public pages (no advertising or ad tracking).

Audience measurement cookies (Google Analytics) — set only if you accept via the cookie banner. They help us understand how the Heedsy site is used (pages viewed, source, device type). Measurement ID: G-H8HDN0VH2K. Cookies involved include _ga and _ga_*, set by Google.

No advertising cookies are set. Declining Analytics cookies does not prevent you from using the site. You can change your choice at any time via the “Cookies” link in the footer, or configure your browser to block cookies.

9. Security

Data is stored securely (including in a PostgreSQL database hosted at IONOS). Passwords are hashed. Reasonable technical and organisational measures are in place to reduce the risk of unauthorised access, loss or alteration.

10. Your rights (GDPR)

Under the GDPR, you have in particular the following rights:

  • right of access
  • right to rectification
  • right to erasure
  • right to restriction of processing
  • right to object
  • right to data portability
  • right to withdraw consent where processing is based on consent

For your Heedsy account data (or processing for which Heedsy is controller), contact contact@heedsy.com. You may also request deletion of your account at any time via this address.

For data submitted through a form or a rating on a merchant’s page, please contact the merchant first, as they are the controller for their use of that data. You may also write to contact@heedsy.com: Heedsy can guide you or, where appropriate, relay your request within the limits of its role as processor.

If you believe your rights are not respected, you may lodge a complaint with the CNIL (www.cnil.fr).

11. Changes

This policy may be updated to reflect changes to the service or the law. The last updated date appears at the top of this page.