Heatbot

GDPR overview

There is no GDPR implementation to report: the word GDPR appears nowhere on the site. The privacy policy, in force since 29 July 2024, lists the data collected and states a single purpose, but names no legal basis, no data subject rights such as access, rectification, erasure, portability or objection, no retention period, no data protection officer, no Article 27 representative, no data processing agreement and no subprocessor list. The only channel offered is hello@heatbot.io. The terms do state that the agreement is governed by the laws of Slovakia, an EU member state, which implies the regulation applies even though the vendor never addresses it. One detail weakens the document further: the children's privacy section names ShipFast, a different product, showing the policy was left as an unedited template.

Who owns the data?

Heatbot's terms are short on ownership. Section 2 states that buying a package grants the right to use the application and that you own the code Heatbot generates. Nothing is said about the screenshots and heatmap images you upload, so their status is left undefined. On the account side, the vendor collects your name, email address and payment details; payment information is not stored on its own servers but handled by third-party processors. The privacy policy limits sharing to what order processing requires and states that personal data is never sold, traded or rented to others. No retention period, no deletion procedure and no data ownership clause for uploads is documented.

Reuse rights

Because the terms hand ownership of the generated code to the customer, that output can be reused, modified, shipped and commercialised without asking Heatbot for permission; nothing in the documents reserves a licence back to the vendor. In the other direction, Heatbot states that personal data is used for the sole purpose of order processing, meaning order confirmations, customer support and status updates, and that it is shared with third parties only where order processing requires it, such as payment processors. Web cookies gather non-personal data such as IP address, browser type, device information and browsing patterns in order to improve the service. The uploaded screenshots and heatmaps are never mentioned in either document, and no use of customer material to train AI models is described, permitted or ruled out.

Data retention & training

Hosting summary

Heatbot publishes nothing about where customer data is hosted. There is no trust or security page, no hosting region or country is named in the privacy policy or the terms, and no infrastructure provider is mentioned anywhere on the site. The complete sitemap holds six URLs, so this is a documented absence rather than a page that was missed. The only jurisdictional statement available is in the terms, which say the agreement is governed by the laws of Slovakia; the publisher, RandomFour, LLC, gives no postal address on the site. One point is stated explicitly: payment information is not stored on Heatbot's own servers and is handled by third-party payment processors, which are never named. A network lookup places the domain's IP address on Amazon infrastructure in the United States, but that is an observation about the web server, not a vendor statement about where user projects, uploaded screenshots or generated assets are stored. Anyone with a hosting requirement will have to ask.