Last updated: 19 October 2026
Heralds Technologies Oy, Business ID 3622410-2, Finland ("Heralds", "we" or "us"), provides an AI workspace for company knowledge, conversations, connected applications, agents and automated workflows.
This policy explains how we process personal data when you use our website or service, communicate with us, represent a customer or prospective customer, or when we otherwise process your personal data as a controller. It also explains how information is handled within customer workspaces.
We act as a controller for personal data used to manage our own accounts, customer relationships, communications, security and business operations. When we process personal data on behalf of a customer and according to its instructions, we act as a processor. That processing is governed by our agreement with the customer and the applicable Data Processing Agreement. The customer's own privacy information explains its purposes and legal bases for processing.
You can contact us about privacy at privacy@getheralds.com.
Depending on how you interact with Heralds, we process:
We receive information directly from you, from your organisation and other authorised workspace users, from applications connected to Heralds, and automatically through operation of the service. Public-source research may use company websites, public registers, news sources, press releases and other publicly available information.
Workspace content may include information about colleagues, customers, email correspondents and other people who do not have a Heralds account. We aim to process only information relevant and necessary for the applicable purpose.
For processing where Heralds acts as a controller, we use the following legal bases as applicable:
| Purpose | Legal basis |
|---|---|
| Provide and administer a service you contract for directly | Performance of our contract with you |
| Manage access for a customer's staff, administer business relationships and provide support | Legitimate interests in delivering the agreed service and maintaining customer relationships |
| Protect accounts and systems, investigate misuse and maintain service reliability | Legitimate interests in keeping the service secure and reliable; legal obligations where applicable |
| Administer invoices, accounting and other legally required records | Compliance with legal obligations; contract or legitimate interests for related administration |
| Communicate with business contacts about Heralds | Legitimate interests in relevant B2B communications, or consent where required |
| Understand service performance and improve features | Legitimate interests in operating and improving the service, subject to the restrictions on connected-app data below; consent where required for non-essential tracking |
| Research public professional information where we determine the purpose | Legitimate interests in providing relevant business information, taking account of the individual's rights and reasonable expectations |
| Establish, exercise or defend legal claims | Legitimate interests in protecting our legal rights |
When relying on legitimate interests, we consider the impact on individuals and the safeguards needed to protect their rights. You may object to such processing as explained below. If processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
For customer-controlled workspace information, we process data on the customer's documented instructions. Connecting an application authorises technical access; it does not by itself establish the legal basis for every use of the information retrieved.
Connected applications make information available to Heralds so it can perform the workflows you configure. The information accessed depends on the application, permissions granted and workflow instructions.
Our Gmail read-only connection requests permission to view email messages and settings. It does not grant permission to send email, create drafts or delete messages in Gmail. This connection does not request access to Google contacts, birthdays, street addresses or phone numbers, although information contained within an email may include those details. The permissions shown during authorisation describe the access granted to that connection.
Google grants read access at mailbox level. Workflow instructions determine which messages Heralds requests and processes. For example, an email-monitoring workflow may use message content, sender and recipient information, subjects and timestamps to identify important messages and prepare a summary.
Relevant information may be processed by the integration, infrastructure and AI providers needed to perform the workflow. If you configure delivery to another application, such as Slack, email-derived information may be sent to that destination. Its membership, access controls and retention settings determine who can access the delivered information and how long it remains available.
You can disconnect an application in Heralds. You can also revoke Google access through your Google Account connections settings. Disconnecting prevents future use of that connection in Heralds. It does not automatically erase information already stored in Heralds or delivered elsewhere. Contact us for help with deletion requests.
Heralds' use and transfer of information obtained through Google APIs comply with the Google API Services User Data Policy, including its Limited Use requirements.
We use Google data only to provide or improve the user-facing features you request. We do not sell it, use it for advertising, or use it to train general-purpose AI models. Broader references in this policy to improvement, marketing or business research do not authorise those uses of Google data.
Transfers of Google data are limited to purposes permitted by Google's policies, including providing a feature you request. We restrict human access to circumstances allowed by those policies, such as your specific agreement to view particular information, a necessary security investigation or a legal requirement. General support access is not unrestricted permission to read email content. These restrictions also apply to Google-derived information in summaries and other outputs.
You can connect Meta Ads to Heralds by signing in with Facebook and approving the Heralds app. The app requests the ads_read, ads_management and business_management permissions for the businesses and ad accounts you choose during sign-in. Heralds uses Composio to manage the connection.
Through this connection, Heralds reads the ad accounts you can access and their campaigns, ad sets, ads, performance results (such as impressions, clicks, spend, reach and conversions) and change history, so it can answer your questions, prepare reports and monitor results in the workflows you configure. It can also make changes, such as pausing an ad or changing a budget, only when the connection's Review access settings allow it. Actions set to Ask wait for your approval, and blocked actions cannot run.
We use Meta data only to provide the features you request. We do not sell it, use it for our own advertising, or use it to train general-purpose AI models, and we do not share it with data brokers. Our use complies with the Meta Platform Terms and Developer Policies.
Removing Meta access and deleting data. To stop Heralds accessing your Meta data, disconnect Meta Ads under Connections in Heralds, or remove the Heralds app in your Facebook settings under Business integrations. To delete Meta data already stored in Heralds, such as reports and run records that contain it, email privacy@getheralds.com from the address you use with Heralds and say which workspace the request concerns. We confirm the request and delete the data within 30 days, apart from information we must keep by law. Where we hold the data on behalf of your organisation, we act on its instructions.
Heralds uses AI to research, analyse, summarise, classify and generate information from customer instructions, workspace content, connected applications and public sources. Relevant content may be included in requests to AI providers. The provider used depends on the feature and configuration.
Some knowledge content is converted into numerical representations, called embeddings, to support search and retrieval. These representations and associated content may be stored so that relevant information can be found in later interactions.
Using an AI model to process a request is distinct from training a model. The Google-data and Meta-data restrictions above apply whenever information from those services is involved.
Heralds does not use automated decision-making that produces legal or similarly significant effects on individuals within the meaning of the GDPR unless an appropriate lawful basis and safeguards are in place. Customers are responsible for deciding how they use outputs in their own activities and for meeting the legal requirements applicable to that use.
We do not sell personal data.
We use service providers for hosting, authentication, databases, file storage, agent execution, application integrations, AI processing, communications and operational support. The platform uses services including Vercel, Supabase, Agent37, Composio and Resend. AI processing may involve additional model providers, including OpenAI, TypeSafe AI and Cohere, depending on the feature and configuration. Other infrastructure supporting Heralds may include Contabo.
Only providers involved in the relevant processing receive the information needed for their role. We require appropriate data protection arrangements where providers process personal data on our behalf. Information about the providers relevant to your service and applicable safeguards is available by contacting us; customer subprocessor arrangements are governed by the applicable Data Processing Agreement.
Information is also shared with authorised workspace users and destinations according to workspace permissions and configured workflows. A recipient application may process delivered information under its own terms and the customer's arrangements with it.
We may disclose information to authorities where legally required, professional advisers where necessary, or parties involved in a potential merger, acquisition, financing or sale of our business, subject to appropriate safeguards.
Some providers may process information outside Finland or the European Economic Area. Where personal data is transferred outside the EEA, we use the measures required by applicable data protection law, such as a European Commission adequacy decision or appropriate contractual safeguards, including Standard Contractual Clauses and supplementary measures where necessary.
You may contact privacy@getheralds.com for information about relevant transfers and a copy of applicable safeguards, subject to necessary redactions to protect confidential information.
We retain personal data for as long as needed for the purpose for which it is processed. The applicable period depends on the category of information, the customer relationship, customer instructions and legal requirements.
Archiving an item is not necessarily permanent deletion. Disconnecting an application does not automatically remove previously retrieved information or copies sent to external destinations. Clearing browser storage does not remove server-side data.
Deletion processes must account for database records, files, runtime information, logs and provider-managed backups. Information in backups may remain until the applicable backup expires; any continued retention must have a lawful purpose and appropriate access restrictions. Where we act as a processor, return and deletion are governed by the customer's instructions and the Data Processing Agreement.
We use authentication cookies and browser storage to maintain sessions, remember preferences and workspace selection, and support the operation and security of the service. The application also caches parts of workspace content in your browser to improve responsiveness. Signing out clears the application's Brain cache. You can clear site data through your browser settings, although doing so may sign you out or reset preferences.
Our website offers analytics to help us understand how visitors use it. You can accept or decline analytics through the website's consent controls. Where consent is required for non-essential cookies or similar technologies, we obtain it before using them. Declining analytics does not prevent you from browsing the website.
We use technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These include access controls and measures to protect authentication and integration credentials. Access is limited according to operational need, and relevant providers must apply appropriate security measures.
No online service or method of electronic storage can be guaranteed to be completely secure.
Depending on the circumstances and applicable law, you may have the right to access your personal data, correct inaccurate information, request deletion, restrict processing, object to processing based on legitimate interests, receive certain information in a portable format, and withdraw consent where processing relies on consent.
You may object at any time to the use of your personal data for direct marketing.
To exercise your rights, contact privacy@getheralds.com. We may request information needed to verify your identity. Where we process information on a customer's behalf, we may refer your request to that customer and assist it in responding. We respond within the periods required by applicable law.
You may lodge a complaint with a competent supervisory authority, including in the EEA country where you live or work or where an alleged infringement occurred. In Finland, the authority is the Office of the Data Protection Ombudsman.
We may update this policy when our service, processing activities or legal requirements change. We will make the current version available and update the date above. Where required, we will provide additional notice of material changes.
Heralds Technologies Oy
Business ID: 3622410-2
Finland
Privacy contact: privacy@getheralds.com