heqticTill appen

Privacy Policy

How Heqtic collects, uses and protects personal data under the EU General Data Protection Regulation (GDPR, 2016/679).

Last updated: · Svensk version

This is an English translation of Heqtic's Swedish privacy notice, provided for a prospect whose own language is English. The pages this notice links to below — the sub-processor list, the integrations page, the customer agreement, and the security page — are published in Swedish only today.

1. Data controller

Heqtic is the data controller for the processing described below. Contact: sam@heqtic.se.

2. What data we process

2.1 Customer data

  • Name, title, email address, company name and website.
  • The content you enter yourself (your ICP, value proposition, notes).
  • Information about your existing customers — either typed in by you in the ICP form, or, if you have enabled it, fetched on an ongoing basis from your connected CRM (only the names of your established company/organisation records there, never contact persons, deal values, or an individual deal's own name). Used solely to avoid suggesting the same company to you as a new prospect, and in that case included in the material sent to our AI provider at generation time (see the sub-processor page). Never shared with other customers, never sold, and never added to a shared database; CRM-fetched names are also never stored by us — see the integrations page and the customer agreement §§ 6 and 9.
  • Login and session data via Supabase Auth.
  • Billing details you provide when ordering: organisation number, VAT registration number, billing address, billing email address and your reference.
  • Evidence that the agreement was accepted: the name of the person who accepted it, the time, and the IP address at acceptance.
  • In some cases: a negotiated price, a revenue-share percentage, and/or a written addendum to the customer agreement — set by an administrator at order time or later, shown to you in the service before being accepted (see the customer agreement).

Lawful basis: Contract (GDPR Art. 6(1)(b)) — we need the data to deliver and invoice the service you purchased. The evidence of acceptance (name, time, IP address) is processed under legitimate interest (Art. 6(1)(f)) in being able to show that an authorised person accepted the order; the IP address is deleted after 24 months. We invoice through our bookkeeping service (see the sub-processor page), and billing details are kept there for as long as Swedish bookkeeping law requires (financial records, 7 years), and that copy is not subject to erasure under Art. 17.

2.2 Prospect data

To deliver Researched Buying Signals (RBSes) we collect publicly available information about decision-makers at companies matching your ICP:

  • The decision-maker's name and title.
  • Company name, sector, size, geographic location.
  • Public buying signals (regulatory deadlines, new hires, press releases, etc.) fetched partly via web search from official websites, LinkedIn and news sources, and partly via an automated collection process that continuously fetches dated signals from public Swedish sources (see Source below).
  • Industry classification code (SNI), business description and legal form of the company, fetched from the Swedish Companies Registration Office (Bolagsverket) and Statistics Sweden (SCB)'s open registers, to categorise the company correctly. For a sole proprietorship, such a company fact can constitute personal data; this specific fact is stored but not sent to our AI model, and is deleted on request. Other facts about the company — including the company name, which for a sole proprietorship is a natural person's name — are processed by our AI model when a buying signal is analysed.
  • The average number of employees according to the company's own filed annual report, fetched from Bolagsverket, to match the company's size against the customer's ICP when selecting candidates. Used only internally for candidate selection and scoring — never shown to the customer and never sent to our AI model. For a sole proprietorship or a closely held company (a company with a small number of owners), this fact may in practice concern the person running the business; however, a sole proprietorship never files an annual report, so this fact cannot be fetched for that legal form.
  • Verified contact details for the professional role: the decision-maker's work email address and a phone number, obtained via our enrichment partner FullEnrich. The vendor does not always distinguish a switchboard, a direct line, and a private individual's own mobile number — the number may therefore be a private individual's mobile number, and we treat it as such. Private email addresses are not collected.
  • The decision-maker's current role and title, and a few of their most recent public LinkedIn posts, obtained via our sub-processor Unipile, to evidence a current, dated buying signal. We store only a minimised, business-relevant summary of the signal — not full profiles. This feature is disabled and has never been active in production. We therefore do not currently fetch any LinkedIn data via Unipile. We will update this page before the feature is enabled.
  • A "way in" to the decision-maker — a concrete way to start a first contact. Primarily a professional route: a named colleague or other professional contact at the same company who is assessed as able to connect you to the decision-maker, obtained the same way and from the same public sources as the buying signal. If no such professional route is found, it may instead be a concrete, sourced fact about the company (e.g. a recently published news item, an initiative, or an organisational change) that shows the research was genuinely done — never a fact about the person. In exceptional cases — only when neither a professional route nor such a company fact is found — it may instead be a personal interest the person has themselves shared publicly in a professional context, e.g. on their own LinkedIn profile or in a published interview: a hobby, a sports club, an education, a hometown, or a language. We never use information about health, family, charity, religion, politics, union membership, personal finances, or any third person in this case, and the fact must always be traceable to a concrete source where the person themselves said it. The personal variant of this feature has been enabled since 14 September 2026.
  • For any customer, regardless of vertical, a buying signal can also be a documented multi-year revenue increase according to the company's own filed annual accounts — always dated to the relevant financial year, never presented as a recent event. The fact concerns the company. The figure is sourced primarily from Bolagsverket's own filings, the company's own published information, or news sources; if that does not yield a usable figure, the revenue figure only (never profit, margin, or any creditworthiness assessment) may instead be sourced from a public aggregator that republishes Bolagsverket's own figures — allabolag.se, ratsit.se, proff.se or bolagsfakta.se. Never from a credit bureau such as UC, Bisnode, Syna, Dun & Bradstreet or Creditsafe. For customers in the insurance vertical a buying signal can similarly also be a documented multi-year revenue decrease — framed as the company's insurance level possibly needing to be adjusted downward for a smaller operation, never as an assessment of the company's financial standing or creditworthiness. This fact is sourced exclusively from Bolagsverket's own, digitally filed annual reports (the same source as above) — never from an aggregator or a credit bureau.
  • For customers in the tradespeople/clinics/accounting vertical, we may also fetch the company's public rating and number of reviews (from Google, Trustpilot or Reco — always with the source stated) and an assessment of the website's/booking system's digital maturity, to show where our research actually found an opportunity. The fact concerns the company, not an individual — but for a sole proprietorship or a closely held company (a company with a small number of owners) this may in practice be a fact about the person running the business. The fact is sourced from the company's own profile on the review service or from its website, never from review text or other people's statements. We may also check whether the company has an official business page on Facebook and/or Instagram, and whether there is a clear sign of paid advertising in the company's name — never a private profile, never LinkedIn, and never how often the company posts or how many followers the page has. We may also look into whether the company currently uses a CRM system, or confirm that we found none — this fact is sourced only from a job ad on the Swedish Public Employment Service's (Arbetsförmedlingen) Platsbanken or the company's own careers page, from the company's own website, or from a vendor's published customer case study naming the company; never from LinkedIn and never from a people-search directory. A job ad that merely lists a CRM system as a nice-to-have does not count as confirmation that the company actually uses it. Beyond the sources above, we may also read the company's own website directly — a single fetch of the homepage, never a crawl of the whole site — for technical signs of a CRM system or a booking, marketing, support/chat, or lead-capture form tool (e.g. Calendly, Bokadirekt, Mailchimp, Zendesk, Intercom or Typeform). Such a booking, marketing, support or form tool is not a CRM system and is reported separately, as "existing systems". Before the page is fetched, we verify that the web address actually belongs to the company in question (against its organisation number or company name), to avoid a fact being mistakenly attributed to the wrong company.
  • For customers in the tradespeople/clinics/accounting vertical, we may also fetch the company's revenue and operating margin per year (up to five years), to show the company's growth. The fact concerns the company, not an individual — but for a sole proprietorship or a closely held company (a company with a small number of owners) this may in practice be a fact about the person running the business. The fact is sourced primarily from Bolagsverket's own, publicly filed annual reports. If that does not yield a usable figure, the revenue figure only (not operating margin) may instead be sourced from a public aggregator that republishes Bolagsverket's own figures — e.g. allabolag.se, ratsit.se, proff.se or bolagsfakta.se. Operating margin is always sourced only from Bolagsverket's own filings, the company's own published information, or news sources. Neither fact is ever sourced from a credit bureau such as UC, Bisnode, Syna, Dun & Bradstreet or Creditsafe.
  • For customers in the insurance vertical, we may fetch the company's revenue, operating margin and number of registered vehicles per year (up to five years), to show the size of the company and the scope of its operations — e.g. how much there is to insure. The fact concerns the company, not an individual — but for a sole proprietorship or a closely held company (a company with a small number of owners) this may in practice be a fact about the person running the business. The fact is sourced primarily from Bolagsverket's own, publicly filed annual reports. If that does not yield a usable figure, the revenue figure only (not operating margin or vehicle count) may instead be sourced from a public aggregator that republishes Bolagsverket's own figures — e.g. allabolag.se, ratsit.se, proff.se or bolagsfakta.se. Operating margin and vehicle count are always sourced only from Bolagsverket's own filings, the company's own published information, or news sources. None of these facts are ever sourced from a credit bureau such as UC, Bisnode, Syna, Dun & Bradstreet or Creditsafe.
  • For customers in the insurance vertical, we may, only for a Swedish housing cooperative (bostadsrättsförening, "BRF") and never for a limited company or other legal form, fetch the name of the cooperative's current property-insurance provider and compute a premium per square metre. The computation is done by dividing the cooperative's own insurance premium (SEK), as stated in its annual report, by the cooperative's own total residential and commercial floor area (sqm), stated in the same report — both figures are already public facts the cooperative is itself required to publish, and the computation adds no new fact beyond those two. When the prior year's premium is also stated in the same report, the percentage change is shown as well. The fact concerns the cooperative, not an individual board member — no individual is named in this fact. The fact is sourced exclusively from the cooperative's own, publicly filed annual report, never from a credit bureau or an aggregator such as UC, allabolag.se, ratsit.se, proff.se or bolagsfakta.se. In some cases our system downloads the cooperative's published annual report directly, rather than relying solely on a search engine — in that case, before anything is transmitted further, we read only the pages of the document that actually contain these facts, never the board roster or the signature page.
  • For the same customers, and only for the same type of housing cooperative, we may also fetch, from the cooperative's own annual report, the property's book value and/or assessed tax value, a fact about any insurance claim payment the cooperative received during the financial year (type of damage and amount, never a description of the event or which apartment or resident was affected), and a fact about a completed or planned major renovation (e.g. a pipe replacement, a roof replacement, or a façade renovation). If the same annual report also states the prior year's assessed tax value, the percentage change between the years is shown too, computed by us from the two public figures. These facts concern only the property and the cooperative, not an individual. Sourced exclusively from the cooperative's own public annual report, never from a credit bureau or an aggregator. As for the previous point, our system may in some cases download the annual report directly and in that case reads only the relevant pages before anything is transmitted further.
  • For customers in the preparedness vertical (e.g. Preppoint), we may fetch how many sites/units the company operates (e.g. number of facilities, offices or locations) and what can be found publicly about the company's current level of preparedness — an existing backup-power solution or continuity plan, or signs of a recent operational disruption. The fact concerns the company, not an individual — but for a smaller organisation this may in practice be a fact about the person running the business. The fact is sourced from the company's own website, annual reports, or news sources — never a guess. The fact is shown as one or two of the report's talking points, not in a separate box of its own.
  • For customers in the preparedness vertical, we may also, for each of five named dimensions from Preppoint's own public preparedness-index model (governing documents and plans, staffing, training and exercises, facilities and support systems, and leadership and coordination), state whether we found publicly evidenced facts within that dimension — never a score or level assessment, only whether evidence exists. Shown only when we found evidence for at least two of the five dimensions; otherwise a short timeline of the general buying signals the research was based on is shown instead. The fact concerns the company, not an individual — but for a smaller organisation, a lack of evidence in one dimension could in practice read as a judgement about the person running the business. The fact is sourced from the company's own website, annual reports, or news sources; for the staffing, leadership/coordination, and training/exercise dimensions it may also be sourced from a job ad (on Platsbanken, Arbetsförmedlingen, or the company's own careers page) for a preparedness coordinator/security manager/continuity manager role, or from a public procurement notice about a preparedness exercise or training — never a guess, and never under the name "Beredskapsindex", which is Preppoint's own trademark for its certified assessment.
  • If the customer leaves written feedback about a specific RBS — via a link in the delivery email, or via a field in the logged-in customer portal — that text, if it mentions you, may be used as input to improve future research results for that same customer. The text is automatically screened before being stored so that it does not contain sensitive personal data (e.g. about health, union membership or religion) — if such data is found, the text is not stored. The feature is disabled by default and enabled per customer.

Lawful basis: Legitimate interest (GDPR Art. 6(1)(f), recital 47 — direct B2B marketing between businesses) in enabling relevant, well-researched sales outreach. A balancing-of-interests assessment has been carried out and documented. A prospect may object to the processing at any time via sam@heqtic.se; objections are entered into our global suppression list, which stops all future collection and all further contact via us, and also means your name, title, and professional background are no longer shown or exported by us from any already-delivered RBS — the company-specific research otherwise (buying signal, analysis, etc.) remains. This is a block on what we ourselves display and export, not a deletion from the underlying record; a copy the customer has already downloaded or pushed into its own CRM (see section 2.5) is outside our control and unaffected. If you want the full record about you in an already-delivered RBS deleted entirely, request erasure (Art. 17) in the same email — please state your email address, phone number, or LinkedIn profile so we can find you.

A prospect outside Sweden. If an ICP concerns a prospect in another country — currently the United States — the underlying research is sourced through real-time web search for each individual research brief: the company's own website, news sources, and public LinkedIn profiles, the same way as for a Swedish prospect. Our enrichment partner FullEnrich (see above) is still used to try to verify a contact route, regardless of country. The continuous, automated collection from Bolagsverket's/SCB's registers, the Swedish Public Employment Service's JobTech/ Platsbanken, and the other sources described below — as well as the automated lookup of a Swedish switchboard number via Eniro's search API — is Swedish infrastructure: it does not cover, and would normally find nothing for, a prospect outside Sweden.

Source (Art. 14): Prospect data does not come from you but from publicly available sources — company websites, news sources and public LinkedIn profiles (collection via our sub-processor Unipile is disabled — see above); the Swedish Public Employment Service's JobTech/Platsbanken (job ads — for the preparedness vertical, ads are searched by free text for roles such as preparedness manager, preparedness coordinator, or security coordinator, rather than an occupation category); press and news feeds (RSS) and Google Alerts; Bolagsverket and SCB (for industry code and business activity on companies we already know of); as well as Bolagsverket's and SCB's weekly-published register of all Swedish companies (an open bulk file, not a search — we use it to ourselves discover newly registered companies within the industries we monitor — restaurant and hospitality, construction and installation, cleaning and moving services, wellness and physiotherapy, accounting and training, construction and civil-engineering contracting, transport and logistics, property management, housing cooperatives, and, for the preparedness vertical, residential health and social care, open social services and preschool activities, wholesale food trade and certain food production, digital infrastructure (telecommunications and data operations), banking, and freight and public transport — limited to companies registered within the last three months. Sole proprietors are not included: rows whose identity is a personal identity number rather than an organisation number are filtered out before anything is stored. On one occasion we also used the same bulk file to supplement our database, for the rest of Sweden, with already-existing — not only newly registered — active companies within the industries we monitor (this does NOT apply to construction and civil-engineering contracting, transport and logistics, property management, housing cooperatives, or any of the preparedness vertical's industries — for those, only ongoing collection of newly registered companies occurs, no one-off backfill of already-existing companies); limited to companies and similar legal entities registered under the industry codes we monitor (a narrower, per-code scope than the broader food-business concept the municipal registers below cover for Gothenburg — see above for which industries apply); the same selection and exclusions apply: sole proprietors are excluded and a registered no-marketing flag is respected); and, for customers in the tradespeople/clinics/accounting vertical, Bolagsverket's own, publicly filed annual reports for companies we already know of (we review companies within the industries we monitor for this vertical — see above — and check whether a documented revenue increase exists, to prioritise which companies are researched further; no new kind of fact is fetched compared to what is already described above about the company's revenue and growth, just a broader, systematic selection of which companies the fact is fetched for); as well as, for customers in the insurance vertical, the same kind of review of Bolagsverket's own, publicly filed annual reports for companies we already know of (we review companies within the industries we monitor for this vertical — see above — and check whether a documented revenue increase or decrease exists, to prioritise which companies are researched further; no new kind of fact is fetched compared to what is already described above about the company's revenue, growth and any decrease, just a broader, systematic selection of which companies the fact is fetched for); as well as municipal open registers of food businesses and serving permits (e.g. the City of Gothenburg — business activity, address, permit type and permit holder; for a sole proprietorship the permit holder is a natural person); as well as the Region of Västra Götaland's open register of hospitality businesses (name, visiting address and locality for companies in the region's hospitality sector — the industry is not stated in the source and may concern e.g. restaurants, cafés, hotels, activity companies or museums; for a sole proprietorship the company name is a natural person); as well as, for customers in the preparedness vertical, Kolada's (the Swedish Association of Local Authorities and Regions' open database) national register of Swedish municipalities and regions (name and official registration number at Kolada for the country's 290 municipalities and 21 regions — a public list of organisations, never natural persons); as well as, for the same vertical, the EU's public-procurement notice database (TED) (notice title, publication date, and the name and organisation number of the procuring organisation, for procurements mentioning e.g. backup power, continuity planning, or crisis preparedness — a public notice published by the municipality, region, authority, or company itself). For verified contact details we use our enrichment partner FullEnrich; if it finds nothing, one of our staff may in exceptional cases manually confirm a name via Ratsit, or a phone number via Eniro or Mrkoll — public directory services a human looks up in their own browser, never fetched automatically by our code; only the name or number itself is entered into the research, no other facts from the page. Beyond this manual step, our system automatically looks up the company's published switchboard number via Eniro's own search API (company search) and stores it as a clearly labelled, alternative contact route, regardless of whether a personal phone line has already been found; the number is never presented as a direct line to a named person. Beyond this, our system may also automatically look up a named contact person's phone number via Eniro's person search (Person Search) — but only for a contact we have already identified through our own research, never to select which people or companies to contact in the first place. Such a number is labelled in the research as a separate source and treated as a possibly private phone line. Some of this collection happens automatically and on an ongoing basis; you may object to the processing at any time (see above). Beyond this manual name/phone lookup, Ratsit, allabolag.se, proff.se and Bolagsfakta.se are used separately and automatically, by our AI model's own search function — not by a staff member — but only for one narrow, specific fact: the company's revenue, when this cannot be fetched directly from Bolagsverket (see above about the insurance vertical and about buying signals based on a change in revenue — growth or decrease). No other fact from these pages is collected in this automated way.

Recipients (Art. 14(1)(e)): The data is disclosed to the customer who receives the RBS delivery, and that customer becomes an independent data controller for their own copy. In exceptional cases the research was produced before the recipient became our customer (e.g. ahead of a sales conversation) — the same kind of recipient, the same lawful basis, and the same safeguards (including a suppression check) apply even then. If the customer has connected their own CRM system, the data is also sent there — in some cases automatically for every delivered RBS, if the customer has chosen that (see the integrations page). The copy covers name, title, employer, work email and phone, LinkedIn profile, the buying signal, the way in (see above — may name a colleague at the same company), the sales-facing analysis (why the company is a fit, angle and objections) and the sources the research is based on (links to public pages), as well as the entire RBS as a PDF file.

In rare cases we show, one RBS at a time, a redacted excerpt to a prospective Heqtic customer, as an example of what an RBS looks like — at most 5 distinct RBSes per internal test delivery in total. The company's and contact person's names, and contact routes (LinkedIn, email address, phone number), are hidden behind a blank, unreadable box wherever they occur, including in the body text — there is no real text behind the box to recover. The contact-details box can still show THAT a verified email address or a published phone number was found for the person (with the same labelling as in a real RBS), without showing the address or number itself. Sources are not shown at all. The "way in" (see above) is never shown in the excerpt, not even hidden behind a box — it is omitted entirely, since it is itself either a contact route or, in the exceptional case, a private fact. Other content — the decision-maker's position/title, a short explanation of why that person is relevant (e.g. role, background, public statements), the buying signal, the sales-facing analysis, company facts (industry, size, revenue, location) and the talking points — is shown largely unredacted, including exact dates and quotes, to show that the research is real and concrete. The draft of the first email is shown the same way when it exists, but is no longer included in every RBS; a separate AI-model review additionally looks for and hides, the same way, the names of other identifiable people or companies appearing in the text (e.g. a quoted executive or a named competitor). Despite this, individual facts — e.g. an unusual combination of title, industry, size and location — may in exceptional cases make it possible to work out which company or person is involved. This only applies to research produced for an internal test delivery (never a paying customer's own delivery), requires an extra login verification every time, is reviewed by a human before the file is sent, and is logged in full. You may object to this the same way as to other processing (see above).

We also use Anthropic (AI generation), Supabase (storage), FullEnrich (contact details) and, if the customer has enabled an optional email notification for approved RBSes, Resend (email delivery — the receiving customer's account owner, and where applicable an additional recipient per the customer agreement § 6 and section 2.6a below, then each receive their own email per approved RBS, each with the company name, a link, and a download link to the PDF which is not time-limited but stops working no later than when the RBS is withdrawn, when we have entered an objection or erasure request into the suppression list (section 4), or when the contact details age out of the material (section 3, normally 12 months after delivery) — whichever happens first) as sub-processors — see the sub-processor page and section 2.5 below for the full picture. If you object or request erasure, we notify the customers who received your data (Art. 19). Each such email also contains a short sentence about which type of buying signal is involved, e.g. "a new hire" or "a leadership change" — never figures, dates, or anyone's name, and always chosen from a small, predetermined list of nine categories; if we do not recognise the category, a fully generic sentence is shown instead that does not name the type of signal.

2.3 Audit log

We log every administrative action on customer data (generations, approvals, edits, deletions, exports). The log contains a timestamp, the actor's identity, the action, and the target ID.

Lawful basis: Legal obligation (GDPR Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) in traceability under NIS2 Art. 21.

2.4 Optional mailbox integration (not in use)

This feature has been disabled since 12 August 2026 and cannot be enabled by you as a customer. No mailbox is connected and no personal data is sent to Unipile. The description below describes how the feature works if we enable it again, which we will not do until a processing agreement with Unipile is in place — and we will update this page before that happens.

If you as a customer choose to connect your email (Gmail or Outlook) — no such feature currently exists in the product — it is connected via our sub-processor Unipile. We then receive a signal when you send an email to a prospect, and when the prospect replies, so that the corresponding RBS is automatically updated to Contacted or Replied respectively. We never store the email texts themselves — only the sender/recipient address and the time are used to match the correct RBS. An incoming reply is briefly reviewed locally by us (no email text is sent to any external service) solely to distinguish a genuine reply from an out-of-office message, and is then discarded. If a reply looks like an unsubscribe request it is flagged for you — acting on the request is your responsibility as data controller; it does not affect Heqtic's own suppression list. The integration is entirely optional and can be disconnected at any time — today on request to us, at which point the connection to Unipile is ended.

Lawful basis: For this processing, Heqtic acts as a data processor on your behalf as a customer (you are the controller for your own inbox), under a data processing agreement between you and us (GDPR Art. 28). A complete chain of agreements — including a processing agreement with Unipile as a sub-processor — is a precondition for the feature to be enabled, and does not yet exist.

2.5 Optional CRM and webhook integration

If you as a customer connect your own CRM, RBSes can be transferred there — either when someone at your company sends an individual RBS, or automatically on every delivery if you have chosen that. That automation is disabled by default, can be switched off at any time, and is reset if you disconnect or change CRM; if it is on, your CRM receives a copy of every contact, including those nobody at your company gets to work with.

What is transferred is the company name, contact details (name, title, email, phone number, LinkedIn), the buying signal, the sales-facing analysis (why the company is a fit, angle and objections) and the sources the research is based on, as well as — on the first transfer of an RBS — the entire RBS as a PDF file, with the same material you see in Heqtic, including contact details. The file is uploaded as a private file, never to a public file library.

The recipient is your own CRM account, not a sub-processor of Heqtic — see the sub-processor page for the full reasoning. Once the data has landed there, you are an independent data controller for that copy, including for deleting notes, free text and attached files.

If you instead, or in addition, connect your own webhook, we similarly post every RBS as structured JSON to a URL you specify yourself — optional and disabled by default. The content is the same as the CRM transfer above, plus the entire RBS as a PDF (when one is stored) in every call. A link to the same PDF is also included, for whoever opens your own record later. The link requires no login with us — anyone with the URL can open the material. The link stops working no later than when the RBS is withdrawn, when we have entered an objection or erasure request into the suppression list (section 4), or when the contact details age out of the material (section 3, normally 12 months after delivery) — whichever happens first. The recipient is your own system, not a sub-processor of Heqtic, the same way as the CRM above; see the customer agreement § 6 and the integrations page for the full description.

If you also enable Automatic status update, we read, at most once per day, whether the deals Heqtic itself has created in your CRM have been marked won or lost, and update the status on the corresponding RBS. If you have, for Pipedrive, also chosen which pipeline stage means "Contacted", we also read at the same time whether the deal is in that stage and mark the RBS as contacted. We only fetch this outcome value — and for Pipedrive, where applicable, which of the two stages you chose the deal is in — never contacts, notes, activities, emails or other fields — and never deals you created yourself. The outcome value (and any contacted mark) is stored by us linked to the relevant RBS and is subject to the same deletion and retention period as the RBS otherwise. Both features are optional, disabled by default, and can be switched off at any time.

If you enable Exclude companies you already work with, we read, before every delivery, the company/ organisation names in your CRM, to avoid suggesting such a company as a new prospect. We only read the names of established company records — never contact persons, deal values, notes, or an individual deal's own name, not even for an ongoing deal. The names are never stored by us: they are read before every delivery and discarded immediately after use, and in that case are included in the material sent to our AI provider for that specific generation. The feature is optional and disabled by default.

Which CRM systems are supported, exactly what is written where, and which settings exist are described together on the integrations page, which is kept up to date as the service develops. The terms for the integration are in the customer agreement § 6.

Lawful basis: Legitimate interest (GDPR Art. 6(1)(f)) in being able to deliver and follow up on the RBS you ordered, with the same balancing-of-interests assessment as for prospect data generally (section 2.2). The source of the outcome value and any contacted mark (Art. 14(2)(f)) is the customer's own CRM.

2.6 Team members at a customer

A customer company may have several logins: the person who signed the agreement (the account owner) and the colleagues the account owner has allowed to be added. If you were given a login by your employer, this section applies to you — and you have not provided your own data to us, so we want to be clear about what we have and why.

  • What data: your work email address, an optional free-text label for your role (e.g. "Salesperson") that your employer or we may have set, and a record of who added you and when.
  • Where from (Art. 14(2)(f)): from your own employer — the person at the customer who signed the agreement, or Heqtic at their request. The data therefore does not come from you.
  • What we use it for: to give you access to the service your employer purchased, and to be able to show afterwards who did what on the account.
  • Who sees it: the other logins on the same customer account see your email address in the team list under Settings. This is intentional — you share an account — but it means your colleagues can see that you have access. Beyond them, Heqtic's administrators have access.
  • What is logged about you: when you do something that changes something on the account, a row is written to our audit log with your email address as the actor. If you mark an RBS as contacted, your address is stored on that RBS.

Lawful basis: Legitimate interest (GDPR Art. 6(1)(f)). You are not a party to the agreement between Heqtic and your employer, so we cannot rely on the contract where you are concerned. The interest is letting your employer's own staff use a tool purchased for them; the fact is a work email address and nothing more, and it was provided by your employer. We have weighed this against your privacy interest and judged the intrusion to be small.

Your rights — and one thing worth knowing. For as long as you have a login, you can obtain an export and request erasure of your own data directly in the app, under Settings → My data. Your access is, however, controlled by your employer's account owner, not by us: they can remove you at any time and without notifying you first, and your self-service route then disappears too. This does not remove your rights. Email sam@heqtic.se and we will handle the request manually — this applies even if you have already been removed. To object to the processing (Art. 21), do so to us at the same address.

Note that the customer's deliverables are not your personal data — they are the customer's data about third parties. An access request from you covers your login, your row in the team list, your audit-log rows, and the RBSes that carry your name, not the company's RBS material at large.

2.6a Recipient of an email notification, without their own login

At an account owner's request, we can add a further named person who receives the same email notification about new RBSes as the account owner does — without that person getting their own login with us (see the customer agreement § 6). This section applies to you if you receive such an email but have never logged in with us.

  • What data: your email address, and a short note on our side on how and when you confirmed you want the notification.
  • Where from (Art. 14(2)(f)): from the account owner at your employer, or from Heqtic at the account owner's request — not from you yourself, even though it is you who confirmed you want the emails.
  • What we use it for: solely to send you the email notification the account owner requested, including the download and reply links it carries under customer agreement § 6. The email also contains a short sentence about which type of buying signal is involved (e.g. "a new hire") — never figures, dates, or anyone's name, and always chosen from a small, predetermined list of categories; if we do not recognise the category, a fully generic sentence is shown instead that does not name the type of signal. This fact concerns the prospect, not you — see section 2.2 for the prospect's own lawful basis.
  • Who sees it: Heqtic's administrators. The account owner can see that such a recipient exists by requesting an export of their own account data (section 2.2), but does not see the address in any list in the service today.

Lawful basis: Legitimate interest (GDPR Art. 6(1)(f)) — you are not a party to the agreement between Heqtic and your employer, so we cannot rely on the contract where you are concerned. The interest is being able to send you a notification you yourself asked to receive; the only data we process about you is your email address and the note above about your consent to the notification. We have weighed this against your privacy interest and judged the intrusion to be small.

Your rights: You have no login of your own and therefore no self-service route in the app. Email sam@heqtic.se to see, correct or delete your data, or to ask us to stop sending the notification (Art. 21) — we will remove you from the recipient list and confirm once it is done.

2.7 Heqtic Pipeline (our own CRM tool)

Heqtic Pipeline is our own tool, built and operated by us, that some customers can work in — a kanban board, notes, tasks, and per-salesperson assignment — to work their delivered RBSes without leaving Heqtic. Unlike the CRM connection in section 2.5, this is not an account you connect yourself: it is our own infrastructure, and a delivered RBS is automatically mirrored there for customers who have the feature. The feature is currently offered selectively, not to every customer — if your account has not been given access to it, no such copy exists. Anyone working on the account can enable it themselves under Settings → Integrations, independent of whether the account also has its own CRM connection (section 2.5) running — both can be active at the same time, and a delivered RBS is then mirrored to both.

Two layers, two roles. The RBS material itself that is mirrored in (company name, contact details, buying signal and analysis) is the same data, on the same lawful basis, as described in section 2.2 — Heqtic is the data controller for it regardless of which of our tools you read it in. What is new is the operational layer your own salespeople create on top of it — which column a card is in, who it is assigned to, and the notes and tasks a salesperson writes. For that layer, Heqtic processes the data on your instruction, as your data processor — see customer agreement § 4a, which governs this directly (no separate agreement to accept).

Exclude companies already in Heqtic Pipeline. If the account has Heqtic Pipeline enabled, any of your users may switch on or off whether we, before every new delivery, read the company names on your Pipeline board — including companies you have added yourself as your own leads — to avoid suggesting such a company as a new prospect again. The feature is enabled by default for as long as Heqtic Pipeline is enabled for the account. Unlike the rest of the operational layer, where Heqtic is your data processor, Heqtic is, for this specific read, an independent data controller — the same basis and the same principle that applies to the corresponding feature for your own external CRM (section 2.5, "Exclude companies you already work with"). We only read company names — never contact details, notes, tasks, or who a card is assigned to — and the names are never stored by us beyond the Pipeline board itself: they are read before every delivery and discarded immediately after use, and in that case are, like the rest of the research material, included in what is sent to our AI provider for that specific generation.

Storage and deletion: a card in Heqtic Pipeline follows the same lifecycle as the RBS it mirrors — if the RBS is withdrawn, deleted, or its contact details age out (section 3), the same happens to the card in Heqtic Pipeline.

Lawful basis: for the research content, legitimate interest (GDPR Art. 6(1)(f)), the same balancing assessment as section 2.2. For the operational layer your own salespeople create: Heqtic's processing happens on your instruction as data processor, under your own lawful basis as controller for that part — except for the company names in the exclusion feature above, where the basis is instead legitimate interest (GDPR Art. 6(1)(f)), the same balancing assessment as sections 2.2 and 2.5.

3. Retention periods

  • Active customer accounts: for as long as the agreement runs. The account is not deleted automatically when the agreement ends — it remains until you request deletion, so you have time to retrieve your deliverables (customer agreement § 8). If you request deletion, we remove the account, logins, ICPs and deliverables, except the billing details that constitute financial records. Those we must, under Swedish bookkeeping law, retain for 7 years after the end of the financial year the invoice concerns.
  • Contact details in a delivered RBS: every contact route to the decision-maker is automatically cleared 12 months after delivery, even if the delivery itself is kept longer — this covers the verified data we obtained via our enrichment partner FullEnrich (email address, phone number, LinkedIn URL), contact routes the research itself quoted in the analysis text (e.g. a switchboard number), and any guessed email address the analysis text itself suggests based on the name and the company's address pattern. The decision-maker's name and the substantive analysis remain. If you want everything about you removed, not just the contact routes, use the right to erasure below (section 4).
  • ICP and RBS deliveries: by default 24 months from the most recent delivery (3, 6 or 12 months can be agreed instead). Each new delivery on the same ICP restarts the period, so an ongoing subscription is not deleted mid-way. When the period expires, a nightly cleanup automatically deletes the ICP and all RBSes under it — this cannot be undone. An ICP that has never been delivered has no such end point: it remains for as long as the customer relationship exists (its un-reviewed drafts are cleared after about 6 months), and is removed when the account is deleted.
  • Prospect data: the same retention as the corresponding ICP.
  • Prospects in Heqtic's own lead generation: automatically deleted after about 18 months without activity. If you have booked a meeting with us, or replied so that contact was taken forward manually, the data is kept longer — but not permanently: about 24 months from the meeting, or the most recent event for that contact, whichever is later, after which it is deleted by the same nightly cleanup.
  • Signal archive and company enrichment: dated buying signals and fetched register data (SNI, etc.) are automatically purged after a set period by a nightly cleanup, and deleted immediately on a valid objection or erasure request.
  • Mailbox events: matching data (address + time) from the optional mailbox integration is deleted after about 6 months, and immediately on deletion of the account or the relevant prospect.
  • Team members at a customer: the data remains for as long as you have a login on the customer's account. If the account owner removes you — or the whole customer account is deleted — your row in the team list and your login are removed at the same time. Your rows in the audit log are exempt and remain per the point below; if you request erasure, your email address is instead pseudonymised on the RBSes you have worked on, so the customer can see that someone worked on the prospect but no longer who.
  • Audit log: rows are kept for about 24 months in the live log for NIS2 traceability; older rows are then archived (moved to secure storage, not deleted).
  • Suppression list: retained permanently to guarantee that an objection is respected even in future searches.

4. Your rights

Under GDPR Chapter 3 you have the right to:

  • Find out what data we hold about you (Art. 15).
  • Have incorrect data corrected (Art. 16).
  • Have data erased (Art. 17).
  • Restrict the processing (Art. 18).
  • Have your data transferred to another provider (Art. 20).
  • Object to processing based on legitimate interest (Art. 21).
  • Lodge a complaint with the supervisory authority, the Swedish Authority for Privacy Protection (IMY), imy.se — Heqtic's own supervisory authority, since Heqtic is established in Sweden. If you live in the EU/EEA, you may instead lodge a complaint with the supervisory authority in your own country (GDPR Art. 77(1)); this notice names IMY because it is the one that applies to Heqtic either way.

Logged-in customers obtain exports and request erasure in the app, under Settings → My data. All other requests should be sent to sam@heqtic.se. We respond within 30 days (Art. 12(3)).

5. Sub-processors and data transfers

We use a small number of sub-processors for hosting, database and AI. The ones most relevant to prospect data specifically, summarised here in English because this is the information a non-Swedish-reading data subject needs most under Art. 14(1)(f):

  • Supabase (database and file storage) — EU (Frankfurt). No third-country transfer.
  • Vercel (application hosting) — EU (Stockholm) for server execution since 2026-08-17; global edge delivery network.
  • Anthropic (Claude) (the AI model used for research and RBS generation) — United States. Transfer safeguard: the EU Commission's Standard Contractual Clauses, EU-module based.
  • FullEnrich (contact enrichment — verified email and phone number) — United States. The vendor is established in the US. Transfer safeguard: Standard Contractual Clauses, Module 2 (and Module 3 for the vendor's own onward transfers to its sub-processors).
  • Resend (email delivery, for account emails and the optional delivery-notification channel) — EU.
  • Unipile (the optional LinkedIn-signal and mailbox features described in sections 2.2 and 2.4) — not currently in use; no personal data is sent to this vendor today.

For the full list — including vendors relevant mainly to Heqtic's own billing and scheduling rather than to prospect data, and the detailed reasoning behind each transfer safeguard — see the list of sub-processors (Swedish).

6. Security

Technical and organisational safeguards are described on our security page.

7. Changes

This policy is updated as needed. For material changes, we notify logged-in customers by email at least 14 days in advance.