Legal
Privacy Policy.
Heatrail wears two hats, and confusing them is how privacy policies go wrong. For our own business contacts and portal accounts we are the controller. For the checks a shop runs at its checkout we are only the shop’s processor, and if you are a shopper, the shop is who you talk to.
Document
Version 1.1
Published 4 September 2026
Controller: Heatrail OÜ
Contact: privacy@heatrail.eu
Read first
Roles
Which hat we are wearing.
Everything in this policy depends on one distinction, so it comes first. Find your situation in the table and follow it.
- You visit this website, or write to us
- Heatrail OÜ is the controller. This policy is the notice for that processing, sections 2 and 3.
- You hold or apply for a partner portal account
- Heatrail OÜ is the controller of your account, billing and agreement records, section 4.
- Your shop sends checks to Heatrail
- Your business is the controller and Heatrail is your processor. We act only on your documented instructions under the Data Processing Agreement, which you conclude at registration. Section 5 summarises it, but the agreement itself is the operative text.
- You bought something from a shop that uses Heatrail
- The shop is your controller, not us. Exercise your rights with the shop you bought from. It is your single point of contact and it holds the raw e-mail address or phone number that we deliberately never receive. What we process for the shop is set out in plain language on the customer disclosure page, which is published for exactly this audience.
This website
Visiting this website.
This site sets no cookies. No analytics, no tag manager, no A/B testing, no advertising pixels, no session recording. The site ships one small JavaScript bundle: the pricing calculator, which computes in memory and writes nothing anywhere, and the pre-launch access gate, which writes a single sessionStorage entry, the literal value open, cleared when you close the tab, once you have entered the access password, so that moving between pages does not ask again. That entry is strictly necessary for something you asked for, which is why there is still no consent banner. The Cookie Policy sets it out in full.
Server logs. The site is a set of static files. Serving them means the hosting provider processes the request, IP address, user agent, the URL requested, the time, to deliver the page and keep the service available and secure. That is ordinary web-server processing on the basis of our legitimate interest in running a website (Article 6(1)(f) GDPR). We do not build profiles from it and we do not join it to anything else.
Google Fonts, and its removal. Until 4 September 2026 the typefaces on this site came from Google’s font service, so your browser contacted fonts.googleapis.com and fonts.gstatic.com and your address was disclosed to Google in the course of that request. For a company that argues about data minimisation for a living that was the wrong default, and it is gone: the font files are served from this domain and the content security policy on every page permits this origin only. We are leaving this paragraph here rather than quietly deleting it, because anyone who read the old one deserves to see what happened to it.
Correspondence
Writing to us.
If you write to hello@heatrail.eu, security@heatrail.eu or privacy@heatrail.eu, we process what you send: your name and e-mail address, your company, and the contents of the exchange.
We use it to answer you and to keep a record of what was agreed or reported. The legal basis is our legitimate interest in responding to enquiries and in keeping a record of security reports (Article 6(1)(f)), or the steps taken at your request before entering into a contract (Article 6(1)(b)). We keep correspondence for as long as the matter is live and afterwards for as long as we may need it to establish or defend a legal claim.
Please do not send personal data about your own customers by e-mail. If a matter requires a specific identifier, we will tell you how to send it in the hashed form the service actually uses.
Accounts
Partner portal accounts.
The partner portal is a separate application with its own database, deliberately isolated from the service’s engine room: portal code cannot reach the ledger, the scoring rules or operator accounts. Here is what it holds about the people who run a partner account, and why.
- Account and business details
- Login e-mail address, a hashed password, business name, registry code, shop domain, e-commerce platform and a contact e-mail address. Purpose: providing the service and reviewing the business before approval. Basis: performance of the contract, Article 6(1)(b).
- Agreement records
- For each acceptance of the Terms and the Data Processing Agreement: the document key and version, the SHA-256 digest of the exact text shown, how it was accepted, the time in UTC, the IP address and browser client it came from, and a snapshot of the business name, registry code, domain and login e-mail as they stood at that moment. Purpose: proving what was agreed, by whom, and when. Basis: our legal obligation to be able to demonstrate a written Article 28 agreement, and our legitimate interest in being able to establish or defend a legal claim. These records are written once and never updated by the application.
- Billing
- A Stripe customer identifier, subscription status, the card brand and last four digits as metadata, and the number of billable orders per shop per day. Card details never reach Heatrail. They are entered on Stripe’s own pages. Basis: performance of the contract, and our legal obligation to keep accounting records.
- Sign-in sessions
- A session record holding the IP address, the browser user agent and the time of last activity, plus the strictly necessary session and CSRF cookies described in the Cookie Policy. Purpose: keeping you signed in and protecting the account. Basis: performance of the contract and our legitimate interest in security.
As processor
Shop-customer data: our role as processor.
When a shop’s checkout sends a check, the shop is the controller and we process on its documented instructions. The Data Processing Agreement is the operative text and the customer disclosure page is the plain-language version written for shoppers. In summary, and consistent with both:
What we receive. Irreversible hashes of e-mail address and phone number, computed in two stages, the first in the shop’s own server, so the raw address and number never reach us, and the second with a keyed hash of our own before anything is stored. The IP address. General order characteristics: amount range, product risk class, quantity, account-age class and referral source class. An order reference and a session pseudonym. Where the shop has switched that layer on, general technical characteristics of the device.
What we never receive. Names, postal addresses, payment instrument data, the contents of an order, or raw contact details. The API rejects fields outside its allowlist rather than quietly storing them.
What we do with it. One purpose: preventing and detecting payment fraud. We return an advisory score and reason categories. We never decide anything about an order, and the design makes it impossible for us to block, delay or cancel a purchase. Where a shop confirms fraud, the hashed trace contributes to the shared signal, and a single shop’s label alone can never raise the network-level signal another shop sees.
How long. Ninety days for signals, then automatic deletion. Derived heat counts towards a score for up to 400 days, at full weight for the first 90 and then falling to a third by day 365. Evidence of confirmed fraud may be kept longer where it is needed to establish or defend a legal claim, under Article 17(3)(e) GDPR, as a documented decision with a stated limit rather than as a default.
Recipients
Recipients, sub-processors and transfers.
We do not sell personal data and we do not share it for anyone else’s marketing. The complete list of third parties is short enough to print.
- Laravel Cloud
- Application hosting, managed Postgres, key-value store and queue workers, the platform the service and the portal run on, in the eu-central-1 region in Frankfurt.
- Amazon Web Services
- The compute, storage and network beneath Laravel Cloud, including database backups, which run with seven-day retention and point-in-time restore. Same region, eu-central-1 in Frankfurt.
- The complete sub-processor list
- Those two, and no others, for the personal data we process on behalf of shops. AWS is listed in its own right rather than folded into Laravel Cloud, so that this list and the trust center give a procurement questionnaire the same answer. Stripe below is not a sub-processor under a shop’s data processing agreement, for the reason that entry gives, and Google Fonts is no longer in the page at all.
- Stripe
- Payments and subscription billing for partner accounts only, our own business relationship with you, never shop-customer data. Card details are entered on Stripe’s pages and held by Stripe. We receive an identifier, a status and the card’s brand and last four digits. Stripe operates globally, and its own privacy policy and transfer safeguards govern that processing, we link to them rather than paraphrase them.
- Google Fonts, removed 4 September 2026
- This website only, and only for typefaces. Until 4 September 2026 your browser’s request for them disclosed your IP address and user agent to Google. They are served from this domain now and that request no longer happens, so Google is not a recipient. The row stays rather than disappearing, because a reader who saw the old one is entitled to know what changed, see section 2.
- Transfers outside the EU
- Personal data processed on behalf of shops stays in the European Union. It is stored in Frankfurt and is not transferred outside the EU or EEA. If that ever needs to change, the Data Processing Agreement requires us to put the safeguards the GDPR demands in place and to inform the controller first. Our own billing relationship with Stripe is the exception to the EU-only picture, and it is confined to partner-account data.
- Authorities
- We disclose data to a public authority only where the law obliges us to, and we do not send automated notifications to law enforcement, regulators or partners. Where an operator prepares a memorandum about a fraud pattern, it is a draft that a person reviews and sends, never something the system sends by itself.
Retention
Retention.
- Checks
- Up to 90 days, then deleted by a nightly purge. Records linked to an active, unreversed confirmed-fraud or chargeback outcome are the exception, see the row below.
- Derived heat
- Up to 400 days, at full weight for the first 90 and then falling to a third by day 365.
- Confirmed-fraud evidence
- Kept beyond 90 days where it is needed to establish, exercise or defend a legal claim and for the legitimate interest in preventing fraud (Article 17(3)(e) GDPR with Recital 47). Each such retention is a documented decision with a stated limit, taken with the controller, not an open-ended default.
- Ledger and audit records
- The append-only integrity chain and the operator audit trail are never deleted. Nothing in the service deletes or rewrites them, and any modification would be detected by the nightly chain walk and signed anchor. They are minimised by design and hold only opaque references: identifiers of records, order references, hash prefixes, event metadata. Never raw identifiers. Once the record a ledger entry points at has been purged, the content is gone while the proof that nothing was rewritten remains.
- Portal accounts
- While the account exists, and afterwards for as long as we need to establish or defend a legal claim.
- Agreement and accounting records
- Acceptance records are kept as evidence that a contract was concluded. Estonian accounting law requires accounting records to be kept for seven years.
- Correspondence
- While the matter is live, and afterwards for the limitation period.
Your rights
Your rights, and where to exercise them.
If you are a shopper, go to the shop you bought from. It is your controller and your single point of contact, and the routing is practical as well as legal: we never hold your e-mail address or phone number, so we cannot look you up from one. The shop normalises and hashes the value on its side and forwards the request, and we assist under the Data Processing Agreement and execute the controller’s decision. If you contact us directly we will not ignore you. We will tell you in writing to route it through the shop, and tell the shop the same day.
One limit on erasure. Where data is linked to an active, confirmed fraud or chargeback outcome, an erasure request may be refused under Article 17(3) GDPR. That refusal is not automatic and it is not a shrug: it is a written weighing decision recording the legal basis and the retention limit, returned to the controller with reasons so it can be relayed and, if you disagree, challenged. Everything not linked to confirmed fraud is deleted on request.
If you are a portal user, a business contact, or you wrote to us, write to privacy@heatrail.eu. You have the rights of access, rectification, erasure, restriction of processing, objection, and portability where it applies. We may ask you for information to establish that the request is yours. The GDPR gives us one month to respond, and allows us to extend that where a request is complex. We will tell you if we need to.
Complaints. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), our supervisory authority, or to the supervisory authority of the EU country where you live or work. We would rather you told us first, but that is your choice and not a precondition.
We have not appointed a data protection officer, and we are not required to. The contact point for anything in this policy is privacy@heatrail.eu.
Security
Security.
The measures are described where they can be checked rather than asserted: encrypted transport, signed API requests with replay protection, two-stage hashing so raw contact data never arrives, an append-only ledger built as a hash chain with a nightly Ed25519 anchor and a nightly verification tripwire, so that any modification is detectable, which is the claim we make rather than that modification is impossible, two-factor authentication on operator accounts, and an audit trail of operator reads and actions. Section 5 of the Data Processing Agreement commits to them, and the security page describes the architecture and its limits.
Our controls are mapped to OWASP ASVS Level 2. If a personal data breach occurs we notify the affected controllers without undue delay after becoming aware of it, and we notify the supervisory authority and data subjects where the GDPR requires us to.
Changes
Changes and contact.
A material change to this policy is published here as a new version with a new date, and where it affects an agreement you have already accepted you are asked to accept the new version in the portal before continuing to use the service. We do not edit a published version in place.
That is the rule that produced version 1.1, of 4 September 2026: version 1.0, of 1 September 2026, listed Google Fonts as a recipient of your IP address and user agent, and on 4 September 2026 the typefaces moved to this domain, so section 2 and the recipients list in section 6 now record both the old behaviour and its removal.
- Controller
- Heatrail OÜ · Registry code 16731349
Mõisa 4, 13522 Tallinn, Estonia - Data protection contact
- privacy@heatrail.eu
- Version
- 1.1, published 4 September 2026
The page your customers can read.
The customer disclosure page is written for shoppers, not for lawyers, and it is deliberately self-contained: no scripts, no database, no dependencies, so it renders even when everything else is down. Link to it from your own privacy notice if it helps.