Privacy Policy

The responsible supervisory authority for data protection in Switzerland is:

We process your personal data only for the purposes we communicate to you at the time of collection or that arise from the context. The legal bases for data processing are, depending on the case:

• Your consent pursuant to Art. 6(1)(a) GDPR or Art. 13(1) DSG;
• the performance of a contract with you or the implementation of pre-contractual measures at your request pursuant to Art. 6(1)(b) GDPR or Art. 13(2) DSG;
• compliance with a legal obligation to which we are subject pursuant to Art. 6(1)(c) GDPR or Art. 13(3) DSG;
• the protection of our legitimate interests or those of a third party pursuant to Art. 6(1)(f) GDPR or Art. 13(4) DSG.

We only share your personal data with recipients who are involved in fulfilling the purpose of data processing or who support us in protecting our legitimate interests. These may include our employees, suppliers, service providers, or partners.

If we transfer personal data to a country without an adequate level of data protection, we ensure appropriate safeguards, in particular standard contractual clauses, or rely on an exception provided by law.

To provide Heracel we use the following service providers, which process personal data on our behalf: Supabase (database of the Company Brain) – Switzerland; Base44 (application, user accounts, finance module, encrypted access tokens, uploaded files) – United States; Anthropic (AI processing) – United States; Microsoft (e-mail) – according to Microsoft's data protection terms, including the United States. Transfers to the United States are based on the providers' data processing agreements, including the standard contractual clauses of the European Commission recognised by the Swiss FDPIC.

We store your personal data only as long as necessary for the purpose of data processing or as required by statutory retention periods. After these periods expire, we delete or anonymize your personal data.

You have the right to request information about the personal data we process at any time. You also have the right to request the correction, deletion, or restriction of processing of your personal data. You further have the right to receive your personal data in a structured, commonly used, and machine-readable format or to have it transferred to another controller. You also have the right to withdraw your consent to the processing of your personal data at any time. Finally, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates applicable data protection laws.

To exercise your rights, you can contact our data protection officer at privacy@heracel.com or send us a written request by mail. We will process your request as quickly as possible and provide you with an appropriate response.

If you connect a third-party account to Heracel — such as a Facebook Page, an Instagram Business account, a TikTok account, a LinkedIn Page, Gmail, Google Calendar, Microsoft 365, HubSpot, Slack, Calendly or bexio — we receive an access token for that account and read only the data needed for the feature you enabled. Typically this is your organisation's own profile data, its published posts and their engagement counts, and, where you chose a calendar, CRM or accounting integration, calendar events, contacts, companies, deals, quotes and invoices.

We never read data of other users of those platforms. We do not publish, send or modify anything on a platform unless you explicitly trigger that action in Heracel.

Access tokens are stored encrypted with our hosting providers (see "Recipients and Countries"). Imported data is kept for as long as the connection exists. When you disconnect a platform, its access tokens are deleted and imported data that is no longer needed is deleted; all data is deleted when you delete your Heracel account. See https://heracel.com/data-deletion for instructions.

Heracel's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Google user data (Gmail messages and metadata, Google Calendar events) is used only to provide the features you enabled in Heracel; it is not sold, not used for advertising, not used to train generalised AI or machine-learning models, and not read by humans except with your explicit consent, for security purposes, or where required by law.

Our use of data received from Meta platforms complies with the Meta Platform Terms and Developer Policies. Our use of data received from TikTok complies with the TikTok Developer Terms of Service. Our use of data received from LinkedIn complies with the LinkedIn API Terms of Use.

The data controller is Apollonic Ventures, J. Fischer, Freidhofstrasse 12, 8934 Knonau, Switzerland. Contact for data protection matters, including our data protection officer: privacy@heracel.com.

Our website uses cookies. Cookies are small text files stored on your computer or mobile device when you visit our website. Cookies allow us to store your preferences, improve the usability of our website, and offer you relevant content and offers.

You can disable or restrict the use of cookies at any time in your browser settings. You can also delete stored cookies at any time. Please note that disabling cookies may impair the functionality of our website.

We reserve the right to change this privacy policy at any time to adapt it to new legal or technical developments. The current version of this privacy policy is available on our website.