Privacy Policy

Heso Inc. (“Heso”, “we”, “us”) builds specialist AI models. This policy explains how we handle personal information collected through this website and through the email updates you can sign up for on it (together, the “Services”).

Heso is responsible for that information: we are its “controller” under the EU and UK General Data Protection Regulation and the organisation accountable for it under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). You can reach the person accountable for privacy at Heso, our Privacy Officer, at privacy@heso.ca.

This policy does not cover Soru-1 or any other product we release. Each will come with its own privacy terms, which we will publish before it is available.

Information you give us

• Your email address, when you sign up to hear about Soru-1 and Heso.
• What you write to us, if you email us: your name and address as they appear in the message, and its contents.

Information collected automatically

• Request logs. Like every website, ours runs on servers that record each request: your IP address, the date and time, the page requested, your browser and device type, and the page that referred you. Our hosting provider keeps these logs to deliver the site, keep it secure and diagnose problems.

What we do not collect

We do not use cookies, analytics tools, advertising pixels, session recording or any other tracking technology on this site, and we do not build profiles of visitors. Our fonts and images are served from our own site rather than from third parties. We do not ask for, and ask you not to send us, sensitive information such as health, financial or government identification details.

When you sign up, your browser keeps a masked note of the address (such as “a•••y@example.com”) in its own storage so that the page can show you are already on the list when you come back. That note stays on your device, is never sent to us, and is removed when you choose “Use another email” or clear your browser’s site data.

We do not receive information about you from other companies, data brokers or social networks.

We use personal information only for the purposes below. Where the GDPR applies, each purpose rests on the legal basis shown.

We do not use your information for advertising, sell it, or use it to make decisions about you by automated means. We do not use it to train AI models.

We email you only if you sign up. Every message identifies Heso and includes a working unsubscribe link, as Canada’s Anti-Spam Legislation (CASL) and similar laws require. Unsubscribing takes effect right away and we will not email you again unless you sign up again.

When you unsubscribe we keep your email address on a short suppression list, solely so that we do not write to you again by mistake. Ask us and we will delete that too.

We share personal information only in these cases:

• Service providers who process it on our behalf and under our instructions: our website host (Vercel Inc.) and our sign-up form provider (Formspree), along with the service we use to deliver our emails. They are bound by contract to protect it and may not use it for their own purposes.
• Legal requirements. When the law requires it, or to respond to valid legal process, protect the rights, property or safety of Heso or others, or investigate abuse of the Services.
• Business transfers. If Heso is involved in a merger, acquisition, financing or sale of assets, your information may pass to the new owner, who will remain bound by this policy, and we will tell you before it becomes subject to a different one.
• With your consent, in any other case.

We do not sell personal information, and we do not “share” it for cross-context behavioural advertising, as those terms are defined in California law.

Heso is based in Canada. Our service providers may store and process information in the United States, Canada and other countries where they operate, whose laws may differ from those where you live and may allow authorities there to access it.

When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision or on safeguards such as the European Commission’s Standard Contractual Clauses. You can ask us for details of these safeguards.

• Email address for updates: until you unsubscribe or ask us to delete it, and in any case no longer than we keep sending updates. After you unsubscribe, only the suppression record described above.
• Messages you send us: as long as we need to deal with them and any follow-up, then deleted.
• Request logs: for the limited period set by our hosting provider, then deleted automatically.

The site is served only over encrypted connections (HTTPS). Access to the sign-up list is limited to the few people at Heso who need it, and our providers maintain their own security programmes. No method of transmission or storage is completely secure, but if a breach ever puts your information at real risk, we will notify you and the relevant authorities as the law requires.

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct it if it is wrong;
• delete it;
• stop emailing you (or use the unsubscribe link);
• withdraw consent you have given, without affecting what we did before.

European Economic Area, United Kingdom and Switzerland

You also have the right to restrict or object to our processing, including processing based on our legitimate interests, and to receive your information in a portable format. You may complain to your local data protection authority, though we would welcome the chance to address your concern first.

Canada

You have the rights of access and correction under PIPEDA and applicable provincial law, and you may complain to the Office of the Privacy Commissioner of Canada.

California and other US states

Residents of California and other states with consumer privacy laws have the right to know what personal information we collect and how we use it, and to access, correct and delete it. We do not sell or share personal information, so there is nothing to opt out of; we nonetheless honour Global Privacy Control signals. We will not treat you differently for exercising these rights. You may use an authorised agent, who must show your written permission.

How to make a request

Write to privacy@heso.ca from the email address in question, or tell us how to reach you. We may ask for information to confirm it is you before acting. We respond within the time the law requires, usually within 30 days, and free of charge unless a request is manifestly unfounded or excessive.

The Services are not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us their information, contact us and we will delete it.

The site links to other websites, such as our LinkedIn page. Their owners decide how they handle your information, under their own policies; this policy does not cover them.

We will post any change on this page and update the effective date above. If a change materially affects how we use information we already hold, we will tell you by email before it takes effect and, where the law requires, ask for your consent.

Questions, requests or complaints about privacy: write to our Privacy Officer at privacy@heso.ca. For the terms that govern use of the site, see our Terms of Use.