Privacy Policy

• This Policy applies to personal information handled by Mighty Lucky Ventures Pty Ltd (ABN 51 653 328 628), trading as Heista (“Heista”, “we”, “us”) through heista.co, the Heista web app, the Heista API, the Heista browser extension and our communications (together, the “Service”).
• We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where other privacy laws apply to you, such as the GDPR, section 11 explains your additional rights.
• We do not sell personal information.
• Heista is a business tool. When an organisation puts personal information about other people into Heista, such as its clients, customers or staff, that organisation decides what is collected and why, and we handle that information on its behalf to provide the Service (see section 6).

You can choose not to provide some information, but we need account and billing information to provide the Service. Please do not upload the types of sensitive information listed in section 11.2 of our Terms of Service.

• To provide the Service: running the AI features you use, storing your workspace, showing your work to your workspace members, and processing payments.
• To bill accurately: recording usage and costs, issuing tax invoices and preventing billing fraud.
• To keep the Service secure: authenticating users, detecting abuse, enforcing usage limits and investigating incidents.
• To support you: answering questions and resolving problems.
• To communicate with you: service, billing and security messages, and product updates. You can opt out of marketing emails at any time; service messages are part of the Service.
• To run our partner and sales activities: reviewing Creative Partner applications, attributing referrals, and contacting businesses that may want to use Heista. You can ask us to stop contacting you at any time.
• To improve the Service: understanding how features are used and fixing errors, using analytics and aggregated information.
• To meet legal obligations, including tax record-keeping, and to establish or defend legal claims.

AI training

Heista does not use your content, prompts, uploads or outputs to train AI models. Section 5 explains how AI providers handle the requests we send them.

Automated decisions

Heista’s AI produces creative and strategic suggestions for people to review and decide on. Some routine decisions are made automatically by our systems, using your account, workspace, usage and billing information: whether an action can start, based on your Credit balance, plan allowances, member spending limits and rate limits; whether a request is blocked by an AI provider’s safety filters; whether to pause an action that looks like automated misuse; and pausing Credit spending while a payment is disputed with a bank. These checks affect only the action or payment in question. We do not suspend or close an account, or refuse a refund, by computer program alone; a person reviews those decisions. You can ask us to review any automated outcome by emailing us.

• Service providers. We use trusted providers for hosting, database and storage, AI processing, payments, email, analytics, support and security. They may only use personal information to provide their services to us. The current list, what each provider does and where, is on our Subprocessors page.
• Your workspace. Content you create in a workspace is visible to that workspace’s members according to their roles. Owners and admins can see the workspace’s usage and spend.
• Public decodes. When you decode an advertisement by public link, the analysis and a copy of the ad may be published in Heista’s Decoded Library. Files you upload are not published: decodes of ads you upload stay private to your workspace and are deleted with it.
• Connected services. When you connect a service such as a Meta ad account, information is exchanged with that service as you authorise.
• Legal reasons. We may disclose information where required by law, or where we reasonably believe it is necessary to protect the rights, property or safety of Heista, our users or others, or to prevent fraud or abuse.
• Business transfers. If Heista is involved in a merger, acquisition or sale of assets, personal information may transfer as part of that transaction, subject to this Policy. We will tell you before your information becomes subject to a different privacy policy.
• With your consent or at your direction.

• Each AI request contains what the task needs: your prompt, any references or documents you attach, and relevant context from your workspace, such as brand information.
• Requests are routed through our AI gateway provider, Vercel, to the provider of the model being used. Vercel does not retain or train on the requests that pass through its gateway.
• Text and chat requests carry an instruction that the provider must not train on them, and are only served by providers that have agreed to that. Image and video requests carry the same instruction wherever the provider supports it. A small number of providers do not offer this; they are identified on our Subprocessors page, and content sent to them may be used under their own terms.
• AI providers may keep requests for a limited period under their own terms, for example to detect abuse (commonly up to 30 days, and up to 55 days for some providers).
• When you upload a document, an AI model reads it so that Heista can extract its text, which is then kept in your workspace for your team’s AI tools to use.

Organisations using Heista may include personal information about other people in their workspace content, such as names, images or voices in briefs, references and uploads. The organisation is responsible for having the right to use that information and for giving any notices and obtaining any consents required. We handle that information on the organisation’s behalf, as its service provider (a “processor” under the GDPR), only to provide the Service, on its instructions and as described in this Policy. We do not use it for our own purposes, and we delete it with the workspace as described in section 8. If you are an individual whose information is in a customer’s workspace, please contact that organisation first; we will help where we can.

• Heista’s database, sign-in system and file storage are hosted by Supabase in Sydney, Australia. Our application runs on Vercel’s Sydney servers and is delivered through Vercel’s global network.
• Payments (Stripe), product analytics (PostHog), email delivery (Resend), support requests (Linear), affiliate tracking (the script that runs today is Rewardful’s) and rate limiting (Upstash) are handled by providers based in the United States.
• Media sent to some video models is placed briefly in Vercel’s file storage, at a temporary link that is deleted when the render finishes.
• AI requests are processed by the provider of the model being used, on whichever of its servers is available. Depending on the provider, this may be in the United States, Canada, Europe, the United Kingdom, Singapore, China or other countries. The Subprocessors page lists each AI provider and where it is based.
• Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through the contractual terms of the providers we use.
• Dedicated hosting in the UK, US or EU is available to Enterprise customers by agreement.

You can ask us to delete your analytics profile and support history at any time by emailing support@heista.co. The Data deletion page explains how to delete your account and connected data.

• Encryption in transit (TLS) on all connections, and encryption at rest (AES-256) for the database and file storage.
• Workspace isolation enforced by the database itself (Postgres Row-Level Security on every table), so one workspace cannot read another’s data.
• Private file storage for your uploads and workspace files, accessed through signed, time-limited links. Public ad-library media, workspace branding assets and some previews use public links.
• Multi-factor authentication on administrative access to our core infrastructure (hosting, database, source code and identity), and production access restricted to authorised personnel.
• Passwords checked against known breach data, and API keys stored only as hashes.
• A web application firewall, rate limiting and automated monitoring.

No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security.

Data breaches

If we become aware of a data breach that is likely to result in serious harm to individuals, we will assess it promptly and notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and other regulators where required.

The Heista API does not use cookies; it authenticates with API keys.

• Access and correction. You can ask for a copy of the personal information we hold about you, and ask us to correct it. You can update most account information yourself in Settings.
• Deletion. You can delete your account in Settings, or ask us to delete specific information. Some information is kept where the law requires (section 8).
• Marketing. You can unsubscribe from marketing emails using the link in any email.
• Anonymity. You can browse our public website without identifying yourself, but you need an account to use the app.

To make a request, email support@heista.co with the subject line “Privacy request”. We may need to verify your identity. We acknowledge requests within 5 business days and respond within 30 days. We do not charge for making a request.

If you are in the EU or UK

If the GDPR or UK GDPR applies to you, you also have the right to object to or restrict certain processing, to data portability, and to complain to your local data protection authority. We rely on performance of our contract with you, our legitimate interests in operating, securing and improving the Service, legal obligations and, where requested, your consent. The controller is Mighty Lucky Ventures Pty Ltd (ABN 51 653 328 628), trading as Heista.

• When you click save, the extension reads the ad or post you selected (text, images, video links, author and page address) and sends it to your Heista workspace.
• It stores your sign-in session in your browser so you stay signed in.
• It does not collect browsing history or keystrokes, does not run in the background on pages you don’t save from, and does not include analytics or third-party tracking.
• Permissions: storage (your session), activeTab and context menus (to save the page you choose), alarms (to refresh your session) and access to supported social sites (to add save buttons).
• The extension does not load remote code. It communicates only with Heista’s servers over HTTPS.

The Service is not intended for people under 18, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact support@heista.co and we will delete it.

We may update this Policy to reflect changes to the Service, our practices or the law. We will publish the updated Policy with a new “Last updated” date and, for material changes, notify you by email or in the app at least 14 days before they take effect.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. If you are in the EU or UK, you can also contact your local data protection authority.

Mighty Lucky Ventures Pty Ltd (ABN 51 653 328 628), trading as Heista. Australia.