Plainly said: what happens to data.
Hevia stores data in Frankfurt, has the AI run in the EU, asks for consent before every chat and identifies itself as AI. This page sets out what applies today and where the limits are.
- Database
- Frankfurt
- AI service
- Mistral, EU
- Backup
- daily, encrypted
- Consent
- before every chat
What already applies
Database and servers in Frankfurt
Conversations, requests and knowledge are stored at Neon in Frankfurt. The server functions run at Vercel in Frankfurt.
AI processed in the EU
Answers are written by Mistral from Paris in data centres in the EU. Conversations are not used for training. If the AI is unavailable, Hevia answers straight from your entries.
Consent before the chat
When the page loads, the chat only shows a button and stores nothing on the device. Conversations only start after a click on “Start chat”. No cookie in the chat.
AI labelling
A fixed AI badge and a notice at the start of every conversation, which the business cannot remove, as Article 50 of the AI Act has required since August 2026.
Encryption
All connections use HTTPS. The daily backup is additionally encrypted, using a key that is kept outside the hosting.
Tested backups
Every night the backup is restored in full into an empty database and compared table by table. Kept for 30 days.
Separate businesses
Every query is tied to one business. No business sees another’s data; automated tests check this before every release.
Retention periods
Each business sets how long conversations are kept (30 to 730 days). Deletion runs automatically every night.
Lean logs
No IP addresses in conversations. Abuse protection only counts with an encrypted value that is deleted after two days. The AI log contains no text.
Individual logins and roles
Everyone signs in with their own email and password. Passwords are only stored encrypted (hashed). Export and deletion are for owners only.
Emergency brake
Every business can pause its public chat with one click. A daily limit caps AI usage per business.
What we say openly
Hevia is in its pilot. These points apply as described today or are not yet in place.
US companies as providers
Vercel and Neon (Databricks) are US companies. The data is stored in Frankfurt, but the providers are subject to US law. The basis is the EU-US Data Privacy Framework and standard contractual clauses.
Worldwide network
Vercel routes requests through nodes worldwide. Visitors from outside the EU are routed through nodes outside the EU.
Storage at the AI provider
Mistral stores requests for up to 30 days to detect abuse. Zero data retention can be requested but has not been agreed yet.
Access control in the database
An additional lock directly in the database is planned. Today the application separates the businesses.
Legal review
Privacy policy, terms and DPA have been checked against the technology but not yet reviewed by a lawyer.
Questions about data protection?
We explain everything during the pilot, including the data processing agreement.
Start free