Privacy statement

The most important points in brief

The website heldena.com sets no cookies, embeds nothing from third-party servers (the fonts are delivered with the website) and sends no details to us on its own, unless you submit the contact form or one of the two pages “Cancel contracts here” and “Withdraw from contract here” or use the question chat on the website; on a visit, technical access data arise at our hosting service. The app encrypts the content of your vault on your device, and our service receives the vault in encrypted form. Individual functions send details in clear text through our service or to third parties (for example to Stripe for payment, to Brevo for emails, to Anthropic for Asking Heldena in the app and for the question chat on the website); this statement says for each of them to whom and why.

This is the information under Articles 13 and 14 GDPR for the website, the app and the service. It also addresses people who are not customers: trusted people, heirs, people who refer others and people who were referred.

1. Controller

The controller is Heldena LLC, 1501 South Greeley Highway, Suite C, Cheyenne, WY 82007, Wyoming, United States of America. For questions about data protection you can reach it at privacy@heldena.com. In this statement, “we” means Heldena LLC. Complete details are in the imprint (in German).

2. The website

The website is hosted by Netlify, a hosting service. With every visit, your browser transmits technical data to the server that delivers the page: the IP address, date and time of the visit, the address requested, the page visited before, and browser and operating system details. The purpose is the technical provision and security of the website (detecting and fending off attacks, troubleshooting). The legal basis is Article 6(1)(f) GDPR, our legitimate interest in stable, secure operation. The website is delivered over HTTPS; a request over http is redirected to https.

The access data are meant to be kept only for as long as fending off attacks and troubleshooting require. The hosting service determines the period; we do not know which one it applies. The app is delivered by the same hosting service; when you open the app, the same access data arise.

What we do NOT do on this website

This applies to the website heldena.com, not to the app and the service; what those do is described in the following sections.

The website does not set cookies, not even technically necessary ones that recognize you.

It does not measure who visits it: no analytics or reach measurement, no tracking, no advertising networks.

It does not embed third-party content: no external fonts, maps, videos or social media components.

It has no newsletter.

The security check, a short questionnaire on this website, stores and sends nothing: it runs in the browser and is gone when you close the page.

3. The question chat on the website

If you use the question chat on this website, we process these details: the question you type, the earlier questions and answers of this conversation, the language of the page, the identifier of the text version of the dialog with which you gave your consent, and your IP address. You need no account for this, and the question chat on the website has no access to a vault. The purpose is to answer your question about Heldena. The question chat is voluntary; without it the website stays usable unchanged.

The path of your question: your browser sends it to our service (dienst.heldena.com, at Infomaniak in Switzerland); the service passes the question, the earlier questions and answers of the conversation and the language on to Anthropic, the company whose AI writes the answers, and sends the answer back to you. Your IP address does not go to Anthropic. We do not store your questions and the answers: the service does not keep them, and your conversation stays in the window until you reload or close the page or withdraw your consent. For a call of the question chat the service writes one line to its operating log, as for every other call (section 5): the method, the path (/besucher/frage or /besucher/verfuegbar), the result and the duration; the operating log adds the time itself. Your question, the answer and your IP address are not in it.

Our service sees your IP address in the process. To limit the number of questions per connection and day and the number of all questions per day, it computes a count value from your IP address as soon as you send a question. The count value is a pseudonym under a key that the service generates anew at random every day; both are held in memory, and the service does not store the IP address itself. Count value and key are gone by midnight (UTC) at the latest, and earlier if the service restarts. This is not anonymisation: as long as the count value exists, the service can tell from it that the same connection asks again; for IPv6 the leading part of the address, which identifies the connection, counts, and several people behind the same address are counted together. The purpose is that nobody floods the question chat with questions and the costs stay limited for everyone; the legal basis is Article 6(1)(f) GDPR, our legitimate interest in a chat that nobody can flood. You can object to this (section 14).

In front of the service stands a web server that keeps technical logs (section 5). We do not offer the question chat on this website until the web server no longer keeps an access log for the requests of the question chat. From then on it does not write down the IP address of your device, the time, the size of the response and the name of your browser for these requests.

The recipient is Anthropic, the company whose AI writes the answers. Anthropic may process the texts anywhere in the world; it can currently store them only in the USA, that is in a country outside the EU. The basis for the transfer is standard contractual clauses that are part of Anthropic’s data processing agreement (anthropic.com/legal/data-processing-addendum; version of 24 February 2025); whether they apply when the sender is, as here, a company in the USA is open. If no safeguard applies, the transfer rests on your explicit consent (Article 49(1)(a) GDPR): on your consent in the dialog, which says that the texts may be processed anywhere in the world and that it is not assured there that protection as in the EU applies. Anthropic is not on the list of the EU-US Data Privacy Framework (after a search for the name on 7 October 2026). Anthropic commits by default not to train any AI with the texts. According to Anthropic, the texts are deleted there within 30 days; another page of Anthropic says they are not stored at all, and we assume the longer period. Anthropic checks the texts automatically for misuse. If this check reports a violation, they can stay there for up to 2 years and the result of the check for up to 7 years. They can also stay longer if Anthropic needs them to enforce its usage rules or a law requires it; Anthropic names no period for that. What applies to the safeguards and how you get a copy is in section 12.

The legal basis for the service passing your question on to Anthropic is your consent (Article 6(1)(a) GDPR), which you give in a dialog of its own before the first question. Without it the website sends nothing to our service and the question chat does not answer. You can withdraw it at any time with effect for the future (Article 7(3) GDPR): with one click on the “Withdraw consent” button at the bottom of the window, without giving a reason. After that the website sends no more questions; what you have sent until then is already at Anthropic and is not retrieved by this.

If you choose “I agree” in the dialog, your browser remembers this consent in its local storage (localStorage) so that the dialog does not appear again on every page. You also consent to this with “I agree”: the dialog names it expressly. The legal basis for this is your consent (section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG). Only the version of the dialog text is stored: no identifier, no time, no cookie. The entry stays until you withdraw your consent or delete the website data of your browser. If you do not want your browser to store your consent, block the storing of website data for this website, not for the app, in your browser settings; how that works depends on the browser. If your browser then stores nothing, the question chat still works: your consent applies until the page is reloaded, after which the dialog appears again.

Do not write passwords, logins or account numbers in the question chat, and no health details, neither about yourself nor about other people. Heldena does not check this and does not stop it; it would then go to Anthropic as well.

4. Contact form

If you write to us through the contact form on this website, we process these details: your name (optional), your email address and your message. Email address and message are required because without them we cannot reply. The language of the page on which you used the form and the time at which your message reaches us are added automatically. You are not obliged to use the form; you can also write to us directly by email: contact@heldena.com.

The purpose is to answer your request. The legal basis is Article 6(1)(b) GDPR if you have a contract with us or want to enter into one and your request relates to it; in all other cases Article 6(1)(f) GDPR, our legitimate interest in answering requests. You can object to a processing under (f) (section 14).

The path of your message: your browser sends the details to our service (dienst.heldena.com, at Infomaniak in Switzerland); it checks them and passes them on as an email, through the sending service Brevo, to our mailbox, which is also at Infomaniak. The service does not store your message in a file or database.

Recipients are Brevo, which sends emails on our behalf (a processor, that is a service provider that works essentially on our instructions; for its own purposes such as billing and statistics, Brevo is itself responsible under its contract), and Infomaniak. For Switzerland, the European Commission has found an adequate level of protection (Decision 2000/518/EC); that is, it has found that an essentially equivalent level of data protection exists there. According to the public version of Brevo’s contract (version of 1 October 2025), Brevo hosts in France and Belgium and uses sub-processors, some of which are based in the USA and India; for transfers outside the European Economic Area, the contract names standard contractual clauses with supplementary measures (contract terms set by the EU Commission) and, for the USA, the EU-US Data Privacy Framework for as long as it is valid. Because we are incorporated in the USA, additional terms apply to us with the company SIB INC. US, whose effect on location and safeguards we have not checked. On request to privacy@heldena.com you get the contract (brevo.com/legal/termsofuse) and, as far as Brevo gives them to us, the clauses.

Storage period: in the mailbox we keep your message for as long as handling your request requires; after that we delete it, if no statutory retention duty prevents it. The sending service keeps the email (among other things the subject and your email address as reply address) in its sending log; in our account it is set that the entries are deleted after one month. Since the change on 19 October 2026 a new entry has no preview with the text; whether Brevo keeps the text anyway, we do not know. For emails before that, Brevo no longer displays the preview but can still send the email again with its text (seen on an older entry on 19 October 2026); so the text is still held there, and whether and when it is deleted, we do not know. On 18 October 2026 the log still held entries that were older than one month; when they are deleted, we do not know. Until the contract with it ends it can keep entries if the deletion does not take effect; after it ends it destroys the data on request within three months, if no law requires longer retention.

5. App and service

This section applies to you as the owner of a vault. What concerns trusted people, heirs, people who refer others and people who were referred is set out in the sections after it.

Account and sign-in

When you create your account, our service receives an account number, a public key, the name of your device, your email address (the app requires it when you create a new account; older accounts may not have one), the language for emails and, if you came through someone else’s code, that referral code. Your device also sends an unreadable checksum of your name; the service keeps it if you came through a referral code (section 11). It also keeps states and times of your account (the subscription, the end of the trial, the time of a deletion, for each case the times at which the message about the protection period and the one about the release were sent to you, and for each trusted person a note whether and when our service accepted the sending of a message about a case to them, without address and without name and for a limited time, as described in section 10), the record of your consent to Asking Heldena (time, text version, language), whether your consent to the community total is on or off, the identifier of your customer entry and of your subscription at Stripe if you take out a subscription, if you confirm your email address with a code, the time of the confirmation, unreadable checksums of the address and of the open code and the times of the latest sendings, and, for older accounts, the masked account number of a former payment method. Your email address is held at the service in clear text. The service uses it to send you important warnings with a deadline, security notices (for example that a new device was connected), a code with which you confirm that the address leads to your mailbox, the messages about a reported case, an inheritance event or an access recovery (that it was reported, that its protection period has ended, after which your trusted people can release it, and that it was released; until it is released you can stop it), after you take out a subscription the confirmation of the contract with the terms of use as a PDF, a reminder about 30 days before a year of your yearly subscription ends, saying what applies afterwards, a notice if a refund could not be made when your account was deleted, and the messages that the terms of use promise; by email as well, because a message to your device can fail to arrive (the two messages about the protection period and the release come by email only, and without a stored address not at all). The purpose is to run your account and to perform the contract; the legal basis is Article 6(1)(b) GDPR, except for the notes about messages to trusted people, for which Article 6(1)(f) GDPR applies (purpose and balancing are in section 10). We keep the record of your consent in order to be able to show it (Article 7(1) GDPR); the legal basis for this is Article 6(1)(f) GDPR, our legitimate interest, and you can object to it (section 14). If you delete your account, it is deleted after 30 days, as far as the service can clear it (section 13); until then you can take the deletion back.

The encrypted vault

The app encrypts the content of your vault on your device with keys that the service does not have. The server therefore holds the encrypted version of the vault, public keys, delivery routes (the addresses to which the service sends notifications), versions and timestamps. In addition the server sees sizes, times, the number of your devices, the shape of your circle (who is entered as a trusted person or heir and who receives encrypted packages) and the IP address of a request. Every package that trusted people receive contains a sealed directory with name and contact of all members of your circle; an invitation carries, in clear text, the name by which you introduce yourself. The purpose is to sync your vault between your devices and to operate the safety net; the legal basis is Article 6(1)(b) GDPR. If an inheritance process takes place, the service keeps its log: who reported, confirmed or stopped it, with time, public keys, signatures and the key parts sealed to the heir, without any content of the vault. If you have given an heir view access, an encrypted package for that view access is held on the server. Whether the encrypted version already counts as personal data for us is open; we treat it that way as a precaution.

Devices, push messages and restoring

If you register a device for push messages, the service stores the endpoint address that your browser assigns and that carries no name, your account number and the time. A push message is empty (“open Heldena”) and runs through the push service that your browser specifies (for example the one run by Google, Apple or Mozilla); the push service receives the endpoint address and the time of each message. The legal basis is Article 6(1)(b) GDPR; the registrations are deleted with your account. If you restore your access through trusted people, the new device temporarily deposits its public keys and a verification code at the service, without a name; the entry is valid for 48 hours from the last report of your device and is removed from the service by its clean-up run once it has expired; it is linked to an account when a trusted person handles it (Article 6(1)(f) GDPR, our legitimate interest in your being able to restore your access). At times the service also accepts results of a test page for passkeys from individual testers (step, device, browser identifier, result, without an account; Article 6(1)(f) GDPR, our legitimate interest in testing sign-in with passkeys on real devices); the clean-up run of the service deletes these results 28 days after the entry. You can object to both (section 14).

Connections to exchanges and wallets

If you set up a connection, our service queries Alchemy, Twelve Data or Binance for you. At Alchemy the public wallet address that you enter and the network are in the request, at Twelve Data a price symbol (for converting the wallet holdings from US dollars into euros the symbol EUR/USD, with no detail about you), at Binance the API key for reading; the balances come back. An older version of the app that you have not updated yet queries Covalent for a wallet address instead, and our service passes this request on. The secret with which the request is signed leaves your device in encrypted form, as part of your vault. The providers see the IP address of our service, not that of your device. The service does not keep these details for itself. In memory, however, it holds two tables that protect its quota at Alchemy: the number of queries per account, with the time at which the counting window began, and a note that two queries in a row could not read the whole holdings of a wallet because it has too many entries, with the time of the last such query; after that note the service does not query Alchemy again for the same combination of account, network and address for 24 hours. Account and address are not stored there in readable form, but as a short code that is made under a key which the service generates at random when it starts and does not store anywhere. This is not anonymization: as long as the service runs it can tell from the code that the same account, or the same combination of account, network and address, is asking again. The counters per account run in two windows (10 minutes and 24 hours), and an expired window starts anew; in the other table an entry arises already at the first retrieval that could not read the whole holding, the second such result in a row starts a pause of 24 hours, and if the pause has expired and the entry has not been cleaned up yet, a single further such result starts a pause of 24 hours again at once; an expired entry stays in memory until it is cleaned up or the service restarts; cleaning up happens at the next new entry once a table has reached 1,000 entries, and once a minute at most; if a table reaches 10,000 entries, a new entry pushes out the one created first; a restart empties both tables. The legal basis for these two tables is Article 6(1)(f) GDPR, our legitimate interest in protecting the quota at Alchemy for all accounts; you can object to this (section 14). What Alchemy may do with the request and how long it keeps it is in section 12. The legal basis for our request is Article 6(1)(b) GDPR, because the connection is part of the subscription; because Alchemy’s contract allows Alchemy to use the request also for purposes of its own, for the request to Alchemy, to the extent that it serves purposes of Alchemy’s own, we additionally name Article 6(1)(f) GDPR, our legitimate interest (section 12).

Total value for the community total

If you agree in the settings, the app tries to send the total value of your vault, rounded to €10,000, to the service right afterwards and then each time you unlock it; if that does not work, for example without a connection, it tries again the next time you unlock. If the rounded value is zero, the app sends nothing. If that value is above €100,000,000, the app sends €100,000,000 instead. The service counts one contribution per account and month and discards every further submission in the same month without storing its value. The counted contribution goes into the community total, the sum of all contributions that the app shows to everyone. The service stores the monthly sum and the number of contributions without your name and without your account number and notes on your account for which month your contribution already counts. If one contribution has arrived so far in a month, the sum can be attributed to you through this note until your account is deleted. The legal basis is your consent (Article 6(1)(a) GDPR); new accounts start without it. You can withdraw it in the settings; after that the app sends nothing more, not even in the current month, and the note on your account stays (section 13).

Stored on your device

The app stores the encrypted vault and its settings in your browser’s storage (IndexedDB, localStorage and sessionStorage; these are stores that every browser offers to a website), and the service worker, which lets the app open without a connection, caches the files of the app there. This is strictly necessary for the app to provide the service you asked for (section 25(2) number 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); we need no consent for it. The app sets no cookies to recognize you.

Logs and protection against misuse

The service and the web server in front of it keep technical logs (the operating log of the service and the access log of the web server): per request the method, the path without query part, the result and the duration, plus the time, which the respective log enters itself; at the web server the IP address of your device, the size of the response and the name of your browser are added. In individual cases the service writes an identifier as well: when it delivers a notification its kind, the account number and, where there is one, the identifier of the person in your circle to whom it goes, for a declaration to cancel or withdraw its reference number, type and state (section 9), for payment events the identifier of the session, the subscription or the event at Stripe. To limit misuse, the service counts requests by the sender address that it sees on the connection and the messages of the contact form in memory; a restart of the service resets the counters. For the requests of the question chat on the website, the service writes the same line per request (the method, the path, the result and the duration); your question, the answer and your IP address are not in it. How the service counts them and what applies to the access log of the web server is in section 3. The logs are meant to be kept only for as long as fending off attacks and troubleshooting require: the access log of the web server reaches back at most 20 days, the operating log of the service (including its copy in the system log of the server) at most six weeks; both apply to the server on which the service runs, under the settings of 19 October 2026. For the access data at the hosting service of the website, section 2 applies. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure, stable operation and in protection against overload. You can object to this (section 14).

6. Asking Heldena and classification in the app

If you use Asking Heldena in the app, the text you write or tap as an example goes, together with the earlier questions and answers of this conversation and the language, to Anthropic, the company whose AI writes the answers. Your vault does not go along with these questions. The chat works only with your consent (Article 6(1)(a) GDPR), which you give the first time in a dialog of its own and can withdraw in the settings under “Privacy”. It then applies to future questions; what you have sent until then is already at Anthropic and is not retrieved by this.

If you ask for a classification of your spread, your distribution by asset type and your distribution by country, both in whole percent, go to Anthropic; amounts and names do not go along. You trigger this yourself with a button, never by merely opening the page; what is sent is stated before the button. Your press of the button is your consent for this one request (Article 6(1)(a) GDPR). The percentages go to Anthropic several times: to the AI that writes the text and to a second one that checks it, and once more if the text is revised. While “Maximum privacy” is switched on, neither questions nor percentages leave your device.

Anthropic may process the texts anywhere in the world; it can currently store them only in the USA, that is in a country outside the EU. The basis for the transfer is standard contractual clauses that are part of Anthropic’s data processing agreement (anthropic.com/legal/data-processing-addendum; version of 24 February 2025); whether they apply when the sender is, as here, a company in the USA is open. If no safeguard applies, the transfer rests on your explicit consent (Article 49(1)(a) GDPR): in the chat, on your consent in the dialog; for the classification, on pressing the button, above which it says that the details go to the USA and that it is not assured there that protection as in the EU applies. Anthropic is not on the list of the EU-US Data Privacy Framework (after a search for the name on 7 October 2026). Anthropic commits by default not to train any AI with the texts. According to Anthropic, the texts are deleted there within 30 days; another page of Anthropic says they are not stored at all, and we assume the longer period. Anthropic checks the texts automatically for misuse. If this check reports a violation, they can stay there for up to 2 years and the result of the check for up to 7 years. They can also stay longer if Anthropic needs them to enforce its usage rules or a law requires it; Anthropic names no period for that.

We do not store your questions: our service does not keep them, and on your device they disappear as soon as you lock Heldena. Do not write passwords, logins or account numbers in the chat, and no health details, neither about yourself nor about other people. Heldena does not check this and does not stop it; it would then go to Anthropic as well.

7. Reporting an error of the app

If an error occurs in the app that we did not foresee, the app asks you (in a dialog or through a line at the edge of the page) whether you want to report it to us. This also applies to an error that the app catches in the background and discards if it is not one of the known cases (for example a lost connection or a step you canceled): then a quiet line may stand at the edge of the page, and the dialog opens when you tap it. The dialog first shows you word for word what would be sent: the kind of error, the place in the delivered program text of the app, the version of the app, the screen (its name, without additions in the address), the browser family (for example Chrome or Safari) and the language. On top of that you can optionally enter an email address so that we write to you whether the error is fixed, and optionally a text on what you were doing; this text may contain personal information, and we read it. Please do not write passwords and do not write health details there, neither about yourself nor about other people. The text of the error message, your account number, the identifier of your device and contents of your vault are not part of what the app puts together; what you write in the text field yourself goes along.

The purpose is to find and fix the error and, if you entered an address, to write to you whether it is fixed. The legal basis is your consent (Article 6(1)(a) GDPR); your tap on “Send” is that consent, for this one report. The app sends no detail about the error before you tap, and it does not send any detail about the error later without you tapping again. When the app starts, it asks the service whether the report is set up there; this request contains no detail about an error, no account number and no identifier of your device. Like every request to the service it carries the IP address of your device and the name of your browser; the web server writes both to its access log, and our service writes the kind of request, the path in a form that carries no identifier, the result and the duration to its operating log; the log itself enters the time (section 5). The legal basis for that is our legitimate interest (Article 6(1)(f) GDPR) in offering the report where it is set up; the request itself carries no account number and no identifier of your device, but its IP address is in the access log of the web server and can be linked through it with other requests from the same connection. You can object to this request on grounds relating to your particular situation (Article 21(1) GDPR; section 14). You are not obliged to report an error, and if you do not, it has no consequences for you. You can withdraw your consent at any time by writing to us (privacy@heldena.com) and naming the date and time of your report or, as long as we have not answered you yet and you had entered an email address, that address (the app shows you the time once, right after sending); what was processed until then remains lawful (Article 7(3) GDPR). After your withdrawal we delete, where we can match the report unambiguously by time or address, the row with your text and, if it is still there and no further report of the same address and error type points to it, the row with your address, and your message to us as soon as we have carried out the withdrawal and answered you. The entry in the log of the sending service we delete if it can be deleted there; whether that is possible, we have not checked. In our account the entries are also deleted after one month (the effect is not confirmed; section 4). Copies of the service keep the rows until the periods in section 13. The IP address in the access log of the web server stays there for at most 20 days (under the settings of 19 October 2026), as long as the defense against attacks and troubleshooting require it (section 5); a withdrawal does not change that. We have no proof that it was you who consented: the traces of a report (the row in the service, the email with the time of receipt and the access log of the web server) show the receipt, but carry neither your account number nor a name of yours, except what you write yourself; the IP address is in the access log. We cannot check whether a report comes from the app and whether the address in it is yours; if someone has written to you about a report you did not send, you can ignore the message: With it we have deleted your address from our service. The row with your text carries no detail that names you, except what you write in your text yourself (your address is in a row of its own, see below); the web server keeps its access log with the IP address for every request (section 12 and section 5, “Logs and protection against misuse”). That the same error does not ask you again in this tab is remembered by the app, after your report arrived following “Send” or you tapped “Do not send” or closed the dialog with ✕, Escape or Back, until the tab is closed, in your browser’s sessionStorage (the kind and place of the error, nothing about you); this is a storage that every browser offers to a website. That an error caught in the background, for which the app shows a quiet line, is not shown again in the same open page, the app remembers in the memory of the page until you reload or close it; for this it writes nothing to the sessionStorage. We assume that for this, and for reading the browser family from the name of your browser so that the dialog can show it, no consent is needed under section 25(2) number 2 TDDDG, because both are strictly necessary so that we can provide you with the report that you expressly request with “Send”, without asking you several times about the same error. Remembering after “Do not send” records your answer so that the dialog respects it; whether that also falls under number 2 and whether a supervisory authority sees it the same way, we do not know.

The path of your report: the app sends the details to our service (dienst.heldena.com, at Infomaniak in Switzerland). The service checks them, passes an email, through the sending service Brevo, on to the operating mailbox of Heldena, which is at Infomaniak, and then stores the report as one row in a table and, if there is an address, the address as a row of its own in a second table. This email carries neither your text nor your email address, only the form of the error (kind, place, version, screen, browser family, language), the mark, the time of receipt, and whether you entered a text and an address; we read your text and answer your report through an access to our service, not in a mailbox. This mailbox forwards its emails to the team mailbox of Heldena, which is also at Infomaniak, and keeps a copy; Infomaniak does not forward emails it classifies as spam. At Infomaniak, no forwarding to another provider and no rule of its own is set up for either of the two mailboxes. The email therefore lies in the operating mailbox and, if it was not classified as spam, in the team mailbox, and also in the sending log of the sending service (storage period, further down in this section), and other reports of our service to us arrive in the operating mailbox as well (for example about a payment that could not be assigned, section 12). The row of the report carries a random identifier, a mark made from the kind and the place of the error, the kind and the place of the error, the version, the screen, the browser family, the language, your text if you wrote one, the time at which the report reaches us, the state of processing (new, read or done) and the day on which the service deletes it; it does not carry your address. The row of your address carries the address, the language of your report, the day from which we usually answer (30 days after your report), the day on which the service deletes it even without an answer (90 days after your report) and the identifiers of your reports; also the mark of the error, the exact time of receipt, our decision (fixed or not fixed) if we have made one, the time of the last attempt to write to you, and how often the sending service rejected the address. If sending to the mailbox fails, the service stores no row (not the one with your address either), and the app tells you that it did not work. The email to the mailbox goes out for every report that carries an address or a text; a report without both that repeats an error already reported triggers one email per error and six hours. The service accepts at most 10 reports an hour and 20 a day (UTC) (after a restart of the service it counts anew); above that it answers that it did not work, and the app tells you. If you send the details yourself to contact@heldena.com instead, as the app suggests when it did not work, section 4 applies to that email.

The answer to you: If you entered an address, our service writes to you whether the error is fixed, usually 30 days after your report, and deletes your address from the service with that message. With very many reports, or if sending fails, it may take longer; after 90 days the service deletes the address, even if it has not written to you. We usually write to you once: as long as the row with your address is open, you usually get one answer per address, and it refers to the kind of error of your first report; a report of another kind from the same address we do not answer separately. If the service fails between sending and deleting, the message may arrive twice. If someone else entered your address, our legal basis is our legitimate interest (Article 6(1)(f) GDPR) in answering everyone who reports an error and enters an address for it; we then have the address from that person and not from you, we write to you once and delete it with that message, and you can object (section 14) and complain to a data protection supervisory authority. The same information is in the answer itself. The service sends the answer through Brevo; it contains no link, no address in the text and no question, and the service sends at most 10 answers a day (UTC); after a restart of the service it counts anew. If you reply to this email, your reply arrives in our mailbox, and section 4 applies to that email.

Recipients are Brevo, which sends emails on our behalf, and Infomaniak, plus, once they exist, the provider of the copies of the service and whoever keeps the key to them (section 12 and section 13); on Brevo and Infomaniak, on the countries and on the contract with Brevo the necessary is in section 4 and in section 12. The answer to you, when we write to you whether the error is fixed, is sent by our service through Brevo; it contains no link, no address in the text and no question.

Storage period: the service deletes the row with your text by itself after 90 days. The row with your address the service deletes as soon as it has answered you, usually 30 days after your report; with a backlog, or if sending fails, it may take longer, and after 90 days the service deletes it, even if it has not written to you. The email to us in the operating mailbox and in the team mailbox at Infomaniak carries neither your text nor your address and lies there without a fixed period (in the operating mailbox Infomaniak empties the trash and spam folders by itself after 30 days, for the team mailbox we do not know; section 13). We read the text through an access to our service in the terminal of a computer of the operator; what was shown there stands afterwards in the terminal of that computer, a place the service does not know. The sending service keeps in its sending log the recipient of every email that our service sends and may keep the content of the email; in our account it is set that the entries are deleted after one month (the effect is not confirmed), and until the contract ends it can keep entries (duration and limit: section 4); that applies to the answer to you, and so to your address, and to the email to us. Infomaniak may also keep backups of the mailboxes; how long, we do not know. If the service makes copies of its data, they hold the row and the address until the periods in section 13. A report that we cannot match unambiguously, even after asking, we do not delete before the 90 days and the periods of the copies end.

8. Subscription and payment

You pay for the subscription through Stripe; you buy from Heldena LLC, and Stripe is the payment service. You enter your name, your email and your address for the payment at Stripe, not at Heldena. Stripe sends details about the payment to the server of our service in the payment notice; the service does not store your name, your email and your address from it. Our service passes the number of your account on to Stripe so that Stripe can assign the payment to your account, together with the chosen cycle and, if you still have trial time, its end.

You can also pay for the subscription through PayPal; then too you buy from Heldena LLC, and PayPal is the payment service. You confirm the subscription on the PayPal page and enter your payment details there, not at Heldena. PayPal sends details about the payment to the server of our service in the payment notice; the service reads only identifiers, the state of the subscription, times and amounts from it and does not store your name, your email and your address. Our service passes the number of your account on to PayPal so that our service can assign PayPal’s notice about this payment to your account, together with the chosen cycle, the addresses of the app to which PayPal sends you back after your approval or when you cancel there and, if you still have time left, the time of the first charge. After that the service retrieves the subscription and the payment at PayPal by their identifier to read their state, and cancels the subscription at PayPal where it has to end (for example when you delete your account or a payment is reversed); these replies too contain details about you (name, email), the service reads only the same identifiers, states, times and amounts from them and stores none of it. If you pay with a PayPal account, the payment method is shown in that account and you change it there; how it works without a PayPal account we have not checked.

Stripe keeps the order data (contact details, addresses, payment details and order details such as date and price) in the account of Heldena LLC at Stripe, and Heldena has access to it. The privacy notice of Stripe applies to the data of the purchase as well. For us the purpose is to perform the contract and to keep invoices and accounting records; the legal basis is Article 6(1)(b) GDPR, and for keeping records Article 6(1)(f) GDPR, our legitimate interest in defending against claims and in meeting the company’s tax obligations; you can object to this (section 14). For a subscription through PayPal, PayPal keeps the details of the payment in its account for Heldena LLC; which details these are in live operation we have not yet checked (in the test environment of PayPal, the name and email you gave at PayPal were among them). The privacy notice of PayPal applies to the data of the purchase as well. We have not yet set a period for this order data.

The refund: if a subscription does not come about because a second subscription would otherwise arise for your account, or if you withdraw from the subscription in the first 14 days (if you changed from monthly to yearly outside the trial: also in the first 14 days from the day on which the yearly price is billed), our service pays the money back to you through Stripe or PayPal without a person at our end arranging it. For this it calls the payment service: at Stripe it asks for the payments with the identifier of your customer record at Stripe, refunds with the identifier of the payment and the amount, and, if the answer was lost, checks whether the refund stands; at PayPal it refunds with the identifier of the payment and checks in the same way. Your email address and your postal address do not go to the payment service in these calls; its answers may contain details about you (name, email address, postal address), the service reads from them the identifier of the payment, the amount, the state and whether the payment is disputed, and stores of these the identifier and the amount. The service refunds when there is exactly one payment that can be refunded, and it refunds it in full, except when you delete your account: then it refunds in the same way the part of the last payment that belongs to the time after the deletion (within the first 14 days after your first payment, the whole payment); the legal basis for this is Article 6(1)(b) GDPR, our promise in the terms of use. If there is more than one, the payment is disputed at Stripe (a dispute), the sum of the refunds that the service has triggered on its own that day (world time, UTC) would exceed 2,000 euros with this payment (this upper limit applies to what the service triggers on its own; a person refunds beyond it by hand) or the outcome of the call is unclear, the case goes to our mailbox as a notice so that a person refunds it or checks. The purpose is to meet and to document your claim to repayment; the legal basis is Article 6(1)(b) GDPR (your contract for the subscription or, if it does not come about, our promise in the terms of use to refund what was charged) and (c) (the legal duty to repay, for a withdrawal sections 355 and 357 of the German Civil Code), and for the proof (f) (our legitimate interest in documenting what was refunded); you can object to this (section 14). For this the service stores an entry for each attempt: the identifier of the payment, the provider, the occasion (withdrawal, second subscription or deletion of the account), the amount, the time, the state (for example requested, refunded, rejected, unclear or not carried out) and the number of your account with Heldena, so that the same payment is not refunded twice and we can assign the refund to your account (for example for a disclosure of your data). The number of your account stays in the entry for as long as the entry exists, but at most until your account is finally deleted (section 13). The rest of the entry of a finished attempt stays until 31 December of the third calendar year after the year in which it was created; an entry whose outcome is still open stays until it is settled. If the service reports a case to us, the email to our mailbox contains the identifiers known to it at that time (account, payment, customer, subscription) and, if known, the amount; for a withdrawal the collective email also contains your name (section 9). On the following day after 6 a.m. (universal time, UTC), as soon as sending is possible, it sends our accounting team an email through Brevo with an overview of the payments it refunded on the previous day (several days together after an outage): the identifier of the payment, the provider, the occasion and the amount, without your name and without your postal address. The purpose is the record of the refund for bookkeeping (Article 6(1)(f) GDPR, as for the proof above); like the other records, the overview stays in our accounting for up to ten years; the sending log of Brevo holds among other things the subject and the recipient; since the change on 19 October 2026 a new entry has no preview with the text, whether Brevo keeps the text anyway, we do not know; in our account it is set that the entries are deleted after one month, the effect is not confirmed (duration and limit: section 4, section 13 and section 12).

9. Canceling and withdrawing on the website

If you submit a declaration on the page “Cancel contracts here” or on the page “Withdraw from contract here” of this website, we process these details: your name, your email address, for an extraordinary cancellation the reason that you enter freely, and your choice of type and time of the cancellation. The language of the page and the time at which your declaration reaches us are added automatically, and our service assigns a reference number to it. You need no sign-in and no access to the app for this. Name and email address are required fields: without them the page does not accept your declaration. They serve to identify you clearly, as sections 312k(2) and 356a(2) of the German Civil Code provide for these pages, and under the email address we search for your subscription. You enter the reason voluntarily. The purpose is to receive and carry out your declaration: under your email address we search for your subscription at our payment service Stripe and in our accounts, and we end it or note its cancellation. The legal basis is Article 6(1)(c) GDPR for receiving the declaration, because the law obliges us to make a cancellation and a withdrawal possible on our website (sections 312k and 356a of the German Civil Code), and Article 6(1)(b) GDPR for carrying it out on your contract.

The path of your declaration: your browser sends the details to our service (at Infomaniak in Switzerland); it checks them, files them and answers before it calls anything at Stripe. After that it searches Stripe for the customers with your email address and their subscriptions (your address goes to Stripe for this) and reads in our accounts the subscriptions with the same address. Then it cancels the subscription at Stripe at the end of the current period or, if you choose a later date, at the first end of a period on or after that date (if an end is already set for your subscription that is not later, that end stays), or, for a withdrawal in the first 14 days of the subscription, ends it with the call to Stripe, without waiting for the end of the period. If your subscription is with PayPal, the service finds it only in our accounts (it does not search at PayPal), and only if the email address you enter here is the same as the one in your account with Heldena; the address of your PayPal account does not count. If it finds nothing, it files the declaration as without a subscription found, and the subscription keeps running. For a cancellation at the next possible time, or at a date that is not after the end of the paid time, it cancels it at once with a call to PayPal (the identifier of the subscription goes to PayPal in that call, not your address) and lets the paid time run on with us until its end. If you choose a date after the end of the paid time, or a withdrawal comes after the first 14 days, the service does not call PayPal: the case goes to our mailbox, a person ends the subscription by hand, and until then PayPal keeps charging. For a withdrawal in the first 14 days, the time you paid for through PayPal ends on receipt; time you already had before (for example trial time) stays. For a withdrawal in the first 14 days, the service refunds the payment that belongs to this subscription itself, if it recognizes exactly one that can be refunded and the refund succeeds; otherwise the case goes to our mailbox as a notice so that a person refunds it or checks. How this works and what is stored for it is in section 8. The page does not show you whether a subscription was found under your address. The service carries out your declaration automatically, without a person at our end looking at it first; in doing so it follows the rules that the pages describe. If a person at our end has to decide a case (for example for an extraordinary cancellation or for a withdrawal after the first 14 days), the service sends one collective email to our mailbox, with your name, your email address, where given your reason and your desired date, the identifier of your subscription (at Stripe also that of the customer), for a subscription through PayPal the number of your account with Heldena and, where a refund by hand is needed, the amount of the latest invoice, through the sending service Brevo (what applies to Brevo and to transfers outside the EU is in section 4). Recipients are Stripe, Brevo and Infomaniak and, for a subscription through PayPal, also PayPal; for transfers to Stripe and PayPal outside the EU, what is written in section 12 applies.

Storage period: the service deletes your name, email address, reason and your details on the kind and time of the cancellation as soon as the declaration has been carried out and no case is open any more, as soon as it has been filed as without a subscription found or passed on to our mailbox as a case; until then they are held in the service, at most 30 days after receipt: if the declaration has not been carried out by then (for example because Stripe cannot be reached), the service first passes it to our mailbox as a case; if no collective email has gone out by then either, it deletes the details anyway. In that case your declaration may not have been carried out yet or not completely, and nobody at our end may have seen the case; we do not notify you about this, and the app shows the state of your account at the service, not the one at Stripe. You can check whether your subscription has ended in the app under “Settings”, or you write to us. In copies of the service they stay until those expire (section 13). The rest of the record stays until 31 December of the third calendar year after the year of receipt, even if you delete your account before: reference number, type of declaration (cancellation or withdrawal), times, number of processing attempts, language of the page, at Stripe the identifiers of the customer and of the subscription, at PayPal the identifier of the subscription, for a subscription through PayPal also the number of your account with Heldena and, where a refund is due or was made for a withdrawal and an invoice exists, its amount (so that we can show what was to be refunded), and the result (until when the subscription runs, whether the service refunded, whether a person at our end had to decide the case and for what reason). We have a legitimate interest in being able to prove the receipt of your declaration and to defend ourselves against claims (Article 6(1)(f) GDPR; the regular limitation period is three years, sections 195 and 199 of the German Civil Code). The collective email stays in our mailbox for as long as handling requires; the sending log of Brevo holds among other things the subject and the recipient; since the change on 19 October 2026 a new entry has no preview with the text, whether Brevo keeps the text anyway, we do not know; in our account it is set that the entries are deleted after one month, the effect is not confirmed (duration and limit: section 4).

Protection against misuse: so that nobody sends declarations in masses, the service limits the number of declarations per email address and day; a declaration beyond that it does not carry out; the first one beyond that per address and 24 hours it passes to our mailbox as a case, as long as it has not already passed as many cases of this kind in the current hour as a collective email carries (this limit applies to all addresses together), and it files the others without carrying them out. For this it holds a short value of the address in memory, made under a key that the service generates at random when it starts and does not store anywhere; this is not anonymisation: as long as the service runs it can tell from the short value that the same address comes again. A restart of the service resets the counter and the key. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in a service that nobody can flood. You can object to this and to the retention (section 14).

10. If you are a trusted person or an heir

This section is for people whom an owner, that is a person who uses Heldena for their vault, has named as a trusted person or as an heir. You may not be a customer of Heldena, and your data does not come from you but from the owner (Article 14(2)(f) GDPR).

Which details about you are in a vault is decided by the owner. They are stored encrypted, and Heldena has no key to them. When the owner’s app or the app of another trusted person reports that one of the occasions has occurred on which a trusted person must be reached (for example a reported inheritance event, a check-in, removal from the circle, deletion of the account or the shutdown of Heldena), your email address, the owner’s first name and the time go through our service, even if you never accepted an invitation: the service passes them to the sending service and does not store the address. The messages carry no link and do not ask for an input. If you have set up Heldena on a device as a trusted person or heir, the service also keeps your role, your public keys, the address of your browser’s push service if you have allowed notifications, and whether you last used Heldena as an installed app or in the browser. The owner sees, for you, when you last fetched, with what kind of device, whether you have allowed notifications and how current your copy is. Name and contact that the owner enters for you go to all other members of the owner’s circle in the sealed directory that every package carries. On the server, these details are deleted with the owner’s account; the copies on the devices of the other members stay there until the data of the app on the device is deleted. If the owner removes you from the circle, the app tries to revoke your invitation link; if it cannot reach the service, the link stays valid. If the owner then redistributes the circle and no new package has been stored for you at the service since the last redistribution, the service deletes, if you had a package, your package, the state of your copy, the address of your push service and a view-access package under the same identifier 30 days after the last redistribution. Because the service does not see the circle and tells from the packages who still belongs to it, this also applies to a person who is still in the circle but for whom no new package was stored. If the owner does not redistribute the circle or cannot (for example because the subscription is not running), these details also stay until the owner’s account is deleted. Your public keys, the entry of your acceptance, your role and all other details of an heir stay in every case until the owner’s account is deleted.

The note about a message to you

If you are a trusted person, then for a reported case (an inheritance event or an access recovery) our service notes, for three messages (the case was started, its protection period has ended, the owner stopped it) that the service has accepted the sending of the message to you, so that the same message is not sent to you several times. For an heir who is not also a trusted person the service creates no note; our app sends these messages to trusted people, not to heirs. The note carries your identifier in the owner’s circle, the case, the kind of message and the time, but no address and no name. The identifier is a number that the app does not display to you; the first eight characters of it appear in the name of the file of your emergency code. If several members have the same address, the app that triggers the message (that of a member, in a veto also that of the owner) picks the smallest of their identifiers; the service does not check this and does not check whether the address the message was sent to belongs to this identifier; the note therefore does not prove that a message went to you. The note is not anonymised, because it can be traced to you through the identifier. The note stays even if the sending service rejects the message or we cannot reach it; the same message is then not sent again and may not reach you. If the app of the member who triggers the message is an older version, the service creates no note; the same message can then arrive several times. The clean-up run of the service (a regular pass that removes old entries) removes the note as soon as it is 200 days old, and it is deleted with the owner’s account; in copies of the service it stays as long as every other detail held by the service (section 13). The app does not offer to remove the copies of this note on the devices of the circle’s members one by one, and we do not delete them; they stay on the device until the data of the app there is deleted (for example in the settings of the browser). The devices keep these copies so that the same device does not trigger a message again. Removal from the circle does not remove the notes about messages to you either.

Purpose and legal basis

The purpose is to reach you when the owner has set it up and a case concerns you. The legal basis is Article 6(1)(f) GDPR: the owner and we have a legitimate interest in your learning of a case; we do not ask for your consent for this. The same legal basis applies to the note that our service accepted the sending of a message about a case to you: our interest is that the same message is not sent to you several times. Set against it is a note without name and without address that is deleted in our service after a fixed period; the copies are described in the paragraph “The note about a message to you”, above. So in our assessment your interests do not override. You can object to this note (section 14), and how we comply is stated in the paragraph “Your right to object as a trusted person or heir”, further down in this section. The same legal basis applies to the details about your device. When we send you a message, it names this statement, points you to your right to object and says where to find the statement. Our service does not write to heirs in these cases; they find the statement on the page through which they accept their invitation. The sending service Brevo keeps among other things the subject of the message and your address in its sending log; since the change on 19 October 2026 a new entry has no preview with the text, whether Brevo keeps the text anyway, we do not know; in our account it is set that the entries are deleted after one month, the effect is not confirmed (duration and limit: section 4). It can record whether a message is opened; anonymisation is switched on in our account, so it shows us neither your email address nor your IP address for this (section 12). In an inheritance event, the trusted people check whether the person asking for access is the one the owner named; the heir shows an ID document to them in a video call. The call takes place outside Heldena.

Your right to object as a trusted person or heir

You can object to the processing of your details as a trusted person or heir, on grounds relating to your particular situation (Article 21(1) GDPR). To do so, write to privacy@heldena.com. More on this is in section 14; how an objection to being reached itself is handled is stated there in the paragraph on the right to object. If you are an heir and have no role as a trusted person with any owner, not in the past either, the service creates no note about a message to you, and what follows does not concern you. By the same route, you object to the note that our service accepted the sending of a message about a case to you, and you give us, as described below, the address of the owner. We comply with an objection to the note as follows: with a tool of our own we delete the notes about messages to the trusted people of the account concerned; for this you write to privacy@heldena.com and give us the email address of the owner in whose circle you are or were a trusted person; we tell you what has happened. If you are or were a trusted person in the circle of several owners, give us the address of each owner; we delete the notes of one account per address. For the address you give us we delete nothing and cannot carry out the objection to the note if one of these applies: you do not know the address, it is not the address of the account, the account has none stored, or the address belongs to more than one account. We have not built a block per person, that is, none that would exempt you from future notes: the service holds neither your name nor your email address in readable form for your identifier in the owner’s circle, and we have not built a way for you to give us this identifier. If you are still in the circle, that is why the note is created again with the next message to you about a case; a message that was already sent can arrive once more, for you and for the other trusted people of the account whose notes were deleted with yours. That the note is created again is a limit of how we built Heldena. We do not delete the copies of the notes on the devices of the circle’s members, and the copies of the service stay, as described in the paragraph “The note about a message to you”, above.

11. If you refer others or were referred

The referral code contains no name. Whoever comes through your code does not learn who you are, and you do not learn who came through your code. For an account that came through a code, our service stores the referral code, the link “came through whom”, a checksum of the name that cannot be read and one of the postcode, both computed by the device of the referred person (the one of the postcode confirms a match among identical names), and the referrer’s payment identifier. Someone with a complete copy of the service’s database and a name list of their own could brute-force the checksums; they are pseudonymous, not anonymous. After an account is deleted, one row (checksum, payment identifier, expiry date) stays for up to two years so that a late credit can still be assigned. The legal basis is Article 6(1)(b) GDPR if you take part in the referral program, otherwise Article 6(1)(f) GDPR, our legitimate interest in being able to assign a referral to the account that made it. If you have a balance from referrals, the service writes to you, as soon as payouts are possible, once a year, in December, about what part of it expires when; the basis is Article 6(1)(f) GDPR, our legitimate interest in your claim not expiring unnoticed and in our being able to show that you learned of it.

Payouts are not yet possible; they begin on a day that Heldena sets. From that day the following applies to them. The participation terms of the program describe when a payout is possible; this describes what happens to your data.

Before your balance can be paid out and booked, our accounting team needs your name and your address.

We send these details to our accounting team for you: your name, your address, the email address for your payout via PayPal, and your statement of whether you refer privately or commercially and, if commercially, whether as an individual or as a company. If you refer commercially, we also send the tax number, if you give one. The company that sends our emails sees these details in the process, as with every email. In our accounting they are kept for up to ten years, so that we can defend ourselves against claims. For the payout, PayPal receives your email address and the amount.

Every time before you request a payout, we ask for these details again. You see them and confirm them before they go out. Your address is never on the server your app works with. The server only passes it on.

If you request a payout, the service records on that request which version of the participation terms it had at that time: the date of its version and a checksum of its wording. The purpose is to be able to show, in a dispute, which version the service had when the request was made; it does not prove that you read it, or that the page with the participation terms on the web carried the same version at that time. Both details stay on the credits that the request covers and are cleared with them: with the account, after the deletion period and once accounting has received the records; how long that is and how long copies stay is stated under “How long” (section 13). The legal basis is Article 6(1)(f) GDPR, our legitimate interest in being able to prove the content of the terms under which payouts are made.

If a single trusted person in the owner’s safety net has confirmed an inheritance event (this comes earlier than the release of the access) and the owner has not stopped the case, no new credits arise for the owner’s account and a payout is held; if the owner stops the case in the app, the credits continue. For this our service reads, in the log of the inheritance process (section 5), whether an inheritance event is confirmed; it cannot read the content of the vault. The purpose is to hold payouts as long as it is not clear who is entitled under inheritance law: the inheritance event in Heldena is not an official finding. The hold happens automatically, without a person at our end looking at it first, and affects a payment claim; you can ask for a person at our end to review it, and state your point of view (Article 22(3) GDPR): write to privacy@heldena.com for this. Heirs report with proof of their inheritance right through the contact route in the legal notice; a built way to lift the hold does not exist yet. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in not paying the wrong person.

If a referred person invests money with an investment provider to which Heldena points, the provider sends our accounting team its commission invoice with that person’s name; accounting asks our service, with this name and, as far as the provider gives them, with the email address and the postcode, who referred the person. The service compares the name and the postcode with the stored checksums and the email address with the address of the account, to find the right match; it does not store the query. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in billing a claim that has already arisen. The legal basis for the payout itself is Article 6(1)(b) GDPR (the participation terms of the program); we base the retention of records and of a US tax form on Article 6(1)(f) GDPR, our legitimate interest in defending against claims and in meeting the company’s tax obligations. If the payout requires a US tax form, its details are added (among others nationality, tax ID, date of birth and your signature, that is the name you type for it; for a company the details of the company, form W-8BEN-E). They go in the same request as the other details, as an email to accounting, and at the sending service Brevo a new entry has had no preview with the text since the change on 19 October 2026, whether Brevo keeps the text anyway, we do not know; for older entries Brevo no longer displays the preview but can still send the email again with its text, so the text is still held there; in our account it is set that the entries are deleted after one month, the effect is not confirmed, until the contract with it ends Brevo can keep entries, after that it destroys the data on request within three months, if no law requires longer retention (section 4). The ten years in our accounting are no upper limit for these details at Brevo, because the end of the contract can lie more than ten years ahead. The service does not store them. Where US tax law requires it, the company reports payments to the US tax authority, for a recipient in the USA with name, address, tax ID and amount (Article 6(1)(f) GDPR, our legitimate interest in meeting the company’s tax obligations); whether that applies to your payout depends on the form. The participation terms of the program are here (in German).

12. Recipients and countries

These recipients receive details from us or through our service, for the function at which they are named in this statement: for the website, the app and the service Netlify (website and app) and Infomaniak (service and mailbox); for emails the sending service Brevo (the service uses Resend only if Heldena switches to it); for payment and subscription Stripe or, if you choose PayPal when paying, PayPal; for payouts PayPal, for payouts and for the overview of refunded payments our accounting team (a server at Infomaniak) and, where US tax law requires it, the US tax authority; for questions in the app and on the website and for the classification Anthropic; for connections Alchemy, Twelve Data and Binance (for older versions of the app Covalent); for push messages the push services of the browser makers. In addition there is a further provider for the encrypted copies of the service, once they are set up, and one or more people who keep the key to those copies and can read them with it; who they are has not been decided (section 13).

Our accounting is a server at Infomaniak. The people we put in charge of it have access, and an external trustee if we appoint one; who keeps the books has not yet been decided. Once the regular run is set up, accounting fetches reports from Stripe about turnover, fees and payouts and keeps them for ten years, without deleting them earlier, even if you ask Stripe to delete your data. The purpose is records for bookkeeping and the defense of claims; the legal basis is Article 6(1)(f) GDPR. You can object to it (section 14); accounting handles the objection by hand. When the service reports an event to us, for example a payment that could not be assigned, it sends an email to our mailbox, through Brevo, with the account number and the identifiers of the session, the subscription, the customer or the payment at Stripe or PayPal and, for a refund, the amount, no names; the basis is Article 6(1)(f) GDPR, our legitimate interest in stable operation and in billing, and you can object to it (section 14).

Brevo itself produces, from our plain-text emails, an HTML part with a tiny image that reports whether an email was opened. According to our observation on 29 July 2026, this open tracking cannot be switched off at Brevo for transactional emails, only anonymised; in our account anonymisation is switched on (seen on 18 October 2026): with it, Brevo shows us neither the email address nor the IP address of the recipient for opens and clicks; the time and the count remain. What Brevo itself collects and stores when the image is fetched, and whether anonymisation already applied to earlier emails, we do not know. Under Brevo’s contract the tracking collects metadata related to the recipient’s email address: IP address, timestamp, click log and open log; Brevo does not inform the data subjects and does not collect their consent on our behalf. We have set no legal basis of our own for it; whether section 25(1) TDDDG applies to this image we have not checked. This concerns the emails of our service to owners, trusted people, people receiving a payout and the answer to people who entered a reply address in the error dialog, not the website; the section “What we do NOT do on this website” expressly refers only to the website.

Alchemy (Alchemy Insights, Inc., USA): For a wallet connection, Alchemy receives the public wallet address, the network and the IP address of our service. Alchemy’s contract consists of its terms of service and a data protection addendum; both are at legal.alchemy.com (terms of service of 27 June 2025, addendum of 30 June 2023). According to our information the account at Alchemy is in the name of Heldena LLC, which is thereby the contracting party of Alchemy; Alchemy’s terms also bind the person who acts for an organization. In this contract Alchemy describes itself as a processor of its contracting parties, that is, as a company that processes data on the instructions of another, and names IP addresses, wallet addresses and information stored on a blockchain as the data it processes in doing so. Alchemy’s contract also allows Alchemy to process the requests for its own internal purposes: to build or improve its services and related products, to detect security incidents and to protect itself against fraudulent or unlawful activity; data derived from the requests in de-identified form it may use for every lawful purpose. In our assessment, Alchemy decides for itself on these purposes of its own and is to that extent a controller itself; the permission is in the terms that apply to our account at Alchemy. Which legal basis Alchemy has for this is for Alchemy to determine, and we do not know it; whether we are thereby joint controllers with Alchemy we have not checked. We base the passing of the request on to Alchemy, to the extent that it serves the retrieval of your holdings, on Article 6(1)(b) GDPR, because the connection is part of your subscription. Because Alchemy’s contract additionally allows Alchemy these purposes of its own, for this part of the passing on we also name Article 6(1)(f) GDPR: on our legitimate interest in offering you the connection on the terms on which Alchemy supplies it, and on Alchemy’s legitimate interest in the security and improvement of its service. Whether the passing on is necessary for Alchemy’s purposes of its own we have not demonstrated; we have not made a comparison with providers without such purposes. Until this is settled it is open whether Article 6(1)(f) GDPR supports the passing on for these purposes; if it does not, a legal basis is missing for that part. We have weighed this against your interests, including the wide purposes stated further above and the long retention at subprocessors stated further below (the app does not yet point to Alchemy when you set up a connection; this section is the place where it is stated): Alchemy receives in the request only the public wallet address and the network, not your name, your email address, your account number or the IP address of your device (it sees the IP address of our service and recognizes from the key of our service that the request comes from Heldena); you set up the connection yourself, and a connection that you set up before the provider was changed runs through Alchemy with the current app version instead of Covalent; you can disconnect it. You can object to this passing on, which rests on our legitimate interest (section 14). The queries at Alchemy cannot be switched off for a single account in a targeted way without ending the subscription or the account: we have not built a block for a single account. You end the passing on by disconnecting the connection in the app; after that the service no longer queries Alchemy for it (a device that has not yet picked up the disconnection keeps querying). You can direct requests about the data that we have given to Alchemy to privacy@heldena.com; Alchemy’s privacy notice excludes customer data from its scope and refers requests about it to the respective customer, that is, to us; we have not read its other sections. Alchemy uses subprocessors, that is, companies that Alchemy itself engages, for example for cloud servers, monitoring of the technology and storage of data; its list is at alchemy.com/policies/dpa/subprocessors. For requests and logs the list (version of 13 August 2026, read by us on 11 October 2026) names, depending on the subprocessor, that the data is only passed through, stays for 7, 30, 60 or 90 days, stays until an incident is resolved, or stays until deletion is requested. How long Alchemy itself keeps them is not stated in the contract as a number: Alchemy processes the data for as long as the contract runs and deletes it afterwards on the written request of its contracting party, provided that no law requires it to keep it; it deletes backup copies according to a retention schedule that we do not have.

Countries: the service runs in Switzerland; for Switzerland the European Commission has found an adequate level of protection (Decision 2000/518/EC). Anthropic processes in the USA and may process worldwide; the basis is standard contractual clauses, whether they apply is open, and otherwise your consent (section 6 and section 3). Brevo names in its contract standard contractual clauses with supplementary measures and, for the USA, the EU-US Data Privacy Framework for as long as it is valid (section 4). Alchemy has its seat in the USA, and most of its subprocessors give an address there in Alchemy’s list. For transfers from the EU, Switzerland and the United Kingdom to the USA the data protection addendum names standard contractual clauses; these are contract terms set by the European Commission for passing data to countries outside the EU (Decision (EU) 2021/914, in the version for passing data from a controller to a processor); we base the transfer to Alchemy on these clauses (Article 46(2)(c) GDPR). Two questions are open: whether Alchemy’s processing is itself subject to the GDPR (the decision provides the clauses for recipients whose processing is not itself subject to the GDPR, and in the view of the European Commission they do not fit others; on its page on the clauses the Commission names a further set of clauses for that case as in preparation, read on 11 October 2026), and whether the clauses that bind Alchemy as a processor also cover its own purposes. We have decided neither. If the first question applies, the clauses do not carry the transfer, and we would have no safeguard for it under Chapter V of the GDPR (the rules for passing data on to countries outside the EU). In the public list of the EU-US Data Privacy Framework a search for the name “Alchemy” on 11 October 2026 among the active participants found only an entry “Alchemy Cloud Inc.” in San Francisco; its profile names no further covered entities, and in a search for the name we found Alchemy Insights, Inc. neither among the active nor among the inactive participants; we did not search other spellings or the address. We therefore rely on no adequacy decision of the European Commission for Alchemy. For Netlify and the other recipients (Stripe, Covalent, Twelve Data, Binance, the push services and PayPal) and for Resend, the provider of the copies of the service and an external trustee, if Heldena uses them, we name no safeguard here. For the US tax authority there is no adequacy decision; the disclosure serves a duty of the company under US tax law. On request to privacy@heldena.com you get information on the safeguards and, as far as we have them, a copy.

13. How long

Your account and the encrypted copy of your vault remain as long as the account exists and, after a deletion, for 30 days; until then you can take the deletion back. The account stays longer while a requested payout has not yet been carried out, while the deletion of your customer entry at Stripe has not succeeded (if you had a subscription) and while the handover of the records to accounting has not succeeded (if your account had a balance from referrals); the service then tries again. If nobody deletes the account, for example because the owner has died, the details stay until we delete it; we have not set a period for that. The subscription invoices in your account are deleted with the account.

The purpose of the copies is to restore the service after an outage; the legal basis is Article 6(1)(f) GDPR, our legitimate interest and yours that your vault survives an outage. We do not take single accounts out of existing copies, not even after an objection: a copy is a snapshot of the whole database and expires after the periods in the next sentence. If the service makes copies of its data, they are encrypted and are deleted after set periods. A deleted account therefore stays in such copies for a while: as planned, up to about 40 days after the permanent deletion, and in a copy held by the person who keeps the key for it on behalf of Heldena and can read it with that key (a human, not a server), until that person’s next trial restore, which is planned at least every 120 days. If the service is restored from a copy, an account that you deleted after that copy can return; such an account stays until you delete it again, and you are not told automatically. The data that the service held before a restoration is kept aside; it is deleted by hand, planned after 30 days.

The row of the referral stays for up to two years after the deletion. Details about payouts and records for bookkeeping, including the commission invoices of investment providers with the name of the referred person, are kept in our accounting for up to ten years (section 11 and section 12). Our accounting team keeps a US tax form for as long as US tax law requires; we name no fixed figure here. For every payout and every action of accounting on it, the service keeps an audit trail (time, access of accounting, action, record identifier, amount and payment identifier, without names; for a US tax form the date of the signature and its validity or the reason for a rejection); the legal basis is Article 6(1)(f) GDPR, our legitimate interest in being able to show what was paid out. We have set no deletion period for the audit trail; it remains even after the account is deleted. You can object to these retentions (section 14).

The monthly sum of the community total and the number of contributions stay without a fixed period, even if you withdraw your consent or delete your account; they carry neither your name nor your account number (section 5). The note on your account for which month your contribution counts stays even after you withdraw your consent, until your account is deleted; the legal basis is Article 6(1)(f) GDPR, our legitimate interest in a contribution not counting twice in one month; you can object to it (section 14).

We do not store questions to Asking Heldena in the app and to the question chat on the website and the classification (section 6 and section 3). The count value of the question chat on the website is held in the memory of the service and is gone by midnight (UTC) at the latest, and earlier if the service restarts (section 3). Our service does not store the email address of a trusted person or of a person receiving a payout; the owner’s email address is held on the owner’s account (section 5). The sending log of the sending service holds among other things the subject and the recipient of the messages that the service sends, and for older entries the text; in our account it is set that the entries are deleted after one month; on 18 October 2026 the log still held entries that were older than one month, and until the contract ends the sending service can keep entries (duration and limit: section 4). We have set no period for the mailboxes in which the reports to us arrive (the operating mailbox and the team mailbox; in the operating mailbox Infomaniak empties the trash and spam folders by itself after 30 days, for the team mailbox we do not know); we keep the emails for as long as we need them for handling (the email about an error report from the app carries neither the text nor the address, section 7); the message with which someone withdraws an error report from the app we delete as soon as we have carried out the withdrawal and answered (section 7). For the logs of the web server and of the service, what is written in section 5 applies, and for the hosting service of the website, the hosting service determines the period (section 2). The service holds the text of an error report from the app and the address you could enter with it not in the mailboxes but in rows of their own: it deletes the row with the text after 90 days; it deletes the row with the address as soon as it has answered, usually 30 days after your report, longer if there are very many reports or sending fails, after 90 days (the cleanup run comes every 5 minutes by default), even without an answer; in addition there are, once they exist, the copies of the service and the sending log of the sending service, with the periods stated in this section (section 7). The two tables in the memory of the service that limit the retrieval of wallet balances: the counters run in windows of 10 minutes and 24 hours, a pause lasts 24 hours; an expired entry stays in memory until it is cleaned up or the service restarts, and an expired pause can begin again at once at a further such result (section 5).

14. Your rights

You have the following rights against us: access to the data processed about you (Article 15 GDPR), rectification of inaccurate data (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on legitimate interests (Article 21). You can withdraw a consent at any time with effect for the future (Article 7(3) GDPR); in the app you do this in the settings, in the question chat on the website with the “Withdraw consent” button in the window; a sent error report you withdraw by writing to us and naming the time of the report or, as long as we have not answered you yet and you entered an email address, that address (section 7). For everything else, contact privacy@heldena.com. You can delete an account in the app; if you no longer have a device, write to us from the email address of your account, and we delete it after your confirmation (Article 17 GDPR).

Notice of your right to object

Against processing that we base on Article 6(1)(e) or (f) GDPR, you can at any time lodge an objection on grounds relating to your particular situation (Article 21(1) GDPR). Point (e) concerns tasks carried out in the public interest or in the exercise of official authority; we currently base nothing on it. Send your objection to privacy@heldena.com.

Your right to object

You can object at any time, on grounds relating to your particular situation, to every processing that we base on our legitimate interest (Article 6(1)(f) GDPR) (Article 21(1) GDPR). That is every processing for which this statement names Article 6(1)(f) GDPR as the legal basis. For the copies of the service (section 13) we do not take single accounts out of them and rely on Article 21(1) sentence 2 GDPR for this. The request at the start of the app serves to find out whether our service has set up the reporting of errors of the app; our legitimate interest (Article 6(1)(f) GDPR) is to offer it in the app as soon as the service has set it up. The request (section 7) carries no account number and no identifier of your device, but its IP address and the name of your browser are in the access log of the web server (section 5), and what the service sees on the connection and how it counts requests by sender address is also stated in section 5; you can object to the request on grounds relating to your particular situation (Article 21(1) GDPR). The app cannot switch it off for individual people, because it runs at the start of the app (at every start of the app and at every reload); someone who does not start the app does not trigger it. How we would comply with a successful objection to this request, we have not yet determined. Whether we have to end the request after an objection depends on Article 21(1) sentence 2 GDPR: it matters whether we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or whether the processing serves the establishment, exercise or defense of legal claims; we assess that case by case. We examine your objection individually and tell you how we decided and why. For orientation: the IP address of your device reaches the web server with every request, otherwise it could not answer. That it then keeps this IP address in its access log for at most 20 days (under the settings of 19 October 2026; section 5) serves the defense against attacks and troubleshooting. Whether the defense against attacks and troubleshooting, the purpose of the access log, prevail in your case, we assess under the standard of Article 21(1) sentence 2 GDPR (compelling legitimate grounds that override your interests, rights and freedoms) once we know your grounds. You send an objection to privacy@heldena.com. For the passing on to Alchemy (section 12) it is implemented by the queries for your connection stopping; that happens as soon as you disconnect the connection in the app. We have not built a block for your single account at Alchemy; an objection by email alone does not end the queries, and until you disconnect the service keeps querying, and so does a device that has not yet picked up the disconnection. What Alchemy has received until then stays with Alchemy for as long as the contract with Alchemy runs; the subprocessors keep it for the periods in section 12. Whether Alchemy deletes single requests earlier if we ask it to, we have not clarified. For the note that our service accepted the sending of a message about a case to you, with a tool of our own we delete the notes about messages to the trusted people of the account concerned, if you give us the address of the owner and it identifies one account unambiguously (otherwise we delete nothing). How this works and where it ends is stated in section 10, in the paragraph “Your right to object as a trusted person or heir”. If you object to being reached itself, that is, to the messages that our service sends you as a trusted person, we have not built a block for your email address in the service. Turn to the owner of the circle you are entered in (with several circles, to each of them): they can remove you from their circle; the app tells them if that does not work yet (what remains at the service after a removal is stated in section 10). When the devices of the other members no longer have you in the directory after that depends on when the owner’s app updates the circle and the devices have picked up the new directory; the service may still send you a message about the removal itself. For all other processing the following applies: after an objection we no longer process the details for this purpose unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

Complaint and providing the details

Independently of that, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). You can turn to the supervisory authority responsible for your place of residence, your place of work or the place of the alleged infringement.

You are not legally obliged to give us details. For an account and a subscription we need the details named in the sections “App and service” and “Subscription and payment”; without them we cannot perform the contract. Which fields of a form are required is stated at the form; without them we cannot handle the request or the declaration.

15. Changes and date

We adjust this statement whenever something changes in the website, the app or the services behind them that is relevant to data protection (for example a new recipient or a new function). The date is given in the line under the title.

The terms of use for app and subscription are here.