Privacy policy

Data we collect

• Account data: your email address and a one-way hash of your password (we never store your password in plain text).
• Your projects: the headlines and text you write, the colors and settings you choose, and the screenshots and fonts you upload.
• Purchase data: the customer and transaction IDs we receive from Paddle and your plan. We never see or store your card details.
• Technical data: the cookie that keeps you signed in, short-lived server logs for security (IP address, browser details), and your theme preference (kept only in your browser).

Why we process it

• To create your account, keep you signed in and verify your email address (performance of a contract).
• To store, preview and export your projects (performance of a contract).
• To recognize your Pro purchase and process refunds (performance of a contract and legal obligation).
• To prevent abuse and attacks, for example by limiting sign-in attempts (legitimate interest).

Cookies

We only use the session cookie the Service needs to work. We use no advertising or tracking cookies and run no third-party analytics.

Who we share it with

We do not sell your data. We share it only with these service providers, and only as far as needed to run the Service:

• Hetzner Online GmbH (Germany): our servers and backups are hosted in its German data center.
• Resend (USA): sends verification and password reset emails; receives your email address.
• Paddle.com (United Kingdom): processes payments, invoices and refunds. Paddle is the Merchant of Record for your purchase and processes data under its own privacy policy.
• kie.ai and Google Gemini: only when you use automatic translation in Pro, the headlines and sublines to be translated are sent for translation. Your images and email address are not sent.

International transfers

Your data is stored on our servers in Germany. Some data may be transferred to providers in the USA for sending email and automatic translation. These transfers are needed to provide the Service and rely on the providers' contractual safeguards.

How long we keep it

• Your account and projects are kept until you delete your account.
• When you delete your account, your account, projects and uploaded files are deleted immediately. Copies in daily backups expire on their own within 7 days.
• Server logs are kept for a short time and deleted regularly.
• Purchase and invoice records are kept by Paddle as tax law requires.

Your rights

Under the GDPR and Turkey's KVKK you can access your data, ask for it to be corrected or deleted, object to its processing and receive it in a portable format. You can delete your account and all projects yourself from the Account page. For anything else, write to iletisim@helovo.com; we reply within 30 days. You can also complain to your data protection authority.

Security

Connections are encrypted (HTTPS). Passwords are stored as one-way hashes, only you can access the files you upload, and sign-in attempts are rate limited.

Children

The Service is not directed at children under 16, and we do not knowingly collect their data.

Changes

We may update this policy and will announce significant changes on the site; the current date is shown at the top of this page.