Privacy Policy

Last updated: March 28, 2026

HeatFries ("we," "us," "our") respects your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding that data. This policy applies to all users of heatfries.com and its services.

1. What Data We Collect

We collect minimal data necessary to operate the Platform:

Data	Source	Purpose
Email address	Google Sign-In	Account identification, credit tracking
Google user ID	Google Sign-In	Unique account linking
Profile name	Google Sign-In	Display in the UI
Credit balance & usage	Our system	Track purchased AI builder credits
Payment transaction IDs	NOWPayments	Verify purchases, prevent fraud
Bot build history	Our system	Credit deduction, audit

We do NOT collect:

• Your password (authentication is handled entirely by Google)
• Your Deriv.com account details, trading history, or account balance
• Your wallet addresses, private keys, or financial information
• Your location, IP address (beyond standard server logs), or device fingerprint
• Sensitive personal data (race, ethnicity, health, political beliefs, etc.)

2. How We Collect Your Data

We collect data in the following ways:

• Google Sign-In: When you sign in, Google provides us with your email, name, and user ID via a secure token (Google Identity Services). We do not see or store your Google password.
• Platform usage: When you purchase credits or build bots, we record transaction IDs and credit changes in our database.
• Server logs: Our hosting provider (Netlify) may collect standard web server logs (IP address, browser type, pages visited) for security and performance purposes. These logs are managed by Netlify under their privacy policy.

3. How We Use Your Data

We use your personal data for these specific purposes:

• Account management: To create your account, identify you when you sign in, and display your credit balance.
• Service delivery: To track your AI Builder credits, deduct credits when you build bots, and verify payments.
• Fraud prevention: To detect and prevent fraudulent transactions or abuse of the Platform.
• Platform improvement: To understand usage patterns (in aggregate, not individually) so we can improve the service.

We do NOT use your data for:

• Marketing emails or newsletters (we do not send any)
• Advertising or ad targeting
• Selling or renting to third parties
• Profiling or automated decision-making that affects you

4. Data Sharing

We share your data only with the following third-party services, which are necessary to operate the Platform:

Service	Data Shared	Purpose	Their Privacy Policy
Supabase	Email, user ID, credits	Database & authentication	supabase.com/privacy
Google	Authentication tokens	Sign-in verification	policies.google.com/privacy
NOWPayments	Email (for payment reference)	Payment processing	nowpayments.io/privacy-policy
Netlify	Server logs (IP, browser)	Hosting & CDN	netlify.com/privacy
OpenRouter / AI Provider	Bot configuration (no personal data)	AI bot generation	openrouter.ai/privacy

We do not sell, rent, or trade your personal data to any third party. We do not share data with advertisers. We will disclose data only if required by law or to protect our legal rights.

5. How We Store Your Data

• Where: Your data is stored in Supabase's cloud infrastructure (hosted on AWS). Servers are located in the United States.
• Security: Data is encrypted in transit (TLS/HTTPS) and at rest. Access to the database is restricted via row-level security policies — users can only access their own data.
• Retention: We retain your account data for as long as your account is active. If you request deletion, we will remove your data within 30 days (see Your Rights below).
• Payment data: We store only transaction references and payment status from NOWPayments. We do not store wallet addresses or private keys.

6. Cookies and Tracking

HeatFries uses minimal cookies:

Cookie / Storage	Type	Purpose	Duration
Supabase auth token	Essential	Keeps you signed in	Session / 1 hour
Google GIS	Essential	Google Sign-In functionality	Session

We do NOT use:

• Analytics cookies (no Google Analytics, no tracking pixels)
• Advertising cookies
• Third-party tracking cookies
• Social media tracking widgets

Since we only use strictly necessary cookies required for the Platform to function, no cookie consent banner is legally required under GDPR. However, we disclose their use here for transparency.

7. Your Data Protection Rights

Depending on your jurisdiction (including under GDPR, UK GDPR, and CCPA/CPRA), you have the following rights:

• Right to access: Request a copy of all personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure ("right to be forgotten"): Request deletion of your account and all associated data.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to us processing your data for certain purposes.
• Right to withdraw consent: Withdraw consent at any time (this does not affect lawfulness of prior processing).

To exercise any of these rights, email us at support@heatfries.com. We will respond within 30 days.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know: What personal information we collect and how we use it (described above).
• Right to delete: Request deletion of your personal information.
• Right to opt out of sale: We do not sell your personal information. No opt-out is necessary.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

9. Children's Privacy

HeatFries is not intended for anyone under the age of 18. We do not knowingly collect personal data from minors. If we learn that we have collected data from a person under 18, we will delete it immediately. If you believe a minor has provided us with personal data, please contact us at support@heatfries.com.

10. International Data Transfers

Your data may be transferred to and processed in the United States (where Supabase and Netlify infrastructure is located). By using the Platform, you consent to this transfer. We ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

11. Links to Other Websites

Our Platform contains links to third-party websites (Deriv.com, NOWPayments, Google). We are not responsible for the privacy practices of these sites. We encourage you to read their privacy policies when you visit them.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will indicate changes with an updated "Last updated" date at the top of this page. Your continued use of the Platform after changes constitutes acceptance of the revised policy.

13. Contact Us

For any privacy-related questions, data requests, or concerns:

Email: support@heatfries.com

Website: heatfries.com

If you believe your data protection rights have been violated, you also have the right to lodge a complaint with a data protection supervisory authority in your country of residence.