Privacy policy

Who we are

heer(ish) is a web service that lets the people attending an event see who else is in town and arrange to meet. heer(ish), the trade name Heerish, is run by thatUkrainianGuy, a sole proprietorship registered in the Netherlands with the Chamber of Commerce (KvK) under number 98959964, VAT number NL005363781B34, at Berlaarstraat 53, 1066 PJ Amsterdam, the Netherlands, reachable at privacy@heerish.app about personal data and at security@heerish.app about a vulnerability or a breach.

Write to privacy@heerish.app about anything in this policy.

Two kinds of data, two roles

Attendees: the organization running your event decides what happens with the data on its event page. In data protection law it is the controller and heer(ish) is its processor. heer(ish) stores that data on the organizer's instructions and has no use of its own for it. The privacy notice linked from the event's sign-in page tells you what is collected, why, and how to reach the organizer.

Organizers and visitors to heerish.app: heer(ish) is the controller, and the rest of this policy is about you.

What we hold about organizers

Your account: your name and email address.

The organizations you belong to: the name and postal address of each, the contact addresses given for privacy questions and for security incidents, and who its admins are. For each Mighty Networks community an organization connects for attendee sign-in: the name it was given, the community's address, and the app identifier and secret the community issued, the secret stored encrypted and never shown again.

If a colleague invited you: an admin of an organization on heer(ish) can invite you as a fellow admin by giving us your name and work email address. That is where we got them. We use them on the basis of legitimate interest (Article 6(1)(f) GDPR): letting an organization's team run its events together. We send you an email when it happens, with a link to this policy. You become an admin only if you sign in and accept. The invitation is kept until you accept or decline it, or an admin of the organization withdraws it. Being removed from an organization, or leaving it, does not delete your account. Ask us and we will.

Your purchases, if you buy a plan: the billing name, address, country, VAT number and email address you enter at checkout, what you bought, the amount and the VAT charged, and the invoice issued for it. Card and bank details are handled by Mollie and never reach heer(ish). Dutch tax law requires invoices to be kept for seven years, so these records outlive the events they paid for.

Your events: the settings you choose, the text you write, and a record of each statement you confirmed when creating an event and when you confirmed it.

Your second step: for each passkey, its public key, the identifier your device chose for it, the name you gave it, and when it was added and last used (the private key stays on your device or in your password manager and never reaches heer(ish)), plus a random identifier for your account that your devices keep with their passkeys; for an authenticator app, its secret key, stored encrypted, and when it was set up and last used; your recovery codes, stored only as one-way hashes. We also count wrong authenticator codes, to lock out guessing, and keep a note of when we emailed you a notice about your second step, to limit how many can be sent in a day. We keep these while your account exists: removing a passkey or the app deletes it, any successful second step clears the count, and the notes are deleted within two days. Your passkeys, app and recovery codes rest on our contract with you (Article 6(1)(b) GDPR), because heer(ish) cannot keep your account secure without them, as Article 32 GDPR requires; the count and the notes are sign-in records, on the basis given for those below.

Technical records: a sign-in cookie, and a log of changes made in the console. IP addresses are not stored. There are no analytics or advertising scripts on any heer(ish) page.

There are no passwords. You sign in through a link sent to your email address, then with a passkey, a code from an authenticator app or one of your recovery codes.

Signing in with Google, LinkedIn, Apple or Mighty Networks

An organizer can let attendees sign in to an event page through Google, LinkedIn or Apple, and through Mighty Networks when the organizer runs a community there and connects it to the event; the organizer chooses which of these an event offers. heer(ish) asks Google, LinkedIn and Apple for the basic sign-in scopes only: your identifier, your name, your email address and, from Google and LinkedIn, your profile picture. From Mighty Networks it asks for the one scope that reads your member profile in that community (read:userinfo), and reads from it your identifier, name, profile picture, short bio and email address.

From what the provider returns, heer(ish) stores the identifier the provider issues for you, kept against that one event so that your card opens for you and nobody else. Your name and profile picture are used to fill in a new card, and the same happens when you fill in your card from LinkedIn: the name is saved only if you save the card, and the picture is copied into the event's photo storage so the card form can show it. Your short bio from Mighty Networks fills in the note on a new card the same way, and is saved only if you save the card. From Google, LinkedIn and Apple your email address is not stored. From Mighty Networks it is: the email address the community returns is kept with your card, against that one event, unless the community withholds it.

heer(ish) requests no access to contacts, calendars, files, posts or connections, and discards the access token the moment sign-in completes. It makes no calls to the provider on your behalf, apart from the single request to Mighty Networks during sign-in that reads your profile, and it does not keep the refresh token Mighty Networks also issues. Data received from a provider is never sold, never used for advertising and never used to train models.

The identifier, the email address from Mighty Networks, and any copied picture that no card uses, are deleted with the rest of the event on the deletion date shown on its sign-in page.

Why, and on what basis

Account and event data is needed to provide the service you signed up for, which is the legal basis under GDPR Article 6(1)(b).

Invoices and the billing details on them are kept because Dutch tax law says they must be, which is Article 6(1)(c).

The sign-in records, the record of what you confirmed and the change log rest on Article 6(1)(f). heer(ish) has a legitimate interest in keeping the service secure, handling misuse and being able to show what was agreed.

When a colleague invites you to an organization, holding your name and email address before you have answered rests on Article 6(1)(f) as well: the legitimate interest is letting an organization's team run its events together.

heer(ish) emails you sign-in links, messages about your account and your events, a notice when your second step changes, a recovery code is used or repeated wrong codes are entered, and a message when a colleague invites you to an organization. It sends nothing else.

No decisions about you are made by automated means.

Who receives it

The other admins of an organization you belong to see your name and email address, and so does anyone you invite to become one, in the invitation and when they sign in to answer it.

Cloudflare, Inc. hosts the service, stores the databases and photos, and delivers the email. Organizer accounts and events on the EU setting are stored in the European Union, under a jurisdiction restriction that keeps them there. Events on the US setting are stored in the United States, in Cloudflare's eastern North America location, with no jurisdiction restriction behind it. Email goes out through the Cloudflare network worldwide, the United States included.

Resend (Plus Five Five, Inc.) is the fallback for email. When Cloudflare cannot send a message, Resend delivers it instead. It receives the recipient's address (and name, on an invitation to an event; an invitation to become an organization's admin names the colleague who sent it, with their email address), the sender name and the message, sign-in links included, and stores them in the United States.

Google provides the map and the place search. Searches pass through the heer(ish) server, so Google does not see your device. Opening a map is different: your browser then loads it straight from Google, which handles that connection under its own privacy policy. On the EU and UK settings the map loads only after you agree to it; on the US setting it loads with the page.

Mollie B.V., in the Netherlands, takes the payment when an organizer buys a plan. It receives the billing details and the amount, and nothing about attendees. The data stays in the European Union.

Cloudflare, Google and Resend are American companies. Transfers to the United States are covered by the European Commission's standard contractual clauses (GDPR Article 46(2)(c)), with the EU-US Data Privacy Framework as a further safeguard. Write to us for a copy of the clauses.

Nothing is sold, and nothing is passed on for advertising.

Cookies and browser storage

heer(ish) sets only the cookies it needs to work: one that keeps you signed in, short-lived ones that carry a sign-in from one step to the next (from the email to your second step, or through Google, LinkedIn, Apple or Mighty Networks), one that remembers your language and, in the organizer console, one that remembers which of your organizations you last opened. On the EU and UK settings your browser also remembers whether you agreed to load the Google map. None of them follows you to other sites, so there is no cookie banner.

On an event page you are signed in to, your browser also keeps a small script for that event, a service worker, which shows the event's notifications and a fallback page when you are offline, and a copy of that fallback page. If you switch notifications on, the page also keeps a note in your browser of which card they belong to, so that they stop when someone else signs in on the same device.

How long it is kept

Every event is permanently deleted on a fixed date after it ends. The date is shown in the console and on the event's sign-in page. Live systems are clear within 24 hours of that date, and backups within 30 days. An email delivered through Resend is the exception: Resend keeps it for 30 days after it was sent, and in its backups for 7 more.

Your organizer account is kept until you ask for it to be deleted. Leaving an organization, or being removed from one, does not delete it. Write to privacy@heerish.app and it is gone within one month. An organization you are the only admin of goes with it, together with its events, unless you invite another admin and they accept first.

An organization and its events are deleted when one of its admins asks. Write to privacy@heerish.app and they are gone within one month.

Invoices are the exception: Dutch tax law requires them to be kept for seven years from the end of the year they were issued in, so an invoice and the billing details printed on it stay after the account is gone.

Your rights

You have the right to see the data held about you, to have it corrected or erased, to have its use restricted, to receive it in a portable format, and to object to the processing that rests on a legitimate interest. Write to privacy@heerish.app. You get an answer within one month.

You can also complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You are free to go to the authority where you live or work instead.

Age

Organizer accounts are for people aged 18 or over who act for an organization. Each event page states its own minimum age for attendees.

The other documents

heerish.app/subprocessors names every company that processes data for heer(ish), what it does, where it does it and under which safeguard.

heerish.app/security describes the security measures, and how to report a vulnerability.

heerish.app/dpa is the processing agreement between an organization and heer(ish) for attendee data, with the standard contractual clauses annexed.

heerish.app/legal/dpia is a pre-filled impact assessment template for organizers.

heerish.app/terms is the agreement accepted on behalf of an organization when it is created on heer(ish).

Changes

When this policy changes in a way that matters, organizers are told by email before the change takes effect. The date at the top shows the current version.