Heura Studios Privacy Policy

1. Who we are

This policy explains what personal information Heura Studios collects, how we use it (including to train our AI models), and the choices you have. Effective date: [insert date before publishing].

Heura Studios (“Heura”, “we”, “us”) is a product of Ostravanne, based in Vancouver, British Columbia, Canada. It covers our website at heurastudios.com, the waitlist, the Heura Studios app, our models (including Heura Arche), the API, and any chat assistants our customers deploy with Heura (together, the “Services”).

When a business uses Heura to build and launch its own assistant, that business decides what documents and end-user data go into it. For that content, the business is responsible for its own privacy notice and we act as its service provider.

2. Information we collect

We collect account and login information, the content you put into Heura, and basic technical data.

If you run a model entirely on your own computer, its documents and conversations stay on your device and are not sent to us, except for licence checks and crash reports you choose to send.

3. How we use information

We use your information to run the Services, keep them secure, and improve them. We do not sell personal information.

• Provide the Services: create and secure your account, sign you in, store your workspace, train and host your custom assistant.
• Security: detect suspicious logins, prevent fraud and abuse, enforce our Terms.
• Communicate: send waitlist and beta updates, service notices, and billing messages. You can unsubscribe from marketing email at any time.
• Improve Heura and train our models: see section 4.
• Legal: comply with law and respond to lawful requests.

Where a law such as the GDPR applies, our legal bases are: performing our contract with you, our legitimate interests in running and improving the Services, your consent (for example, marketing or optional analytics cookies), and legal obligations.

4. How we use trial data to train our AI

We use protected copies of trial data to improve Heura’s base models (such as Arche, Asteria and Aniketos) only if you turn on “Use my data to improve Heura”, and you can turn it off at any time.

What we use. Content from free trials and beta workspaces that turned it on: uploaded documents, rules, example answers, test questions, prompts, model outputs and feedback. We never use passwords, login credentials or payment information for training.

How we protect it.

1. Trial data is encrypted in transit (TLS) and at rest.
2. Before data enters a training set, we remove or replace direct identifiers such as names, email addresses, phone numbers and account IDs (pseudonymization).
3. Training data is stored separately from account data. Only a small number of authorized staff can access it, and access is logged.
4. We test trained models to reduce the chance that they repeat training content.

Pseudonymized data can still count as personal information under some laws, so we continue to treat it as personal information and protect it accordingly.

Your choices.

• “Use my data to improve Heura” is in your workspace settings. It is off unless you turn it on. You can turn it off again at any time, or email us; turning it off applies to data from that point on.
• Paid workspaces are not used to train our base models unless the customer opts in. [Confirm this matches your plans.]
• Your own custom assistant is trained on your content for your use only and is not shared with other customers.
• Once data has been used in a released model version, we cannot remove its influence from that version, but we will exclude it from future training.

5. Sharing

We share personal information only with:

• Service providers that host, store, email, process payments or provide analytics for us, under contracts that limit their use of the data. [List key providers, e.g. hosting and email.]
• Your organization, if your account belongs to a company workspace.
• Authorities, when required by law or to protect rights and safety.
• A buyer or successor, if Ostravanne is involved in a merger or acquisition, with notice to you.

6. Security

We use encryption in transit and at rest, hashed passwords, access controls and logging. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify you and the relevant regulators as the law requires.

7. Retention

• Account data: while your account is open, then deleted within 90 days of closure.
• Workspace content: deleted within 30 days after you delete it or close your account.
• Pseudonymized training data: kept up to 3 years, then deleted.
• Logs: up to 12 months.

We may keep some records longer where the law requires. [Adjust periods to match your systems.]

8. Your rights

Depending on where you live (including under Canada’s PIPEDA, BC’s PIPA, the GDPR and California law), you may ask to access, correct, delete or export your information, withdraw consent, object to training use, or complain to a regulator. Email us and we will reply within 30 days. We will not treat you differently for using these rights.

9. International transfers

We are based in Canada and may store or process data in Canada, the United States or other countries where our providers operate. We use contractual safeguards for these transfers.

10. Children

The Services are for businesses and are not directed to children under 13 (or under 16 in the EEA and UK). We do not knowingly collect their information and will delete it if we learn we have.

11. Changes

We will post updates here and change the effective date. For material changes, especially to how we use data for training, we will notify you by email or in the app before they take effect.

12. Contact

Ostravanne (Heura Studios), Vancouver, British Columbia, Canada. Privacy contact: [privacy@ostravanne.com or leoli@ostravanne.com].