Internal app privacy policy

Privacy Policy

Last updated: 27 August 2026

1. Who we are

This policy is issued by hevisleep, s.r.o., the data controller.

Registered address: Janka Kráľa 1600/3A, 905 01 Senica, Slovakia

IČO: 56509774

DIČ: 2122329462

IČ DPH: SK2122329462

Privacy contact: kontakt@hevisleep.sk

We operate the consumer brand HEVI and the internal business application described below.

2. What this policy covers

This policy covers personal data processed by our internal business application (the "App") — a private, staff-only tool used to manage inventory, advertising performance, orders and influencer partnerships.

The App is not a consumer product. It is not publicly available, has no public sign-up, and is used solely by our own employees and contractors.

This policy covers data the App processes from all sources, including data obtained through the Meta Platform (Instagram and Meta Ads), not only data collected via our websites.

3. What data we process, and why

3.1 App users (our staff)

We process: name and work email address; hashed credentials, session tokens and password-reset tokens; assigned role and page-level permissions; IP address, browser user-agent and request timestamps.

Purpose: to authenticate users, enforce access control, secure the App, and maintain an audit trail of changes.

Legal basis: legitimate interests (Art. 6(1)(f) GDPR) — operating and securing an internal business system; and contract, where the user is an employee or contractor.

3.2 Instagram and Meta business account data (our own accounts)

We process: Instagram Business account ID, username, account type and media count; our own posts, captions, permalinks, timestamps and media type; ad account ID, campaign, ad set and ad names, spend, impressions, clicks and conversion counts.

Purpose: to measure the performance of our own marketing and report on it internally.

Legal basis: legitimate interests — understanding the effectiveness of our own advertising.

3.3 Instagram users who mention or tag our accounts

When an Instagram user tags or @mentions one of our brand accounts, the Meta Platform makes limited information about that interaction available to us.

We process: Instagram username, Instagram user ID and media ID; the caption text of the post that tagged us, media type, permalink and timestamp.

Purpose: to identify and record collaboration content published by influencers we work with, and to attribute the commercial results of those collaborations. We use it to answer questions such as "which partner content was published, and did it coincide with a change in sales?"

Legal basis: legitimate interests — administering and evaluating our influencer partnerships. Where the person is a contracted partner, we also rely on the performance of that contract.

We do not use this data to build advertising profiles of individuals, to target individuals with ads, to enrich it with data from other sources, or to sell it. Mentions from people we have no partnership with are reviewed and deleted rather than retained.

3.4 Customer and order data

We process: order number, order date, line items, quantities, order value and currency; customer identifier, country or market, and discount code used; payment processor reference (for example a Stripe payment ID) and payment status.

Purpose: revenue reporting, margin and profitability analysis, inventory forecasting, and attributing sales to marketing activity and discount codes.

Legal basis: legitimate interests — business analytics and inventory planning; and legal obligation, where retention is required for accounting or tax purposes.

3.5 Survey responses and on-site analytics

We process: answers to post-purchase survey questions and response timestamps; aggregated page-level session counts, scroll depth and time on page.

Purpose: to understand how customers find us and how our landing pages perform.

Legal basis: consent, where collected via a consent-gated tool; otherwise legitimate interests in aggregate, non-identifying form.

3.6 Publicly available competitor advertising data

We read advertising transparency data that Meta publishes publicly under the EU Digital Services Act (advertiser page names, ad creative text, delivery dates, aggregate reach). This concerns businesses rather than private individuals and is used only for competitive market analysis.

4. Where the data comes from

Directly from our staff, when they use the App. From the Meta Platform (Instagram Graph API, Marketing API, Ad Library) in respect of accounts we own or interactions with them. From our e-commerce and payment providers (Shopify, Stripe). From our own marketing tools (survey and analytics providers).

5. Who we share it with

We do not sell personal data, and we do not share it for advertising purposes.

We use the following processors, who handle data on our instructions: Supabase (database and authentication hosting); Vercel (application hosting, EU region, Frankfurt); Meta Platforms Ireland (Instagram and advertising data); Shopify (e-commerce platform); Stripe (payment processing); Google (advertising data)..

We may also disclose data where required by law, or to establish, exercise or defend legal claims.

6. International transfers

Our application and database are hosted in the European Union. Where a processor transfers data outside the EEA, that transfer is covered by an adequacy decision or by Standard Contractual Clauses.

7. How long we keep it

App user accounts: for the duration of employment or engagement, then deleted within 90 days.

Instagram mention records: for the duration of the partnership plus 24 months, for performance comparison.

Mentions from non-partners: reviewed and deleted, ordinarily within 30 days.

Order and financial records: as required by Slovak accounting and tax law.

Aggregated analytics: indefinitely, in non-identifying form.

8. How to request deletion of your data

If you are an Instagram user and we hold a record of a post or story in which you mentioned one of our accounts, you can ask us to delete it.

Email kontakt@hevisleep.sk with the subject line "Data deletion request" and tell us the Instagram username you posted from. We do not need any other information to find your records.

We will confirm receipt within 5 working days. We will complete the deletion within 30 days and confirm in writing. There is no charge.

You can also remove our access at any time from your own Instagram account: Settings → Apps and Websites → remove the app. This stops any further data reaching us, though it does not by itself delete records we already hold — email us for that.

The same address handles deletion requests from staff, customers and survey respondents.

9. Your rights

Under the GDPR you have the right to: access your data; have inaccurate data corrected; have your data erased; restrict or object to processing (including objecting to processing based on legitimate interests); and receive your data in a portable format.

To exercise any of these, email kontakt@hevisleep.sk.

You also have the right to lodge a complaint with the Slovak supervisory authority, Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk), or with the authority in your country of residence.

10. Security

Access to the App requires authentication and is restricted by role. Database access is governed by row-level security policies. Credentials and API tokens are held as encrypted environment secrets and are not exposed to end users. Access is limited to staff who need it for their role.

11. Changes to this policy

We may update this policy. The "last updated" date above will change, and the current version will always be available at this address.

12. Contact

hevisleep, s.r.o.

Janka Kráľa 1600/3A, 905 01 Senica, Slovakia

kontakt@hevisleep.sk