Privacy policy

Who is responsible for your data

The controller of your personal data is George Vatalis, trading as HeWho, a sole proprietorship based in Athens, Greece. For anything about your data, write to hello@hewho.gr. We have not appointed a data protection officer, as the law does not require one for a studio of our size; the same address reaches the person responsible.

What we collect, and why

We only receive personal data that you choose to send us, plus the technical minimum any website needs to serve a page.

• The contact form. Your name, your email address and your message. We use them to reply and, if you ask for one, to prepare a quote. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• The free trial request. Your name, email address, phone number and type of business. We use them to call you and set up your trial. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)).
• The chat with our AI (the chat window and the Ask our AI page). The messages you write, and your name and email address if you leave them so we can follow up. We use them to answer your questions, to hand the conversation to a person when the AI cannot help, and to improve our answers. Legal basis: our legitimate interest in answering questions about our services (Art. 6(1)(f)). Please do not share sensitive information (health, finances, identity documents) in the chat.
• Technical data. When your browser loads a page, our hosting providers necessarily receive your IP address, the page requested, your browser’s user agent and the time. They keep it in server logs for security and to keep the site running. Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f)).

Submissions from the contact and trial forms are filed as conversations in our own customer-support console (the same system our AI agent runs on), where we read and answer them. You are not obliged to give us any of this data, but without an email address or phone number we cannot reply.

The AI in the chat

The chat is answered by an AI model, not by a person, using HeWho’s own published content. Its answers can be wrong and are not binding offers. It makes no decisions about you that have legal or similarly significant effects (Art. 22 GDPR); when it cannot help, it passes the conversation to us.

Each message you send is processed by Anthropic, the provider of the AI model, only to generate the reply. Anthropic does not use data sent through its commercial API to train its models.

Who else processes your data

We use a small number of service providers who process personal data on our behalf, under data processing agreements that bind them to our instructions (Art. 28 GDPR):

• Vercel Inc. (United States) hosts this website and serves its pages.
• Hetzner Online GmbH (Germany, servers in the EU) hosts our customer-support system and AI agent, where your form submissions and chat conversations are stored.
• Anthropic PBC (United States) provides the AI model that writes the chat’s replies.
• Hostinger (EU) provides our email, if you write to us directly.

We do not sell your data, and we do not share it with anyone for their own marketing.

Transfers outside the European Union

Vercel and Anthropic are based in the United States. Transfers to them rely on the EU–U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary safeguards. You can ask us for a copy of the relevant safeguards at the address above.

How long we keep it

• Enquiries and trial requests: 24 months after our last contact with you. If you become a client, we keep what we need for as long as our contract runs and for as long as Greek tax and accounting law then requires.
• Chat conversations: 12 months after the last message.
• Server logs: kept by our hosting providers for a short period for security purposes, then deleted.

When the period ends we delete the data or anonymise it so it can no longer be linked to you.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict how we process it (Art. 18);
• receive the data you gave us in a portable format (Art. 20);
• object at any time to processing based on our legitimate interest, including the chat (Art. 21).

To exercise any of these, email hello@hewho.gr. We answer within one month, free of charge, and may ask you to confirm your identity first.

If you believe we have handled your data unlawfully, you also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, www.dpa.gr, or with the supervisory authority where you live or work. We would appreciate the chance to put things right first.

Security

Every connection to this site and to our support system is encrypted (HTTPS). Our databases are not reachable from the internet, and access to them is limited to the people at HeWho who need it to answer you.

Children

This site is meant for businesses. It is not directed at children under 15, and we do not knowingly collect their data.

Cookies

This site sets no cookies. What it stores in your browser, and why, is on the cookies page.

Changes to this policy

When our practices change we update this page and the date at its top. If a change affects data we already hold about you in a significant way, we will tell you directly.