Skip to content

Heelo Privacy Policy

Effective date: October 29, 2026

This Privacy Policy tells you what personal data STARCHOLAR LLC ("Heelo", "we", "us") collects when you use heelo.dev, the Heelo dashboard, the Heelo API, and the Heelo MCP server (the "Service"), how we use it, and what choices you have. Contact: info@heelo.dev.

1. Data that we collect

1.1 Data that you give us

  • Account data: your email address, your name, and your login information. If you sign in with Google or another provider, we get your name, email address, and profile picture from that provider.
  • Content: the data that you send to tools, and the results that the tools return ("Your Content").
  • Messages: what you write to us, for example to info@heelo.dev.

1.2 Data from connected accounts

When you connect a third-party account (for example an email or social media account), we get access tokens for that account. We keep the tokens encrypted. We use them only to do the actions that you or your software ask a tool to do. We read data from a connected account only when a tool that you use needs it.

1.3 Payment data

Stripe processes your payments. Stripe collects your card details. We do not receive or store your full card number. We get from Stripe your customer ID, your plan, the payment status, and the last four digits and brand of your card.

1.4 Data that we collect automatically

  • Usage data: which tools you call, when, the result status, and the credits used.
  • Technical data: IP address, browser type, device information, and error logs.
  • Cookies: we use cookies that are necessary to keep you logged in and to keep the Service secure. We do not use advertising cookies.

2. How we use data

  • to provide the Service, run the tools that you ask for, and do actions for you;
  • to manage your account, your credits, and your payments;
  • to find and fix errors, and to measure and improve the performance of the Service;
  • to protect the Service and our users against fraud, abuse, and security problems;
  • to send you messages about the Service, for example receipts, security alerts, and changes to our terms;
  • to obey the law.

We do not sell your personal data. We do not share your personal data for advertising. We do not use Your Content to train AI models.

3. Legal bases (EEA and UK users)

If the law of the European Economic Area or the United Kingdom applies to you, we process your data because it is necessary to give you the Service (contract), because we have a legitimate interest in operating and protecting the Service, because the law requires it, or because you agreed (consent). You can withdraw consent at any time.

4. Who we share data with

We share data only with service providers that help us operate the Service, and only as necessary for their work:

  • Hosting and database: Vercel (website), Supabase (database and login), Cloudflare (network), and servers that we operate;
  • Payments: Stripe;
  • AI models and search: AI model providers (for example through OpenRouter) and web search providers, which get the part of Your Content that a tool sends to them;
  • Monitoring: error and performance monitoring services;
  • Third-party services that you connect: they get the data that a tool sends to do the action that you asked for.

We can also disclose data if the law requires it, to protect the rights and safety of people, or as part of a transfer of the Service to a new operator. If the Service is transferred, this Privacy Policy continues to apply to your data.

5. How long we keep data

  • Account data: while your account is open, and up to 30 days after you delete it.
  • Your Content and tool results: while your account is open, unless you delete them before.
  • Connected-account tokens: until you disconnect the account or delete your account.
  • Payment records: as long as tax and accounting law requires, which can be up to 7 years.
  • Technical logs: usually up to 90 days.

6. Security

We use encryption in transit (HTTPS), we encrypt connected-account tokens, and we limit who can access production data. No system is fully secure. If a data breach affects you, we will tell you as the law requires.

7. Your rights

Depending on where you live, you can have the right to see the data that we keep about you, to correct it, to delete it, to get a copy of it, to object to some processing, and to complain to a data protection authority. To use these rights, write to info@heelo.dev. We will reply in 30 days. We will not treat you differently because you used these rights.

California residents: we do not sell or share personal information as the California Consumer Privacy Act defines those words.

8. International transfers

We operate the Service from the United States. If you use it from another country, your data goes to the United States and to other countries where our service providers work. Where the law requires it, we use safeguards such as standard contractual clauses.

9. Children

The Service is not for people under 18 years old. We do not knowingly collect data from children under 13. If you think that a child gave us data, write to info@heelo.dev and we will delete it.

10. Changes to this Policy

We can change this Privacy Policy. We will put the new Policy on this page with a new effective date. For an important change, we will also tell you by email before it takes effect.

11. Contact

Email: info@heelo.dev