Privacy Policy

Privacy Policy

At hsmart.dev, we are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website and services.

1. Data We Collect

We collect the following types of personal data:

• •Contact Information: Name, email address, and any message you send through our contact form
• •Assessment Data: Information you provide when using our automation assessment tool, including your role, automation level preferences, and problem descriptions
• •App Early Access: Email address, preferred language and your selected apps when you sign up for early access to our apps (double opt-in). If you volunteer as an Android tester, also the Google account email of your Android device, used solely to enroll you in the Google Play closed test. Processed via Resend and stored on Neon; withdraw any time via the unsubscribe link in every email.
• •WhatsApp AI Assistant: when a business uses our WhatsApp assistant, we process the messages its customers send and receive on that business's WhatsApp number, the customer's phone number and WhatsApp profile name, and any booking details shared in the chat (name, date, time, party size). We process this on behalf of that business, which is the data controller. The assistant tells customers it is an AI in its first reply.
• •Technical Data: IP address, browser type, device information, and usage data collected through analytics tools
• •Storage on your device: one functional cookie for your language, plus a per-tab random id for audience measurement that is erased when you close the tab. Full detail in our Cookie Policy.

2. How We Use Your Data

We use your personal data for the following purposes:

• •To respond to your inquiries and provide customer support
• •To deliver our services, including automation assessments and consultations
• •To improve our website and services based on usage analytics
• •To comply with legal obligations and protect our legal rights

3. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on:

• •Consent: When you provide explicit consent (e.g., subscribing to the newsletter)
• •Contract Performance: To fulfill our service agreements with you
• •Legitimate Interests: To improve our services and ensure website security
• •Legal Obligation: To comply with applicable laws and regulations

4. Data Sharing and Third Parties

We may share your data with the following third-party service providers:

• •Resend: For sending transactional emails (privacy policy: https://resend.com/legal/privacy-policy)
• •Cloudinary: Serves images on the site (privacy policy: https://cloudinary.com/privacy)
• •Vercel: Hosts the website (privacy policy: https://vercel.com/legal/privacy-policy)
• •Cal.com: For scheduling consultations (privacy policy: https://cal.com/privacy)
• •Neon Database (EU, Frankfurt): Stores contact form submissions, newsletter and marketing list entries, analytics events, and the conversations handled by our WhatsApp AI assistant (privacy policy: https://neon.tech/legal/privacy-policy)
• •Meta Platforms Ireland (WhatsApp Business Platform): Delivers WhatsApp messages between a business and its customers (privacy policy: https://www.whatsapp.com/legal/business-data-processing-terms)
• •Google (Gemini API, United States): Generates the WhatsApp assistant's replies from the conversation text. Messages are sent to Google's servers in the US for this purpose (privacy policy: https://policies.google.com/privacy)
• •Tableo: When a customer books a table through the WhatsApp assistant, the booking details are sent to the restaurant's own Tableo reservation system (privacy policy: https://tableo.com/privacy-policy/)

These providers are contractually obligated to protect your data and only use it for specified purposes.

5. Data Retention

We retain your personal data only for as long as necessary:

• •Contact form submissions: 2 years or until you request deletion
• •Assessment data: 1 year or until you request deletion
• •Analytics events: first-party and cookieless, kept as aggregate site statistics. They carry no IP address and no identifier that can be linked to you.
• •WhatsApp assistant conversations: Kept for as long as the business uses the service, and deleted when the business or the customer asks, or when the business stops using the service
• •Legal requirements: As required by applicable law

6. Your Rights (GDPR & CCPA)

You have the following rights regarding your personal data:

• •Right to Access: Request a copy of your personal data
• •Right to Rectification: Correct inaccurate or incomplete data
• •Right to Erasure: Request deletion of your personal data
• •Right to Data Portability: Receive your data in a structured format
• •Right to Object: Object to processing of your data
• •Right to Withdraw Consent: Withdraw consent at any time
• •Right to Opt-Out (CCPA): Opt-out of sale of personal information (we do not sell your data)

To exercise these rights, please contact us at henoch@hsmart.dev

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption, secure servers, and regular security assessments.

8. International Data Transfers

Your database sits in the European Union: contact form submissions, newsletter subscriptions, testimonials, analytics events and WhatsApp assistant conversations are stored on Neon in Frankfurt. Some processors we rely on are based in the United States, so data does leave the EU when it reaches them: Resend for sending email, Cal.com for the booking calendar on the contact page, Vercel and Cloudinary for hosting and images, and Google, whose Gemini API generates the WhatsApp assistant's replies. Those transfers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework where the provider is certified.

9. Cookies

This site sets one functional cookie, for your language. Audience measurement is first-party and cookieless, and there is no advertising tracker anywhere on the site. The contact page embeds a Cal.com booking calendar, the only third party that loads in your browser. Full detail in our Cookie Policy.

10. Children's Privacy

Our services are not directed to children under 16. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the 'Last Updated' date.