Privacy policy

Who we are

HeisenBERT (heisenbert.com) is operated by Chronic Qual SRL, Romania, tax ID (CUI) 29400617. We are the data controller for the personal data described here. For anything about your data, write to privacy@heisenbert.com.

What we collect

• Account: your email address and, if you sign in with Google or X, your name, profile picture (and X username).
• Sign-in security: for passkeys, only the public half of the key and the kind of device (the private key never leaves your device); for each signed-in device, its browser, IP address and last activity, so you can see and sign out devices in Account.
• What you say to Bert: your typed messages and the transcripts of what you say to him, his replies, and the results of helpers you start.
• Voice: while Bert is listening, your microphone audio is sent to our speech provider to be transcribed. In “Hey Bert” mode, listening for the wake word happens on your device, and only what you say after it is sent.
• Camera and screen: mixed on your own computer. Video only reaches us if you save a recording to your library or go live. Live video passes through our servers to the platforms you stream to, and is only stored if you choose to save a copy to your library (Creator and Pro).
• Uploaded videos (Creator and Pro): stored in your library like recordings, checked by our servers to make sure they’re videos, and deleted with the same rules.
• Editor transcripts: when you ask for a transcript of a recording, its audio is sent to our speech-to-text provider, and the words and their timings are kept with the recording until it’s deleted. Edits are rendered in your browser, and so is “Center on face” (the face detector runs on your device; no images are sent). Your edit in progress, and your intro, outro and logo, are saved to your account until you delete them or the recording. A thumbnail you publish is kept only until YouTube has it.
• Saved recordings (Creator and Pro), characters you design, their images and prompts, and your scene settings.
• Billing: your plan, credit balance and usage, and the invoices Stripe issues. Card details stay with Stripe.
• Developer features (Pro): API keys (stored only as a hash) and website chat settings. Messages from visitors to your website chat and their IP address, used for rate limiting.
• Invite links: when someone opens your invite link we count the click and the website it came from, and keep a salted, one-way hash of the IP address (to spot self-invites), never the address itself. A cookie (hb_ref, 60 days) remembers the invite until sign-up; it’s strictly necessary for the reward you asked for. If you joined through an invite, the person who invited you sees that someone joined, not who.
• Support requests: what you write to us through the contact form, Help in the app or by email, our replies, and the IP address the form was sent from (to stop abuse). The form’s spam check runs in your browser and sets no cookies.
• Technical data: IP address, browser type and error logs, kept for security and to fix problems.

How we use it, and why we’re allowed to

• To provide the service you signed up for (contract): sign-in, Bert’s answers, helpers, recordings, streaming, billing.
• To keep it safe and working (legitimate interest): fraud and abuse prevention, rate limits, debugging, measuring our own costs.
• To meet legal duties (legal obligation): invoices, tax and accounting records.
• With your consent: connecting Google or YouTube, and any optional emails. You can withdraw consent at any time.

We don’t sell your data, we don’t show ads, and we don’t use your conversations, recordings or voice to train AI models. Our AI providers process your content only to answer your request, under contracts that do not allow them to train on it where they offer that choice.

AI processing

Bert’s answers, helpers and characters are generated by third-party AI models. Your messages and transcripts are sent to those models to produce a reply. In a screen scene that lets him see the screen (the default; you can turn it off per scene), each question you ask also sends one picture of what you’re sharing, used for that answer and not kept by us. When you credit a video you react to, we look up its public title and channel on YouTube and keep them with that session. Bert does not make decisions about you that have legal or similar effects. AI output can be wrong; see our terms.

Signing in with X

Optional. When you choose “Continue with X”, X shares your name, username, profile picture and, if you allow it, your confirmed email address. We use them only to create and sign in to your account. We don’t read or post anything on X. You can remove our access in X under Settings → Security and account access → Apps and sessions.

Twitch

Optional, only when you connect a Twitch channel. Twitch shares your channel’s id and name. With the permissions you allow, we read your stream key and set your stream’s title when you go live; read your chat, Bits and subs so Bert can answer viewers and thank supporters, and post his replies; and, when you turn on chat moderation or click Remove, Timeout or Ban, remove chat messages and time out or ban viewers as you set it up. Tokens are encrypted at rest. You can remove our access in Twitch under Settings → Connections.

Your viewers (remembering regulars)

When a channel has “Remember regulars” on (the default), we keep, for that creator, a record of each viewer who writes in their live chat: the public name and platform id YouTube or Twitch shows, how many streams and messages, when they were first and last seen, and up to five short notes an AI model writes from what they said in that chat (for example “plays bass”). The model is told never to note health, religion, politics, sexuality, money, contact details or anything private. What viewers wrote is kept only until those notes are written, at most two days. A viewer’s record is deleted 30 days after they were last seen. The creator decides to use this and can see, correct and delete it on the Audience page; we process it on their behalf. Viewers can ask the creator, or write to us, to have their record deleted.

Google and YouTube data

Connecting Google is optional. You can use HeisenBERT with an email sign-in link instead.

What we ask for

• Sign in with Google (openid, email, profile): your name, email address and profile picture, used to create and sign in to your account.
• YouTube (youtube.force-ssl), only when you connect a channel. We use it to:
  • show which channel is connected (its name and picture);
  • create, start and end live broadcasts and streams on your channel when you go live;
  • read your live chat, including Super Chats and new members, so Bert can answer viewers and thank supporters, and post Bert’s replies to that chat;
  • when you turn on chat moderation or click Remove, Timeout or Ban, remove messages from your live chat and time out or ban viewers, as you set it up;
  • when you choose “Fill from YouTube”, read your channel’s name and description and the titles and descriptions of your latest videos, to suggest your channel’s topic, audience and tone for helpers (you can edit or delete the result);
  • when the after-stream helper is on, update your replay’s title, description and tags with the ones it wrote;
  • when you click Publish to YouTube in the editor, upload that video to your channel with the title, description, tags, visibility and thumbnail you chose.
  We don’t delete or change your videos, remove chat messages except as your moderation settings or clicks say, or read your private messages or subscribers.
• YouTube Analytics (yt-analytics.readonly, read-only, optional), only when you allow it while connecting a channel. We read your channel’s watch time and Shorts views, by content type, for the last 12 months, and your subscriber count, to show your progress toward the YouTube Partner Program. The numbers are kept for up to 6 hours, then fetched again.

How we use and protect it

• We use Google data only to provide the features above, which you can see and control in the app.
• We don’t sell it, use it for advertising, or use it to train AI models.
• Live chat messages are sent to our AI provider only to write Bert’s replies to your viewers, to remember your regulars (see above) and, when moderation is on, to check them for abuse and scams.
• No person at Chronic Qual SRL reads your Google data, unless you ask us to (for support), it’s needed for security, or the law requires it.
• Access and refresh tokens are encrypted at rest and never shown in the app.

HeisenBERT’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services

HeisenBERT uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.

Removing access

You can remove HeisenBERT’s access at any time in your Google account permissions, or by asking us to delete your account. We delete stored Google tokens and YouTube data we hold when you revoke access or delete your account, and in any case within 30 days.

Who processes your data

We use these service providers, under data processing agreements, only to run HeisenBERT:

Some of these providers are in the United States. Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. We share data with authorities only when the law requires it.

Your clip kit

Clips you add to your clip kit, with the credit and rules you set and a link to your YouTube channel, are shown to anyone who has the kit’s link. We ask search engines not to list it. A clip leaves the page when you take it out or it expires from your library; a new link stops the old one. We can’t recall copies people already downloaded.

If you add Bert to your website

For website chats and API use, you decide what your visitors’ messages are used for, and we process them on your behalf. Tell your visitors in your own privacy notice that the chat is run by HeisenBERT and is AI.

How long we keep it

Cookies and local storage

Strictly necessary: a session cookie that keeps you signed in (30 days), and Stripe’s cookies on its own checkout pages. Your browser also keeps a few preferences locally, and website chats store a random visitor ID so the conversation continues. Analytics: only if you accept them in the cookie banner, Google Analytics sets its cookies (_ga, _ga_*, up to 2 years) to count visits. You can change your choice any time with “Cookie settings” at the bottom of every page. We use no advertising cookies.

Your rights

Under the GDPR you can ask us to:

• give you a copy of your data, or send it to another service;
• correct it, or delete it and your account;
• restrict or object to how we use it;
• withdraw a consent you gave.

You can download all your data and delete your account yourself, any time, on the Account page in the app. For anything else, write to privacy@heisenbert.com from your account email. We answer within one month. You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or the authority where you live.

Security

Traffic is encrypted with HTTPS. Sign-in is by one-time email link or Google, so we store no passwords. Third-party tokens are encrypted, API keys are stored as hashes, and access to production data is limited to the people who need it.

Children

HeisenBERT is not for children. You must be at least 16 to use it.

Changes

If we change this policy in a way that matters, we’ll email you before it applies. The date at the top shows the latest version.