Privacy

Last updated 22 October 2026

Heimiro is in development. These parts touch personal data: the waitlist, sign-in, the AIs you connect, your memory, the apps you connect, the workspace agent and bots, and payments. This page says what we keep, why, and for how long. We don’t use tracking, advertising or analytics cookies. We don’t sell your data, and we share it only with the providers named on this page, for the part they do.

Who is responsible

Visitt AS (org. no. 921404263), Uranienborg Terrasse 9, 0351 Oslo, Norway, is the controller. Questions or requests: hab@viit.no.

The waitlist

• We keep your email address, the time you signed up, and a short tag saying which link you came from.
• We use it for one thing: to email you when your invite is ready.
• The legal basis is your consent (GDPR article 6(1)(a)). You can withdraw it at any time by emailing us.
• We delete the address when you ask, when you delete an account that signed in with the same confirmed address, or at the latest 12 months after the public launch if you haven’t created an account.

Signing in

• You sign in with Google, GitHub or Microsoft. We never see your password. From them we get an account id, your name and your email address.
• We set one cookie to keep you signed in, and a short-lived one during sign-in. Both are strictly necessary.
• The legal basis is providing the service you asked for (GDPR article 6(1)(b)). We keep your account until you delete it on your account page, or ask us to.

The AIs you connect

• When you connect an AI, we keep the name it gives itself, the address it sends you back to, the workspace and permissions you chose, and when it was connected and last used. Its access keys are stored only as scrambled versions (hashes).
• For each call an AI makes, we log which AI it was, which tool it used, when, and whether it worked. Never what it saved or read.
• You can disconnect an AI on your Home page at any time. It loses access at once.

Your memory

• Your memory is what you and your connected AIs save: the text, an optional topic, which AI saved it and when. We use it for one thing: to give it back to you and to the AIs you connected.
• When one of your AIs reads a memory, it goes to that AI’s provider (for example Anthropic or OpenAI), under your own agreement with them. Only connect AIs you trust with it.
• Your memory is split into workspaces. An AI you connect sees one workspace, plus the core memories you choose to share with all of them. We keep the workspace names you choose and when you shared a memory.
• Please don’t let your AIs save passwords, health information or other sensitive data here.
• You can export your memory as a Markdown file from your Home page at any time, and take it wherever you like.
• The legal basis is providing the service you asked for (GDPR article 6(1)(b)). You can forget any memory on your Home page. AIs no longer see it, and we keep a copy for 30 days so you can undo it. After that the copy is deleted the next time anyone uses that personal or team space. Deleting a workspace deletes the memories saved in it, and their copies, at once. We keep the rest, and the log of calls, until you delete it or ask us to delete your account.

Cards on your board

• An AI you connect with the permission to pin cards can put a result on the board in its workspace: a title, the text, an optional link, which AI pinned it and when. We keep the column you move it to and when you last moved it. We use it for one thing: to show it to you, to the others in the same personal or team space, and to the AIs connected to that workspace.
• We don’t take cards with ID numbers, card numbers, keys or passwords after a label. This catches the common formats, not every one, so please don’t ask your AIs to pin sensitive data.
• The legal basis is providing the service you asked for (GDPR article 6(1)(b)). You can remove a card on your Home page, and it’s deleted at once. Deleting a workspace deletes its cards. Cards are in both exports. We keep the rest until you delete it or ask us to delete your account.

The apps you connect

• When you add an app to a workspace, we keep which app it is (or the name and address you gave a private app), the list of tools it shows, and the level you chose for each tool.
• When you connect your own account at an app, we keep the keys it gives us, encrypted, so your AIs can use the app for you. Each person’s keys are their own. If you add an API key yourself, we keep it the same way.
• When one of your AIs uses an app, we send the request to that app and pass its answer back to the AI. We don’t keep the request or the answer. The log has which AI, which app and tool, when, and whether it worked.
• When a tool needs your approval, we keep what the AI asked to send, so you can see it before you decide. We delete it 7 days after you approve or reject it, or 7 days after the request expires (a week after the AI asked), the next time anyone uses that personal or team space after that. We never keep the app’s answer.
• What you send to an app is handled by that app under its own terms, wherever it runs. The list of apps says where each app keeps its data.
• The legal basis is providing the service you asked for (GDPR article 6(1)(b)). Removing an app, or disconnecting yourself from it, deletes its keys at once. Deleting a workspace removes its apps.

The workspace agent

• When you give the workspace agent a task, we send the task, what the agent reads from your memory and your apps in that workspace, and the list of tools, to the AI model that runs the agent: Google’s Gemini on Vertex AI. By default (Global) it runs wherever Google has capacity, which can be outside the EU. An owner can choose EU only on the account page, and then it runs in Google’s EU region.
• If Gemini is overloaded or too slow, a backup model may answer instead: Anthropic’s Claude, directly from Anthropic on Global, or on Google’s Vertex AI in the EU when you’ve chosen EU only. It gets the same task and conversation. Google and Anthropic act as our processors, and under their terms for these services they don’t use the data to train their models. When the model runs outside the EU, the transfer is covered by the EU standard contractual clauses in their data processing terms.
• We keep the task, the agent’s plan and answer, which tools it used, and the changes it proposed with what they would send, so you can decide on them and undo them. The agent’s answer can repeat what it read; we try to hide ID numbers, card numbers, keys and passwords in it before we keep it, and the agent can’t save them to your memory. This catches the common formats, not every one, so please don’t give the agent passwords. We delete all of it 30 days after you gave the task, the next time anyone uses that personal or team space after that. We never keep what an app answered.
• Nothing the agent proposes happens until you approve it. The legal basis is providing the service you asked for (GDPR article 6(1)(b)).

Bots and automations

• When you make a bot, we keep its name and the job you wrote for it, in the workspace you chose, until you or an owner deletes it. When you schedule it, we keep when it runs, the time zone and the price per run you saw.
• Each run is a task like the ones you give in Work: the same model, the same rules, and kept for 30 days in the same way. What a bot wants to change waits for your approval. What it found shows on your Home page.
• We don’t send email about runs yet. If we start, this page will say so first.
• When you install a recipe, its bots and schedules are copied into your workspace as your own, like ones you made yourself, and kept the same way. Nothing links them back to the recipe.
• When you save a workspace as a recipe, we keep a copy of its bots’ names and jobs, your own schedules for them, and which apps from our catalog it has with the levels set there, for your personal or team space. Everyone in that space can see it. It stays until you or an owner deletes it, or the space is deleted; deleting the workspace it came from doesn’t delete it. Don’t put passwords or keys in a bot’s job: we refuse to save a recipe with them.
• When you describe a recipe, it’s a task like the ones you give in Work: your description goes to the same model, and the task and the proposed recipe are kept for 30 days in the same way. If you approve the proposal, it’s kept as a saved recipe, as above. Nothing is installed until you install it yourself.

Payments and credits

• When you pay, Stripe sells you the plan or the credits as the merchant of record, and handles your card, your address and the tax under its own privacy terms. We never see your card.
• We keep Stripe’s ids for your customer and your subscription, your plan, whether it’s active or ends with the paid period, which account paid for it, and a log of credits added and used, with the task that used them. We keep the log as long as your account exists, so you and we can check what you paid for, and delete it with the personal or team space it belongs to.
• When a subscription ends, we keep its Stripe id and the time it ended, and nothing else, so a late message from Stripe can never switch your account back to it.
• Deleting a team, or your account, cancels its plan at Stripe at once, so you’re not charged again. Stripe keeps the receipts as long as the bookkeeping law requires.
• After a personal or team space is deleted, we keep its id and when it was deleted, and nothing else, for 90 days. If a plan for it still reaches us, say from a checkout left open in another tab, we cancel that plan at Stripe as well. We delete the id the next time any space is deleted after the 90 days.
• If you pay for a team and leave it, or an owner removes you, its plan ends when the paid period ends, also if you go before the payment has gone through.
• When you choose a plan or buy credits, we send Stripe your email address, so the receipt reaches you, and our ids for your account and the team or personal space you pay for, so the payment is credited to the right place. We keep which account opened Stripe’s checkout page for a plan until the page expires, at most a few hours, so only that account is sent back to it.
• The free trial doesn’t need a card, and it’s once per account: we keep which account used it, in which space and when, for as long as the account exists. The legal basis is providing the service you asked for (GDPR article 6(1)(b)).

Teams

• In a team, everyone in it sees your name and your role, and the owners also see your email address. The team’s memory, workspaces and apps are shared by everyone in it.
• When an owner invites someone, we keep the email address and the role until the invite is used or cancelled, and at most 7 days. An expired invite stops working at once, and is deleted the next time anyone sends or opens an invite. We don’t send the invite: the owner gets a link and sends it themselves. We keep only a scrambled version of the link.
• An owner can remove you from the team. What you saved there stays with the team, and your AIs, app keys and automations there stop at once.

Server logs

Google Cloud logs each request to our servers: your IP address, the browser it says it is, the address on our site, and the time. We use the log to find faults and stop abuse, which is our legitimate interest (GDPR article 6(1)(f)). Google deletes it after 30 days. The log is kept in Google Cloud Logging’s global storage, not in Finland, so it can be outside the EU. We don’t log what you or your AIs send, only that a request was made.

Protection against abuse

To stop people from flooding the waitlist, guessing their way in or overloading your memory, we count attempts per IP address, per email address and per connected AI. We store only a scrambled version of each (a keyed hash), and delete it after two days.

So that one account can’t use up the AI for everyone, we also count the tokens the workspace agent and your bots use on our models each calendar month, per account, across all your personal and team spaces. Here too we store only a scrambled version of the account’s id (a keyed hash), with the month and the number, and keep it for the current and the previous month only. It isn’t anonymous: we hold the key, so it can be linked to your account, and if you’ve paid, also to the account id Stripe keeps with the payment after the account is deleted.

Where the data is

Your account, memory, workspaces and everything else in our database are stored with Google Cloud in Finland (europe-north1), in the EU, whichever choice you make for the AI. The backups are kept in Google’s EU multi-region. The server logs are the exception: Google keeps them in its global logging storage, which can be outside the EU (see Server logs). The choice for the AI only decides where the workspace agent’s model runs: wherever there’s capacity on Global, the default, or inside the EU on EU only. We keep the choice with your personal or team space. Google, and Anthropic for the backup model, act as our processors. When you choose a sign-in provider, that provider also handles your sign-in under its own privacy terms.

Your rights

You can see, correct or delete what we have about you, take it with you, and object to how we use it. Most of it you do yourself on your account page:

• Download everything you can see, in one machine-readable file: your account, the AIs you’ve connected, and in each personal or team space the memory, the cards on your boards, workspaces, apps, bots, recipes, tasks and requests. Keys and tokens are never in it.
• Leave a team. What you saved there stays with the team, your AIs lose access to it, and your keys to its apps, your automations and your requests that are still waiting go at once.
• Delete a team you own, with everything in it, for everyone in it.
• Delete your account, with your personal space and any team where you’re the only member. If you’re the only owner of a team with other people in it, delete that team first.

Deleting takes effect at once and can’t be undone. The data is gone from our backups within eight days, as they roll over. For anything else, email us. If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet).