Hedda
Privacy policy
Last updated 16 October 2026
This policy explains how personal data is handled in Hedda, the HR and resource planning service at my.hedda.app, and on our website hedda.app. It applies to people who sign in to Hedda, to employees whose employer uses Hedda, to people outside a customer who are invited to give feedback, and to people who contact us.
1. Who we are
Hedda is provided by VNTRS Consulting AB, company registration number 559070-8417, S:t Eriksgatan 63 B, 112 34 Stockholm, Sweden ("we", "us"). You can reach us about anything in this policy at hej@hedda.app.
2. Our role: processor or controller
Most personal data in Hedda is put there by the company that uses the service, usually your employer (our "customer"). For that data the customer is the controller and we are the processor. We process it only on the customer's documented instructions, under our data processing agreement. If you are an employee and have a question about your data in Hedda, for example a request for access or correction, contact your employer first. We will help them answer you.
We are the controller for the data we need to run our own business: your sign-in account, contact with customers and prospects, product feedback you send us, and visits to our website.
3. Personal data we process
Account and sign-in data
Your name and email address, which company accounts you are a member of, and your roles there. See section 4 for what we receive from sign-in providers such as Google.
Data our customers store in Hedda
Depending on which features a customer uses, Hedda can contain the following categories of personal data. The examples are not a complete list, and new features add data within these categories:
- identity and contact details, such as name, work email, phone number, address and Swedish personal identity number (personnummer);
- employment details, such as start and end dates, job title, department and employment terms;
- compensation and payroll, such as salary history, variable pay, pay runs, tax details and bank account details for salary payments;
- time and absence, such as time reports, project allocations, vacation, parental leave and other leave;
- development and feedback, such as goals, check-ins, performance reviews, feedback (also from invited people outside the company) and managers' notes;
- surveys, such as pulse surveys, whose answers are stored separately from who answered and shown only in aggregate;
- profile content, such as profile pictures, introductions and internal news.
Health data: Hedda records sick leave and leave to care for a sick child (VAB), which are health data, a special category of personal data. Customers record it to administer absence and payroll as employers are required to. We process it only as their processor.
Demo requests
If you request a demo on our website, we receive your name, email address, company, and the phone number and message you choose to add. We use it only to contact you about the demo.
Product feedback
If you send a bug report or suggestion with the "Send feedback" button in Hedda, we receive your name, email address, your description, the page you were on and any screenshots you attach. We may use service providers, including AI tools, to help us analyse and fix what you report. Please don't include other people's personal data, such as salaries or personal identity numbers.
Technical data
When you use Hedda or our website, our hosting provider logs your IP address, browser information and which addresses you request, to deliver the service, protect it against abuse and troubleshoot errors. These logs do not contain the information stored in Hedda, such as salaries or absence. They are stored in Finland and deleted after 30 days.
4. Signing in with Google and other providers
You sign in to Hedda through Firebase Authentication, a Google service, with an account from Google, Microsoft or another supported provider. When you sign in with Google we receive only the basic profile information Google shares by default: your name, email address, whether that email address is verified, and a profile picture link. We do not request access to your Gmail, Calendar, Drive, contacts or any other Google data.
We use this information only to sign you in and to match you to the company accounts that have invited your email address. We do not sell it, use it for advertising, or share it with anyone except the service providers in section 6 that run Hedda for us. Hedda's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing Hedda to our customers, including sign-in and support | Performance of our contract with the customer (art. 6.1 b), and our legitimate interest in giving their users access (art. 6.1 f) |
| Processing customer data on the customer's behalf | The customer's legal basis. We act on their instructions (art. 28) |
| Security, abuse prevention, audit logging and troubleshooting | Legitimate interest in keeping the service and customer data secure (art. 6.1 f) |
| Handling product feedback and improving Hedda | Legitimate interest in developing the service (art. 6.1 f) |
| Communicating with customers and prospects | Legitimate interest (art. 6.1 f) |
| Accounting and invoicing | Legal obligation (art. 6.1 c) |
6. Where data is stored and who we share it with
Hedda's database, file storage and servers run on Google Cloud in Finland (europe-north1). We use these service providers (subprocessors):
- Google Cloud and Firebase (Google Cloud EMEA Ltd / Google LLC): hosting, database, file storage and sign-in. Background jobs are queued in Belgium (europe-west1). Firebase Authentication may process sign-in data outside the EU.
When personal data is transferred outside the EU/EEA, we rely on the EU-US Data Privacy Framework where the recipient is certified, or on the European Commission's standard contractual clauses.
A customer can also connect integrations such as Fortnox (payroll) or Slack (notifications), and authorise AI assistants and other applications to use Hedda's API or MCP server. Data is then exchanged with those services on the customer's instruction, and under the customer's agreement with them.
We never sell personal data. We disclose it to authorities only when required by law.
7. How long we keep data
- Customer data is kept as long as the customer uses Hedda. The customer can delete the records of former employees. When the agreement ends, the customer can export its data for 30 days. After that the company account and its data are deleted.
- Your sign-in account is deleted automatically when you no longer have access to any company account in Hedda. Sign-ins that never got access to a company account are deleted after 30 days.
- Audit log entries recording changes made in Hedda are deleted automatically after one year.
- Backups: deleted data can remain in our backups for up to 14 weeks (point-in-time recovery for 7 days, weekly backups kept for 14 weeks). It then disappears permanently.
- Demo requests are deleted when they are no longer relevant, and no later than 12 months after our last contact with you.
- Product feedback is kept while we handle it and as a record of the change it led to. It is deleted together with the customer's company account. You can ask us to delete your feedback.
- Accounting records are kept for as long as Swedish accounting law requires.
8. How we protect data
- All traffic is encrypted with HTTPS, and data is encrypted at rest.
- Each customer's data is kept separate from every other customer's, and every request for data is checked against the user's membership. Images such as profile pictures are served from unguessable addresses without a sign-in check.
- Access within a company account is role-based. Sensitive information such as salaries and bank details is visible only to people who have been granted that right.
- Changes made in Hedda are recorded in an audit log.
- API keys are stored only in hashed form.
9. Cookies and local storage
The Hedda app stores a few settings in your browser, such as language, theme and your selected company account, and keeps your sign-in session through Firebase Authentication. These are strictly necessary for the service to work, so we do not ask for consent for them. If we use cookies or similar technologies that are not strictly necessary, for example for analytics, we ask for your consent first and describe them before we do.
10. Your rights
Under the GDPR you have the right to request access to your personal data, to correction, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest. Where we are the processor, we pass your request to the customer and help them respond. Contact us at hej@hedda.app.
We do not make decisions about you based solely on automated processing.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or the supervisory authority where you live.
11. Changes
We may update this policy. The date at the top shows when it last changed, and we notify customers of material changes before they take effect.
Back to home