Privacy policy

Last updated: 19 October 2026

Who is responsible

Enora Labs Limited, company no. 672022, 77 Camden Street Lower, Dublin D02 XE80, Ireland, is the controller of the personal data processed by Heru Cloud and heru-security.com. Contact: support@heru-security.com.

What we collect

• Your e-mail address, and whether (and when) you agreed to receive news about Heru.
• For each site you connect: its URL, its platform, its Heru version and the date of its last contact with Heru Cloud.
• For a subscription: the identifiers given by Paddle, its status, its number of seats, its billing period and its dates. We never receive your card details or your billing address: Paddle keeps them.
• The IP address of requests to Heru Cloud, used only to limit abuse: kept with a pending registration for at most 24 hours, and otherwise only as a one-way hash in short-lived counters.
• One cookie, set when you sign in to your account: it keeps you signed in for at most 30 days (8 hours without activity) and is strictly necessary for the account pages. No tracking or advertising cookie is used.

Heru running on your site does not send us your visitors' traffic, nor the content of its attack log.

Why, and on what basis

• To provide Heru Cloud and your subscription (performance of a contract).
• To keep the service secure and prevent abuse (our legitimate interest).
• To send you news about Heru, only if you agreed to it (consent, which you can withdraw at any time by writing to us).

Who else processes your data

• Paddle.com, our reseller and the Merchant of Record for all our orders, processes the payment and its data as an independent controller, under its own privacy policy.
• OVHcloud hosts Heru Cloud and our mail server.

How long

• Account, sites and subscription: as long as your account exists; you can ask us to delete it once no subscription is running.
• Pending registrations and sign-in links: at most 24 hours. Sessions: at most 30 days.
• Notifications received from Paddle: only their identifiers, types and dates, without personal data.

Your rights

You can ask for access to your data, its correction or deletion, a copy in a portable format, and you can object to or restrict its processing, by writing to support@heru-security.com. You can also lodge a complaint with the Data Protection Commission (Ireland) or the authority of your country.