Privacy Policy

1. Data Controller

Arda Kaan Özcan
Contact: hey@ardakaanozcan.com

2. Information We Collect

• Account Data: Email address. We authenticate you with passwordless magic links, we never store passwords.
• Payment Data: All payments are securely processed by our merchant of record, Polar.sh. We do not store full credit card details on our servers.
• Usage Data: IP address, browser type, device information, timestamps, pages visited, and interactions with the Service.
• Popup Content: Messages, images, and settings you create in the dashboard, and the interaction data of visitors who see your popups on your own websites.
• Cookies: Essential cookies (authentication) and, with your consent, analytics cookies. See Section 5.

3. How We Use Your Information

• Provide, maintain, and improve the Services
• Authenticate users and secure accounts
• Process subscriptions and payments via Polar.sh
• Deliver customer support and important Service-related notices
• Understand product usage and develop new features
• Comply with legal obligations and resolve disputes

4. Cookies

We use a consent banner so you can accept or reject analytics cookies. Essential cookies (such as your login session) are always required for the Service to work. You can also manage or delete cookies in your browser settings at any time; disabling them may affect certain functionality of the Services.

5. Analytics and Tracking

We use the following analytics and feedback services to understand and improve our product:

• PostHog, product analytics (US-hosted, us.posthog.com). Initialized only after you accept analytics cookies in our consent banner.
• Microsoft Clarity, session recordings and heatmaps that help us understand how visitors use the site.
• Inputly, a feedback widget that lets you send us feedback directly from the site.

Where these providers are located outside the EU/EEA (e.g. the United States), we rely on appropriate safeguards such as standard contractual clauses, or your consent.

6. Third-Party Service Providers

We share information only when necessary to operate the Services:

• Supabase: Database, authentication, and storage
• Cloudflare: Hosting and edge deployment
• Polar.sh: Payment processing, subscriptions, and merchant of record services
• PostHog: Product analytics (with your consent)
• Microsoft Clarity: Session recordings and heatmaps
• Inputly: Feedback widget

7. Data From Your End Users

When you install the HeyCustomer script on your own website, your visitors' devices may send data to HeyCustomer (such as page views and popup interactions) so the Service can function. In this relationship you are the data controller for your visitors, and HeyCustomer acts as a data processor on your behalf. You are responsible for informing your visitors about this processing in your own privacy policy.

8. Data Retention

We retain personal data for as long as your account is active or as needed to fulfill the purposes described in this Policy. Data may be deleted or anonymized upon request.

9. Security

All data is transmitted over HTTPS. Authentication is passwordless via magic links issued by Supabase. We employ access controls and routine security reviews.

10. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict processing of your personal data. To exercise any right, email hey@ardakaanozcan.com.

11. Contact

For any privacy-related questions, email hey@ardakaanozcan.com.