Privacy Policy
Herovant is a workspace for freelancers and small agencies to run client work: clients, projects, tasks, proposals, deliveries, file uploads, invoice and payment tracking, a client portal, a public profile and the Find a Hero directory. This policy explains what personal data we handle to provide it, why, who else sees it, how long we keep it and what rights you have.
Who is responsible
The data controller is Ali Yalınkılıç, sole operator of Herovant, Türkiye (“Herovant”, “we”, “us”).
- General questions and support: support@herovant.com
- Privacy questions and data requests: privacy@herovant.com
For the content that customers put into their workspaces (for example information about their own clients), the customer decides why and how it is used and Herovant acts as a processor on the customer's behalf. If you are a client of a Herovant customer and have a question about your data, please contact that customer first; we will help them to answer you.
What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Waitlist | Email address, language, profession, team size (optional), the source and campaign (UTM) parameters of your visit, the version of the consent you gave, and whether you confirmed your email and were invited. | You, when you join the waitlist. |
| Account | Name, email address, password (stored only as a salted hash), two-factor authentication settings, language and workspace preferences. If you use Google sign-in: your Google account identifier, name and email address (no other Google data). | You, and Google if you choose it. |
| Workspace content | What you and your team enter or upload: clients and their contacts, projects, tasks, comments, proposals, deliveries, extra-work requests, invoice and payment tracking records, files and their previews, portfolio items and testimonials. | You, your team members and the clients you invite to the portal. |
| Public profile and enquiries | What you choose to publish on your public profile, and messages or reports that visitors send through the profile's forms (including the contact details they type in). | You, and visitors to your profile. |
| Billing | Your plan and subscription status, billing email, and identifiers and invoice details from Lemon Squeezy. We do not receive or store your full card number. | You, and Lemon Squeezy. |
| Security and technical data | Sessions (with IP address and browser user agent), security events such as sign-ins, failed sign-ins, two-factor changes and rate-limit hits (stored with a hashed email and a keyed hash of the IP address, plus the user agent), request logs at our hosting and network providers. | Your device and browser. |
| Email and notification records | The notifications and emails we send you (for example reminders, invitations, receipts of activity), their delivery status and bounce or complaint signals from our email provider. | Generated by the service. |
| Website analytics (public website only) | If you accept analytics cookies on herovant.com: pseudonymous identifiers, pages viewed, approximate location, device and browser information, and (Microsoft Clarity) interaction data such as clicks and scrolling and session recordings of how you use the marketing pages. Never collected inside the Herovant app or the client portal. | Your browser, only after you consent. |
| Communication with us | Messages you send to support or privacy addresses and our replies. | You. |
We do not knowingly collect special categories of personal data. Please do not put them into Herovant unless it is necessary for your own work and lawful.
Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account and workspace, storing your content, scanning uploads for malware, letting you collaborate and share with clients. | Performance of a contract (Art. 6(1)(b)). |
| Sending service emails and notifications you need (sign-in links, invitations, reminders and the optional weekly digest, which you can switch off). | Performance of a contract, and our legitimate interest in keeping you informed about your work (Art. 6(1)(b) and (f)). |
| Taking payments through Lemon Squeezy, keeping billing records, meeting tax and accounting duties. | Contract and legal obligation (Art. 6(1)(b) and (c)). |
| Securing the service: detecting abuse, limiting sign-in attempts, keeping security logs, moderating public profiles and reports. | Our legitimate interest in protecting the service and its users (Art. 6(1)(f)). |
| Managing the waitlist and emailing you about the launch. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. |
| Answering your questions and handling data requests; establishing or defending legal claims. | Legitimate interest and legal obligation (Art. 6(1)(f) and (c)). |
| Measuring and improving the public marketing website with Google Analytics and Microsoft Clarity (herovant.com only, never in the app or client portal). | Your consent (Art. 6(1)(a) GDPR, and consent for the cookies under the ePrivacy rules), given in the cookie banner and withdrawable at any time with “Cookie settings”. |
We do not sell personal data, we do not show advertising, we do not use advertising or profiling tools, we use analytics only on the public marketing website and only with your consent (never inside the app or client portal), and we do not make decisions about you by automated means that have legal or similarly significant effects.
Transfers outside your country
Our application servers, database, file storage and email sending are in the European Union. Some providers (Lemon Squeezy, Google, Microsoft and Cloudflare's global network) process data in other countries, including the United States, and our operator works from Türkiye. Where personal data leaves the EEA or Türkiye we rely on the safeguards these providers offer, such as standard contractual clauses or an adequacy framework, and on your explicit consent where the KVKK requires it. Emails you send to our @herovant.com addresses are received and forwarded by Cloudflare (Email Routing) and read in a Google (Gmail) mailbox. You can ask us at privacy@herovant.com for more information about the safeguards in place.
Google Analytics and Microsoft Clarity receive data only if you accept analytics cookies. Google (Ireland and Google LLC in the United States) and Microsoft process it in the EEA, the United States and other countries; where it leaves the EEA or Türkiye we rely on the safeguards these providers offer (such as standard contractual clauses or the EU–US Data Privacy Framework) and on your explicit consent, which you give by accepting analytics and can withdraw at any time.
How long we keep data
| Data | Retention |
|---|---|
| Account and workspace content | For as long as your account exists. Deleted content is removed as described in the next section. |
| Waitlist entry | Until you ask us to delete it. If you join from an invitation, the entry is linked to your account and kept for sign-up statistics. |
| Sessions | Until you sign out or the session expires; expired session records are deleted 30 days after they expire. |
| Security events | 400 days. |
| Notifications in the app | 365 days. |
| Email delivery records | 400 days. |
| Automatic reminder records | 90 days. |
| Workspace audit logs | For as long as the workspace exists. |
| Billing and tax records | As long as tax and accounting law requires. |
| Backups | For a limited period; see the next section. |
Deleting data and backups
When you permanently delete a file, it is removed from storage together with its previews by a background process. To be able to repeat deletions if we ever have to restore from a backup, we keep a minimal deletion record (identifiers, storage location, time and size; never file contents) in a tamper-resistant log for at least 45 days.
You can delete content yourself. To close your account or delete your personal data, write to privacy@herovant.com; we will act on your request within one month, except for data we must keep by law (such as billing records) or that we need to defend legal claims. At the time of writing, closing an account is handled by us on request rather than by a button in the app.
Our hosting provider takes automated daily backups of our servers, and each backup is kept for 7 days. Data you delete can therefore remain in a backup until it rotates out, and it is not used for any other purpose. If we restore a backup, we re-apply deletions made since.
How we protect data
- Encryption in transit (TLS) on all public traffic.
- Passwords stored only as salted hashes; optional two-factor authentication; sign-in rate limits and session controls.
- Strict separation between workspaces enforced in the database, and least-privilege access between our services.
- Every upload is scanned for malware before it is stored.
- Hosting of application data and files in the EU, with limited-retention backups.
- Security events are recorded, and email addresses and IP addresses in them are stored only as hashes.
No system is perfectly secure. If a personal data breach affects you and the law requires it, we will notify you and the competent authority.
Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw a consent you gave (this does not affect earlier processing). If you are in Türkiye, you have the rights listed in Article 11 of the Law on the Protection of Personal Data No. 6698 (KVKK), which are similar.
To exercise any right, write to privacy@herovant.com. We may need to verify your identity first, and we answer within one month (KVKK: thirty days). Where we act as a processor for a customer, we will pass your request to that customer.
You also have the right to complain to a data protection authority: in the EU, the authority of your country of residence or work; in Türkiye, the Personal Data Protection Board (KVKK Kurulu). We would appreciate the chance to resolve your concern first.
Age
Herovant is for business use by adults. You must be at least 18 to use it, and we do not knowingly collect data from children.
Changes to this policy
We will update this policy when our practices change and show the date above. For material changes we will notify you by email or in the app before they take effect. The English version is the reference version and prevails in case of any discrepancy with a translation.
Contact
Ali Yalınkılıç, Türkiye. Privacy: privacy@herovant.com. General: support@herovant.com.