Privacy Policy

01Who we are

HiVis (“HiVis”, “we”, “us”) is operated by Perpetio OÜ, a private limited company registered in Estonia under registry code 14661567, with its registered office at Harju maakond, Tallinn, Kesklinna linnaosa, Kaupmehe tn 7-120, 10114, Estonia.

For any privacy question or request, email support@hivis.app.

02What this policy covers

This policy covers the personal data we handle when you:

• visit our website, including the landing pages and the demo request form;
• create or use a HiVis account, or accept an invitation to a workspace;
• subscribe to a plan, or contact our sales or support team.

It doesn’t cover other companies’ websites or services, even when HiVis links to them.

03Our role: controller and processor

Where we are the controller. We decide how and why personal data is used for accounts and sign-in, billing, support conversations, demo requests, website and product analytics, and security. This policy describes that processing.

Where we are the processor. Businesses that subscribe to HiVis (our customers) keep their own operational data in their workspace: employees and contractors, hours worked, pay rates and bonuses, projects, clients and quotes, inventory, vehicles, documents and photos. The customer is the controller of this customer data and decides what it holds and why. We process it only to provide HiVis, under our Terms of Service and the customer’s instructions.

If your details appear in a customer’s workspace, for example as an employee or contractor, please send questions or requests about that data to the company concerned. If you contact us, we’ll pass your request on and help them answer it.

04Personal data we collect

• Account details: your name, work email, company name, password (stored only as a bcrypt hash, which we can’t read), role, language, timezone, email confirmation status, and when you accepted our Terms.
• Workspace details: the workspace name, plan, members and their roles, invitations, and email notification preferences.
• Customer data: whatever a customer’s users enter or upload in HiVis, as described in Our role.
• Billing details: billing name and email, plan, billing period and subscription status. You enter card details on Stripe’s checkout page and Stripe handles them; we never see or store full card numbers.
• Demo requests: your name, work email, company name, team size and any notes you add.
• Support conversations: messages you send us in the chat or by email. When you’re signed in, the chat also shows our support team your name, email, workspace name, role and plan, so they know who they’re helping.
• Usage data: pages viewed, features used, and product events such as creating a project or starting a subscription. Events never include the contents of your records: no names, amounts, notes or addresses. Analytics explains session recordings.
• Device and technical data: IP address, browser, device and operating system, the referring page, campaign tags (utm parameters), and error reports when something breaks.
• Email delivery data: which emails we sent you, whether they were delivered, and your unsubscribe choices.

05How we use personal data, and our legal bases

Under the EU General Data Protection Regulation (GDPR), each use of personal data needs a legal basis. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see Your rights). We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

Service emails, such as email confirmation, password resets, invitations and billing messages, are part of using HiVis. Reminders, alerts and digests can be switched off with the unsubscribe link in each email.

06Analytics, session recordings and error monitoring

Before you sign in, for example on the landing page, our analytics (PostHog, hosted in the EU) store nothing in your browser: no cookie and no local storage. Visits are counted with an identifier that PostHog’s servers calculate from your IP address and browser details, using a key that changes every day.

After you sign in, PostHog links your activity to your account (user ID, name, email, role and workspace) and sets a cookie to recognise your browser. When you sign out, the cookie is removed and your browser goes back to anonymous counting.

Session recordings. For signed-in users, PostHog records how pages are used (clicks, scrolling and page changes) so we can find and fix usability problems. Everything typed into fields is hidden. On payroll, contractor, report, admin, customer, quote and billing pages all text is hidden too, and email addresses, phone numbers and other sensitive values are hidden on every page. Recordings never capture network requests or the browser console.

Error monitoring. When HiVis hits an error or runs slowly, Sentry receives a report with the error message, where in the code it happened, the page address without its query string, browser and device details, timing data, and the IP address the report came from. We have set it not to collect your name, email, cookies, form contents or request data.

07Cookies and browser storage

We don’t use advertising or cross-site tracking cookies. This is everything HiVis keeps in your browser:

On the demo request form, Cloudflare Turnstile checks that a person, not a bot, is sending it, using technical signals from your browser.

You can block or delete cookies in your browser settings. Without the essential cookies, you won’t be able to sign in.

08Who we share personal data with

We don’t sell personal data, and we don’t share it for advertising. We share it only:

• with service providers who process it for us under data processing agreements (see Service providers);
• within your workspace: owners, admins and users with the right permissions can see what the workspace holds, including your name, email and role;
• when the law requires it, for example to comply with a valid court order, and only as far as required;
• to protect HiVis, our customers or others from fraud, abuse or security threats;
• in a business transfer: if HiVis or our company is merged, acquired or sold, the new owner must protect your data as this policy describes. We’ll tell you before your data becomes subject to a different policy.

09Service providers (sub-processors)

These companies process personal data for us. Each one is bound by a data processing agreement and may use the data only to provide its service to us.

We update this list when our providers change, and tell account owners by email before a new provider starts processing customer data, so they can object.

10International transfers

HiVis is hosted in Germany. Some of the providers above are based in the United States or may access data from there. When personal data from the European Economic Area, the UK or Switzerland goes to a country without an adequacy decision, we rely on the provider’s certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where available, and otherwise on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of these safeguards.

11How long we keep personal data

• Accounts and customer data: for as long as the workspace is active. When a customer closes their workspace, or their subscription or trial ends without renewal, we delete the workspace’s data within 30 days. Backups that still contain it are overwritten within a further 30 days.
• Billing records: invoices and payment records are kept for as long as tax and accounting law requires, usually up to 10 years.
• Demo requests: kept while we arrange and follow up on the demo, and deleted within 12 months of our last contact unless you become a customer.
• Support conversations: kept while they help us support you, and no longer than 24 months after the last message.
• Session recordings and error reports: deleted automatically after at most 90 days.
• Analytics events: kept while they help us understand how HiVis is used over time. When we delete your account data, we delete your analytics profile as well.
• Email delivery records: 90 days. Email confirmation and password reset links: until they expire, after 24 hours and 1 hour respectively.

We may keep data longer when the law requires it, or to establish or defend legal claims.

12How we protect personal data

• All traffic to HiVis is encrypted in transit (HTTPS).
• Passwords are stored as bcrypt hashes, never in readable form.
• Each workspace’s data is kept separate, and every request is checked against the workspace it belongs to.
• Roles and permissions control what each user can see and change. Business plans also keep an audit log of changes.
• Access to production systems is limited to the people who run HiVis and protected by strong authentication.

If a personal data breach puts your data at risk, we’ll notify the affected customers and, where required, the authorities without undue delay.

13Your rights

Depending on where you live, you can ask us to:

• give you a copy of your personal data and tell you how we use it;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how we use it;
• send it to you or another provider in a machine-readable format;
• stop using it, where we rely on legitimate interests;
• withdraw consent, where we rely on consent, without affecting what we did before.

To use these rights, email support@hivis.app from the address on your account. We may ask you to confirm your identity. We reply within one month, and tell you if a complex request needs longer.

If your data is in a customer’s workspace, we’ll forward your request to that customer, who decides on it (see Our role).

You can also complain to a data protection authority, in particular in the country where you live or work, or where you believe the infringement happened. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). In Ukraine, you can contact the Ukrainian Parliament Commissioner for Human Rights.

14Children

HiVis is a business tool for people aged 18 and over. We don’t knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we’ll delete it.

15Changes to this policy

We update this policy when HiVis or the law changes. The date at the top shows when it last changed. If a change materially affects how we use your data, we’ll tell account owners by email or in the app before it takes effect.

16Contact us

Perpetio OÜ, registry code 14661567, Harju maakond, Tallinn, Kesklinna linnaosa, Kaupmehe tn 7-120, 10114, Estonia. Email: support@hivis.app.