Data Controller
Blue Gorilla Consulting LTD, whose contact details appear in the legal notice, is the data controller for processing related to hepaly.com. Contact: contact@hepaly.com, subject line Hepaly.
Data collected
We collect information necessary for processing orders: identity, email, cart contents, payment status, subscription status, digital consents, and customer service exchanges. Hepaly does not ask for a delivery address for PDFs. Stripe may collect information required for processing payments or fraud checks. Technical logs serve to secure the site. We do not request personal data regarding children to purchase a workbook. If you request your welcome code, we log your email address, chosen age group (ages 4–6 or 7–10, with no other child information), consent date, and sign-up page.
Why we process your data
Fulfilling your order and managing your subscription justifies processing PDF access and payment information. Accounting and tax legal obligations ground the retention of necessary invoices and receipts. Fraud prevention and security rely on our legitimate interest. The welcome discount code and our advice/offer emails (at most five messages over ten days, featuring an increasing discount) rely on your consent given during sign-up; you can withdraw it at any time using the unsubscribe link included in every email. These emails stop automatically upon your first purchase or as soon as you initiate checkout.
Service providers
Stripe processes secure payments; our Gabriel Group mailing servers, hosted by Hetzner, send order confirmations, access codes, and welcome emails. No digital order data is transmitted to Sendcloud or shipping carriers. Our Gabriel Group infrastructure centralizes orders and customer service. Hetzner hosts the site and Cloudflare provides website protection. Credit card data is processed directly by Stripe and is not stored on our server.
Cookies and local storage
Cart contents may be saved locally in your browser. Essential cookies secure access to your order and subscription. Your browser also remembers your promo code and welcome offer status. An internal traffic measurement system (Gabriel Group, without advertising or third-party sharing) records anonymized visits to improve the website. The website does not load advertising pixels by default. Embedded YouTube videos are loaded only when you click the corresponding play button; this action then connects you to YouTube according to its own privacy rules.
Data retention and access
Data is retained for the duration required for the commercial relationship, resolving claims, and meeting statutory legal requirements. Email sign-ups are stored until you unsubscribe, and for at most three years after our last contact. Access is limited strictly to staff and service providers who need it to perform their duties. Potential transfers outside the European Economic Area rely on mechanisms provided for by applicable regulations.
Your rights
You may request access to, rectification, erasure, restriction, or portability of your data according to legal conditions, and object to certain processing activities. Proportionate verification of your identity may be requested. You can file a complaint with the relevant data protection authority, such as CNIL in France.
Optional app add-on
If you choose the 30-day trial followed by €13.99 per month, Stripe stores your payment method for this separate subscription and processes its recurring charges. We store your explicit consent, its date and version, email address, subscription reference, status, and renewal dates. The account service of the app, published by Vision Publishing LLC, receives the email address and these entitlements to enable your sign-in across multiple devices. No data from a child's logbook is requested during payment. Parent account details, Apple or Google details, and optional backup features are described in the app's privacy policy. The app's confirmation email, trial expiration reminder, and payment or cancellation notices are used to perform this contract.