Legal
Privacy policy
Last updated 8 October 2026
What Heberlis collects, why, and what you can do about it. The controller is Servolia LLC (trading as Heberlis), 30 N Gould St, Ste R, Sheridan, WY 82801, United States.
What we collect
- Contact form: your name and email, and if you give them, your business name, domain, topic, plan and message.
- Assistant: what you write to it is sent to Anthropic to produce the answer. We do not keep these conversations.
- Domain search: the name you type is sent to Vercel's registrar to check availability. The result is kept in memory for up to 10 minutes, with nothing linking it to you.
- Technical data: your IP address is used, briefly and in memory, to limit abuse; our host (Vercel) keeps technical logs for security and operations.
- Clients: your contact details, plan, invoices and messages to our team, and what we need to run your site, domain and mailboxes. They are kept encrypted in our storage (Vercel Blob). Questions you ask the assistant in the client area are sent to Anthropic with a summary of your account, and are not kept by us.
- Sign-in: we keep a fingerprint of each sign-in link we send (never the link itself) and the times of attempts, to limit abuse.
Why
To answer you and prepare an offer (steps before a contract, and legitimate interests), to provide the service you signed up for (contract), to protect the site from abuse (legitimate interests), and to keep accounting and tax records (legal obligation). We do not sell your data.
Cookies and measurement
Signing in to the client area sets one strictly necessary cookie (your session, 14 days at most), and your cookie choice is kept in a cookie (hb_consent, 6 months).
Only with your consent, we load the Meta pixel (Facebook, Instagram) on the public pages of this site, never in the client area or the admin. It sets the _fbp and _fbc cookies (up to 90 days) and sends Meta the pages you view and the fact that you sent the contact form (not what you wrote), with your browser's technical data. We use it to measure our ads and show them to people likely to be interested. Legal basis: your consent. For this collection we are joint controllers with Meta Platforms Ireland Ltd, which then processes the data under its own policy (facebook.com/privacy/policy) and may transfer it outside the EU. Refusing has no effect on using the site. You can withdraw consent at any time with the Cookie settings link in the footer.
Who processes your data for us
- Vercel: hosting of this site, technical logs, and the registrar for domains.
- Meta Platforms Ireland: the advertising pixel, only if you accept it (see Cookies).
- OVHcloud (France): hosting of our clients' sites and apps.
- Hetzner (Germany): backup storage.
- Supabase (Paris region): our clients' app databases.
- Resend: sending email (your acknowledgement, and the copy to our inbox).
- Google Workspace: our inbox.
- Telegram: an internal alert to our team for each message received, which carries your contact message (never the text of a data protection complaint).
- Anthropic: the assistant's answers.
- Stripe: card payments and invoices (we never see your card number).
- Zoho: our clients' mailboxes.
These providers are based in the United States among other places. Transfers rely on the safeguards they offer, such as standard contractual clauses.
How long
An enquiry: up to two years after our last exchange, unless you become a client. Client records: for as long as the service runs, then as long as tax law requires for invoices.
Your rights
You can ask for access to your data, correction, deletion, restriction or a portable copy, and you can object to processing (UK and EU GDPR). We offer these rights to everyone, whichever law applies to you. Write to hello@servolia.com; we reply within one month.
Complaints
If you are unhappy with how we use your personal data, you can complain to us online, by email to hello@servolia.com, or by post to Servolia LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. We acknowledge every complaint within 30 days, investigate it, and tell you the outcome. You may also complain to the data protection authority that covers you:
Which law protects you depends mainly on where you are. The UK and EU rules apply to us because we offer our services to people there; the UAE and Saudi laws also cover data about people in those countries that is handled from abroad.
The DIFC and ADGM financial free zones in the UAE have their own data protection laws and regulators. If your business is established in one of them, its regulator may be the one to contact.
Whatever law applies, we handle every request and complaint the same way. If you are unsure which authority to contact, write to us first and we will tell you which one we believe is competent; you can always contact an authority directly.
- In the United Kingdom: UK GDPR and the Data Protection Act 2018. Authority: Information Commissioner's Office (ICO), ico.org.uk/make-a-complaint.
- In France or elsewhere in the EU: the EU GDPR, which applies to us because we offer our services to people in the EU. Authority: the CNIL in France, or the authority of the EU country where you live or work, cnil.fr/fr/adresser-une-plainte.
- In Spain: the EU GDPR and Spain's Organic Law 3/2018 on data protection (LOPDGDD). Authority: the Agencia Española de Protección de Datos (AEPD), aepd.es.
- In Belgium: the EU GDPR and the Belgian law of 30 July 2018 on the protection of personal data. Authority: the Belgian Data Protection Authority (APD / GBA), autoriteprotectiondonnees.be.
- In Morocco: Law No. 09-08 on the protection of individuals with regard to the processing of personal data. Authority: the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP), cndp.ma.
- In the United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL), in force since 2 January 2022. Authority: the UAE Data Office, the federal data regulator set up by Federal Decree-Law No. 44 of 2021, u.ae (data protection laws).
- In the Dubai International Financial Centre (DIFC): the DIFC Data Protection Law, DIFC Law No. 5 of 2020. Authority: the DIFC Commissioner of Data Protection, difc.com (Commissioner of Data Protection).
- In Abu Dhabi Global Market (ADGM): the ADGM Data Protection Regulations 2021. Authority: the ADGM Office of Data Protection, adgm.com (Office of Data Protection).
- In Saudi Arabia: the Personal Data Protection Law (PDPL), issued on 16 September 2021. Authority: the Saudi Data and Artificial Intelligence Authority (SDAIA), which takes complaints through its National Data Governance Platform, dgp.sdaia.gov.sa.
Children
Our services are not for people under 18.