Privacy Policy

This Privacy Policy explains how HEUS ("we", "our", "us") collects, uses, shares and protects information in connection with our website at https://heus.pro, our products and services (including ChatGrw and any other software, integrations and automations we operate on behalf of ourselves and our clients), and our use of third-party APIs including the Google Ads API, Google Analytics, Google Tag Manager, Google Sheets and Google Drive.

We are based in Australia and operate under Australian Privacy Principles (Privacy Act 1988). When we handle data subject to other jurisdictions (e.g. GDPR in the EU, CCPA in California), we apply those requirements in addition.

1. Who this policy applies to

• Visitors to heus.pro and any other website we operate.
• Clients who engage HEUS to manage their Google Ads, Google Analytics, web properties, automations, or related marketing infrastructure.
• End users of our clients' websites whose data passes through tools we administer (e.g. a contact form on a client site that we configured).
• Developers and platforms we integrate with, including Google (Google Ads API, Google Analytics Data API, Google Tag Manager API).

2. Information we collect

2.1 Information collected directly from you

• Contact details you provide (name, email, phone number, company) when you contact us, request a quote, or sign up for a service.
• Account credentials and authorisation tokens you grant us so that we can administer your platforms on your behalf (for example, OAuth refresh tokens that allow us to access your Google Ads, Google Analytics or Google Tag Manager account with the permissions you have approved).
• Billing information when you become a paying client.

2.2 Information collected automatically when you visit our site

• IP address, browser type and version, device type, operating system, referring URL.
• Pages you visit, time on page, and interactions, collected through Google Analytics 4 and similar analytics tools.
• Cookies and similar technologies for analytics, ad measurement and basic site functionality. You can disable cookies in your browser settings.

2.3 Information we access through the Google Ads API and related Google APIs

When you authorise us to manage a Google Ads account, Google Analytics property, or Google Tag Manager container on your behalf, we access only what is necessary to perform that work, including:

• Campaign, ad group, ad, keyword, search term, conversion and budget data from Google Ads.
• Session, event, traffic source and engagement data from Google Analytics.
• Container, tag, trigger and variable configuration from Google Tag Manager.
• Sheets/Drive files you explicitly share or that our tooling creates on your behalf.

We do not use Google user data for advertising, training machine learning models, or any purpose other than providing the agreed services to you.

3. How we use information

• To deliver the services you have engaged us for (campaign management, analytics reporting, automation, custom development).
• To generate reports, dashboards and recommendations for our clients.
• To improve our own products and operations, in aggregate and de-identified form where possible.
• To communicate with you about our services, support, billing, and material changes to this policy.
• To comply with legal obligations.

4. How we share information

We do not sell personal information. We share information only in the following cases:

• Service providers we rely on to operate our business , for example Google (Cloud, Workspace, Ads, Analytics, Tag Manager), Supabase (database hosting), n8n (workflow automation), notification providers (email, SMS, WhatsApp), and similar infrastructure providers. These providers are bound by their own privacy commitments and act on our instructions.
• Our clients , where you are an end user of a website we administer for a client, your information is delivered to that client (for example, a lead form submission goes to the business that owns the website).
• Legal compliance , where required by law, court order, or to protect our rights, property or safety.
• Business transfers , in connection with a merger, acquisition or sale of assets, in which case we will require the recipient to honour this policy.

5. How we protect your information

• All communication with our servers and dashboards is encrypted in transit using TLS 1.2 or higher with HSTS enforced.
• Secrets, OAuth tokens and API keys are stored encrypted at rest with access restricted to authorised personnel and processes only.
• Production systems are hosted on hardened virtual private servers and audited cloud platforms (including Google Cloud and Supabase).
• We follow the principle of least privilege , each integration is scoped to the minimum permissions required, and access is revocable at any time by the account owner through the relevant platform (e.g. https://myaccount.google.com/permissions for Google).
• We log administrative actions and review them regularly.

6. Data retention

We retain information for as long as it is needed to provide the services and to comply with legal obligations. When you end an engagement with us, we will delete or anonymise your data within 90 days unless we are required to retain it (e.g. tax, accounting). You may request earlier deletion at any time using the contact details below.

7. Your rights

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your information (subject to legal and contractual retention requirements).
• Withdraw consent and revoke API access at any time (for Google APIs: https://myaccount.google.com/permissions).
• Lodge a complaint with the Office of the Australian Information Commissioner (https://www.oaic.gov.au) or your local data protection authority.

8. International transfers

The services we use (including Google) operate globally, which means your information may be processed in countries outside Australia. We require providers to apply appropriate safeguards consistent with this policy.

9. Children

Our services are not directed at children under 16 and we do not knowingly collect personal information from them. If you believe a child has provided us with information, please contact us so we can delete it.

10. Cookies and similar technologies

We use cookies for the purposes described in section 2.2. You can configure your browser to refuse cookies or to alert you when cookies are being sent. If you disable cookies, some features of the site may not function.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top, and where appropriate we will notify affected users directly.

12. Compliance with Google API Services User Data Policy

Our use and transfer of information received from Google APIs (including Google Ads, Google Analytics, Google Tag Manager, Google Sheets and Google Drive) adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request scopes necessary to provide the agreed service.
• We do not use Google user data for advertising purposes.
• We do not allow humans to read Google user data unless we have obtained explicit consent, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or our use is limited to internal operations and the data has been aggregated and anonymised.
• We do not transfer Google user data to third parties except as necessary to provide or improve the service, comply with applicable law, or as part of a merger, acquisition, or sale of assets with appropriate notice.