Privacy Policy

Last updated: 2026-03-03

Who we are

Heist AS ("Heist", "we", "us") provides an autonomous penetration testing platform that enables customers to run continuous application security tests (the "Service"). This Privacy Policy explains how we collect, use, and protect personal data in connection with the Service and our business activities.

Heist AS is the data controller for the processing described in this policy. For questions about your personal data, contact us at privacy@heisthq.com.

Heist AS Org. nr. 935 833 973 Sandbrekkevegen 100 5225 Nesttun Norway

What this policy covers

This policy covers personal data we process in our role as data controller, meaning data we collect and use for our own purposes.

Heist also acts as a data processor on behalf of customers. That processing is governed by our Data Processing Agreement, not this policy. If your personal data is processed as part of a customer's use of the Service, please contact that customer. See Section 12 below for more detail.

The information we collect

Account and contact information

When you sign up for or use the Service, we process your name, work email address, role, company name, and any other contact details you provide.

Service usage

We process information about how you use the Service, including account activity, support enquiries, communications with us, and configuration settings.

Technical information

We process IP addresses, device and browser information, and log data for system administration, reliability, and security.

Website visitors

Our website (heisthq.com) is built on Framer and uses minimal analytics. We use PostHog for product analytics within the Service. You can manage cookie preferences in your browser settings.

Business contacts and prospecting

We collect contact information about potential customers from publicly available sources and third-party data providers in order to market our services. This includes name, work email, job title, company, and professional background. If you have not interacted with us directly but have received communication from us, your information was likely obtained from a publicly available source or a data enrichment provider. You can request deletion of this information at any time (see Section 10).

Event and newsletter subscribers

If you sign up for our newsletter or attend our events, we process your name, email address, job title, and company.

Why we process your data and on what legal basis

To deliver the Service (legal basis: performance of contract)

Creating and maintaining your account, granting access, delivering the Service, responding to support enquiries, and notifying you of changes to the Service or these terms.

To improve and secure the Service (legal basis: legitimate interest)

Improving the Service, its content, and user experience. Maintaining, monitoring, and strengthening security, preventing fraud and abuse. We consider that these interests do not override your privacy interests, given that we process only business contact information and service usage data.

To market our services (legal basis: legitimate interest)

Communicating with existing and prospective business customers about the Service. We use Loops for marketing emails. You can unsubscribe from marketing emails at any time. We consider that our interest in reaching relevant business contacts does not override your privacy interests, given the professional context and the ease of opting out.

To comply with legal obligations (legal basis: legal obligation)

Retaining records required by accounting legislation or other statutory requirements.

Who we share data with

We use service providers who perform services on our behalf. We have data processing agreements in place with each provider. These providers only process personal data according to our instructions and for the purposes described in this policy.

Our current providers include:

A full list of sub-processors that process Customer Data on behalf of our customers is available at heisthq.com/sub-processors. That list covers Heist's role as a data processor and is separate from the providers listed above.

International transfers

Several of our service providers are based in the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses and, where applicable, certification under the EU-US Data Privacy Framework.

We do not sell, rent, or exchange your personal data with third parties for their own purposes.

Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, and misuse. For details on how we secure the Service, see our security page at heisthq.com/trust.

Obligation to provide data

To create an account and use the Service, you must provide your name and work email address. Without this information, we cannot deliver the Service. All other data you provide is voluntary.

How long we keep your data

We retain personal data for as long as necessary to fulfil the purposes described in this policy.

Account data is deleted when you cancel your account or at your request, unless legal obligations require continued storage. Purchase and payment documentation is retained for five years in accordance with Norwegian accounting legislation. Prospecting data is deleted when you request it or when we determine it is no longer relevant. Marketing preferences are retained until you unsubscribe.

Your rights

Under the General Data Protection Regulation, you have the right to access the personal data we hold about you, to have inaccurate data corrected, to request deletion of your data, to restrict or object to processing, and to receive your data in a portable format.

To exercise any of these rights, contact us at privacy@heisthq.com. We may need to verify your identity before processing your request.

If your request relates to Customer Data processed on behalf of a customer, please contact that customer directly. We will assist customers in responding to such requests as required.

Complaints

You have the right to lodge a complaint with a supervisory authority. In Norway, the supervisory authority is Datatilsynet (datatilsynet.no). You may also complain to the supervisory authority in the EU/EEA country where you live or work.

Heist as a data processor

Heist tests customer applications using dedicated test accounts provisioned by the customer. During testing, our agents may incidentally encounter personal data that exists in the target application. Heist does not intentionally collect end-user personal data. Where personal data is clearly identifiable in findings, it is anonymised before storage.

Customers are the data controllers for Customer Data. Heist processes this data strictly according to customer instructions and our Data Processing Agreement, available at heisthq.com/dpa. A list of sub-processors involved in this processing is maintained at heisthq.com/sub-processors.

If you believe your personal data has been processed as part of a customer's use of the Service, please contact that customer.

Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available at heisthq.com/privacy-policy. We will notify users of material changes that affect how we process their personal data.

Contact

Heist AS Org. nr. 935 833 973 Sandbrekkevegen 100 5225 Nesttun Norway privacy@heisthq.com