Privacy Policy

The data controller for personal data processed on hesti.lv is SIA "Efficient Solutions", registration number 40103800720, registered office at Liepājas iela 40 k-5 - 26, Riga, LV-1002, Latvia. Privacy contact: info@hesti.lv.

We collect data in the following categories:

• Account data: email address, hashed password, language, account creation date.
• Property report inputs: address, area, room count, building details, condition rating, free-text description, renovation notes, photos, the role you indicated (buyer / seller / investor / tenant / landlord).
• Generated reports: the AI-produced report content stored against your account.
• Payment metadata: token order ID, package, amount, status. Card data itself is handled by Stripe and is never stored on our servers.
• Technical data: IP address, browser, device, pages visited, referring URL, approximate location derived from IP.
• Cookies and analytics events: described in section 8.
• Error and diagnostic data: stack traces, breadcrumbs, and short anonymized session replays captured by Sentry when an error occurs.
• Communications: the content of emails you send to info@hesti.lv.

We process your personal data on the following legal bases:

• Contract performance — to provide the Service: account, login, paid Reports, payments. Without this data we cannot deliver the Service.
• Legitimate interest — to keep the Service secure (rate-limiting, fraud detection), to detect and fix errors, and to understand high-level usage (anonymous analytics).
• Consent — for non-essential cookies and analytics. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligation — for accounting and tax record-keeping related to paid services.

We share data with the following processors strictly to provide the Service:

• Stripe — card payment processing. Stripe receives the order ID and amount; it does not receive your email from us.
• Amazon Web Services — hosting, photo storage, transactional email. Data is stored in the EU.
• Google — Google Tag Manager, Google Analytics 4 (anonymised metrics), Google Maps Platform (geocoding the addresses you enter).
• Sentry — error monitoring and session replays only on error events. Text and form inputs are masked, media is blocked.
• Microsoft Clarity — anonymous session-replay analytics used to improve user experience. Loaded only after you give consent.
• Third-party AI providers — for Report generation. Only property data and photos are sent, not your email or other directly identifying information.

We do not sell your personal data and do not share it with advertisers.

Most of our infrastructure is located in the European Union. Some of our processors (notably certain third-party AI providers and Sentry) may process data in the United States. Where this happens, we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework, to provide appropriate safeguards.

• Account data: as long as your account is active. After you close your account, we keep minimum identifiers in encrypted backups for up to 90 days.
• Reports and uploaded photos: kept for as long as your account is active so that you can revisit past Reports. You can request deletion of any Report (and its photos) at any time — see Your rights below.
• Payment records: kept for 10 years as required by Latvian accounting law.
• Analytics events: aggregated and retained for 14 months (Google Analytics default).
• Error data: retained by Sentry for up to 90 days.

Under GDPR you have the right to:

• access the personal data we hold about you
• request correction of inaccurate data
• request deletion of your data ("right to be forgotten")
• request restriction of processing
• request portability of your data in a machine-readable format
• object to processing based on legitimate interests
• withdraw consent at any time (where consent is the legal basis)
• file a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) if you believe we have mishandled your data

To exercise any of these rights, write to info@hesti.lv with a clear description of your request. We will respond within one month of receiving the request, as required by GDPR.

We use the following categories of cookies:

• Necessary cookies: required for the Service to function (session, authentication, consent state). Cannot be disabled.
• Analytics cookies: Google Analytics 4 (_ga, _ga_*) helps us understand site usage in aggregate; Microsoft Clarity (_clck, _clsk) lets us see how users interact with pages so we can improve UX. Loaded only after you give consent.
• Functionality cookies (e.g. language preference): remember your settings.

On first visit you are asked to accept or reject non-essential cookies via our consent banner. Until you accept, no analytics tracking is loaded. You can change your choice at any time via the Cookie settings link in the footer.

We apply administrative, technical, and physical safeguards to protect your data. These include HTTPS for all traffic, encryption at rest where supported by our infrastructure, hashed passwords, restricted internal access, signed Stripe webhooks, redaction of personal data in error logs, and review of access on a need-to-know basis. No system can guarantee absolute security; if a personal data breach affects you and presents a likely risk, we will notify the Latvian Data State Inspectorate within 72 hours and contact you without undue delay, as required by GDPR.

Privacy questions, data-rights requests, and complaints: info@hesti.lv. By post: SIA "Efficient Solutions", Liepājas iela 40 k-5 - 26, Riga, LV-1002, Latvia.

If you are not satisfied with our response, you may contact the Latvian Data State Inspectorate (Datu valsts inspekcija) at https://www.dvi.gov.lv.

We may update this Privacy Policy when our practices, the Service, or applicable law changes. The "Last updated" date at the top of the page reflects the most recent change. Material changes will be communicated by email or in-app notice.