Privacy policy
Last updated: 4 November 2026 · Hevia is a product of evioe studio.
This version has been checked against Vela’s actual technical architecture. A review by a lawyer is still pending.
1. Overview and roles
Hevia is an AI chat for businesses’ websites. This policy describes which personal data we process when you visit this website, try Hevia, sign up or use the dashboard. We are responsible for this processing.
When you use the chat on a business’s website, that business is responsible, and we only process the data on its behalf. What happens there is described under Privacy in the chat. How the AI works is described under AI information.
2. Controller and contact
Controller within the meaning of the GDPR:
evioe · Web & IT Studio
Owner: Mahsum Kavak
Schwarzwaldstr. 61
79539 Lörrach
Germany
For any privacy question: hey@evioe.de, phone +49 7621 9517360.
3. Visiting the website
The website runs on Vercel. When you open a page, Vercel processes technically necessary data (IP address, time, requested address, browser identifier, region of the network node) to deliver the page and protect it against attacks (Art. 6(1)(f) GDPR). Our application runs in Frankfurt; visitors from outside the EU are routed through nodes outside the EU. Vercel is a US company and, by its own account, processes primarily in the United States.
We use no analytics services, no advertising and no tracking cookies. We serve fonts ourselves; no connection to Google is made.
4. Pilot and partner enquiries
When you submit the “Start free” form or the partner enquiry, we store your name, business, email address and, optionally, your website, in order to answer your enquiry (Art. 6(1)(b) GDPR, pre-contractual measures). The enquiry is held in our database in Frankfurt and is deleted automatically after 12 months.
5. Try-out and demo chats
Trying Hevia with your own website
If you enter a website address on the homepage, we read that website (up to five subpages) and have the AI turn it into knowledge entries, which it uses to answer your test questions. Entries and questions stay in your browser and are not stored by us; we only store the number, duration and size of the AI calls, without content (Art. 6(1)(f) GDPR, our interest in a demonstration).
Demo chats
The example businesses on this website use the real chat. Your messages there are stored as they would be for a real business, with us as controller, and deleted 12 months after the last message. Please do not enter personal data in demo chats.
6. Sign-up and dashboard
For an account we store your name, your email address and your password, which is stored only in encrypted (hashed) form that we cannot read. We also store which businesses you belong to and in which role. When you create a business, we store its name, town, website and contact address. The legal basis is the contract for using Hevia (Art. 6(1)(b) GDPR).
When you invite someone to your team, we create an invitation link that is valid for 14 days; the invitation can be tied to an email address. You pass the link on yourself; we do not send invitation emails.
You can delete your account at any time under “Data & account”. Owners of a business can export all of the business’s data as a file and delete the business with all conversations, requests and knowledge entries.
7. Emails
Hevia sends emails for password resets, for new requests from the chat to the business concerned, and for internal incident alerts to us. The service intended for this is Resend (Plus Five Five, Inc., USA). Resend is not set up yet; until it is, no emails are sent. As soon as Resend is active, we will list it among the subprocessors. Resend stores account data, email metadata and logs in the United States.
9. Logs and abuse protection
- Abuse protection: To slow down mass requests, sign-in attempts and sign-ups, we count requests. IP addresses are only used as an irreversible, encrypted value; the counters are deleted regularly once they are older than two days (Art. 6(1)(f) GDPR).
- Error logs: We log errors and incidents in shortened form, without content; email addresses and long digit sequences are masked. Deleted after 90 days.
- AI usage: For each AI call we store the business, time, volume, duration and success, but no text, to calculate costs and daily limits.
- Vercel: Vercel logs requests (including the requested address, browser identifier and IP address) and keeps these logs for 1 hour or 1 day, depending on the plan. In individual cases, error messages there may contain parts of a request.
10. Providers and third countries
We use Vercel (hosting, delivery, backup storage), Neon (database) and Mistral AI (AI answers). Location, purpose and contractual basis are given in the list of subprocessors.
Vercel Inc. and Databricks, Inc. (Neon’s parent company) are US companies and, by their own account, certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023); their data processing terms also provide for EU standard contractual clauses (Art. 45, 46 GDPR). The database is located in Frankfurt. Mistral AI is a French company; the AI runs in data centres in the EU and EFTA countries.
We do not sell data and do not pass it on for advertising.
11. Retention and deletion
| Data | Retention |
|---|---|
| Account (name, email, encrypted password, memberships) | Until you delete the account |
| Pilot and partner enquiries | 12 months from receipt, then deleted automatically |
| Demo chats on this website | 12 months after the last message |
| Try-out with your own website | Content is not stored; only the number and duration of AI calls, without personal data |
| Team invitations | Valid for 14 days; stored until the business is deleted |
| Password reset link | Valid for 60 minutes; stored only in encrypted form |
| Abuse-protection counters (pseudonymised IP address) | Deleted regularly once they are older than 2 days |
| Operational events (errors, shortened, no content) | 90 days |
| Logs at Vercel | 1 hour or 1 day, depending on the plan |
| Encrypted backups | 30 days; deleted data also disappears from the backups by then at the latest |
How long conversations and requests in a business’s chat are kept is decided by that business; see Privacy in the chat. Statutory retention obligations (for example for invoices) remain unaffected.
12. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). Write to hey@evioe.de; we reply within one month.
You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI), Heilbronner Straße 35, 70191 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.
You are not obliged to give us any data. Without an email address and password, however, an account is not possible. We make no automated decisions within the meaning of Art. 22 GDPR.
13. Changes
If Hevia or the law changes, we will update this policy. The date at the top shows the current version. We inform customers of material changes in advance.
This English version is provided for convenience. If the two versions differ, the German version prevails.