1. Overview

Slickful Group LLC ("we," "our," or "us") operates heatm.app (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our heatmap analytics service.

We are committed to protecting your privacy and ensuring compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2. Data We Collect

2.1 Personal Information

• Account Information: Email address, name (if provided)
• Authentication Data: Google OAuth profile information (name, email, profile picture)
• Contact Information: Email address for support and service communications

2.2 Website Analytics Data

• Website Information: Domain names, page URLs, page titles
• User Interactions: Mouse movements, clicks, scroll depth, time on page
• Device Information: Screen resolution, device type, browser type
• Session Data: Session duration, page views, interaction patterns
• Performance Data: Page load times, interaction timing

2.3 Technical Data

• Log Data: IP addresses, browser type, operating system
• Cookies and Tracking: Session cookies, authentication tokens
• Usage Analytics: Feature usage, error logs, performance metrics

3. How We Use Your Data

3.1 Service Provision

• Provide heatmap analytics and user behavior insights
• Generate reports and visualizations of website interactions
• Maintain and improve service functionality
• Process payments and manage subscriptions

3.2 Communication

• Send service-related notifications and updates
• Provide customer support and respond to inquiries
• Send important account and security notifications

3.3 Legal Basis (GDPR)

• Contract Performance: Processing necessary to provide our services
• Legitimate Interest: Service improvement, security, and fraud prevention
• Consent: Marketing communications (where applicable)

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party services that help us operate our platform (Supabase, Google, Stripe)
• Legal Requirements: When required by law or to protect our rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Consent: When you explicitly consent to sharing

5. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit and at rest
• Secure authentication and access controls
• Regular security assessments and updates
• Limited access to personal data on a need-to-know basis
• Secure hosting infrastructure through Supabase

6. Data Retention

We retain your data only as long as necessary for the purposes outlined in this policy:

• Account Data: Retained while your account is active
• Analytics Data: Retained for the duration of your subscription
• Deleted Accounts: All associated data is permanently deleted within 30 days
• Legal Requirements: Some data may be retained longer if required by law

7. Your Rights

Under GDPR and other applicable laws, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for consent-based processing

To exercise these rights, contact us at support@heatm.app.

8. Cookies and Tracking

We use cookies and similar technologies to:

• Maintain your authentication session
• Remember your preferences and settings
• Analyze service usage and performance
• Provide personalized experiences

You can control cookies through your browser settings, but disabling them may affect service functionality.

9. Third-Party Services

We use the following third-party services:

• Supabase: Database and authentication services
• Google OAuth: Authentication and user profile information
• Stripe: Payment processing
• Netlify: Website hosting and deployment

These services have their own privacy policies, and we encourage you to review them.

10. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers, including:

• Standard contractual clauses
• Adequacy decisions by relevant authorities
• Appropriate technical and organizational measures

11. Children's Privacy

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us immediately.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending an email notification to registered users
• Displaying a notice on our service

Your continued use of the service after changes become effective constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: