Last updated: 30 October 2026
Who we are
Helecos is a service for monitoring competitor and reseller prices. It is run by a self-employed professional (autónomo) registered in Spain, who is the controller of the personal data described on this page. For anything about your data, write to [email protected].
This policy covers the website helecos.com, the application app.helecos.com and our measurement service t.helecos.com.
When you visit the website
Server logs and protection
Like any web server, ours records each request: IP address, browser (User-Agent), the page requested, the referring page and the time. Traffic passes through Cloudflare, which protects the site from attacks and bots; forms are additionally checked by Cloudflare Turnstile. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). Logs are deleted after about five weeks.
Measurement without cookies
Until you accept cookies we write nothing to your device and read nothing from it. On our own server we do record that a visit happened:
- campaign tags in the link, if there are any (
gclid,utm_*); - the page, its language and the domain;
- the host of the site you came from (for example
google.com, not the full search address); - two actions: scrolling past the middle of the page and following a link into the application.
These records are filed under an identifier that cannot be turned back into anything about you. For a visit from an advertisement it is a one-way cryptographic transformation (HMAC) of the ad click identifier. For any other visit it is derived from the IP address, the User-Agent and the current date, so it changes at midnight: tomorrow the same visitor is a stranger to us. Neither the IP address nor the User-Agent is stored with these records. We do not follow you on other websites and do not build profiles.
Legal basis: legitimate interest — learning which channels bring visitors to our own website (Art. 6(1)(f) GDPR). The records are deleted automatically after 90 days. You can object at any time (see “Your rights”).
With your consent
Only after you click “Accept” in the cookie banner do we load:
- our own analytics cookies
hs_aidandhs_ft; - Google Tag Manager with Google Analytics 4 and Google Ads tags;
- the JivoSite chat widget (helecos.com);
- Hotjar usage analytics (app.helecos.com).
Legal basis: your consent (Art. 6(1)(a) GDPR). To withdraw it, delete the cookies of helecos.com in your browser: the banner will appear again, and nothing will load until you accept.
Forms and chat
When you send a contact, demo or tariff request form, we receive your name, email address and phone number and, if you fill them in, your website and message. We use them only to answer you and prepare an offer. Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR). Submissions are deleted after 24 months. Messages you write in the chat are stored by JivoSite and used only to answer you.
When you use the application
- Account: email address, name, phone number, website, interface language and the password (stored only as a hash). The country is detected from your IP address using a local database — nothing is sent to third parties — to preselect the region and currency.
- Your work data: projects, product catalogues, competitor addresses and the prices we collect for you. If they contain personal data, we process it on your instructions.
- Payments are handled by Stripe. Card details go directly to Stripe and never reach our servers; we keep the invoices, amounts and the Stripe customer identifier.
- Attribution: when you sign up, we link the identifier of the visit that brought you (see above) to your account and Stripe customer identifier, to understand which channels bring customers.
- Service emails and support: registration, password reset, notifications and your support requests.
- Error reports: when something breaks, technical details of the error (page, browser, user number) are sent to Sentry so that we can fix it.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for invoices — a legal obligation (Art. 6(1)(c)); for attribution and error reports — legitimate interest (Art. 6(1)(f)). We keep the data while your account exists. After you ask us to delete the account, we erase the account and project data within 30 days, except invoices and payment records, which Spanish tax and commercial law requires us to keep for up to six years.
Who else processes the data
- Hetzner Online (Germany, Finland) — hosting of the website, the application and the measurement service.
- Supabase (database in Zurich, Switzerland) — storage of measurement records.
- Cloudflare — delivery and protection of the website, Turnstile.
- Stripe — payments.
- Sentry (USA) — error reports.
- Google (Tag Manager, Analytics, Ads), Hotjar (Malta), JivoSite — only with your consent.
Email is sent from our own mail server. We do not sell personal data. Where a provider processes data outside the European Economic Area (Cloudflare, Google, Stripe, Sentry may do so in the USA), the transfer relies on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses; Switzerland is covered by an adequacy decision.
Cookies
| Cookie | Purpose | Lifetime | When |
|---|---|---|---|
cookie-agreed | remembers your choice in the banner | 100 days | always (necessary) |
SESS… | keeps you signed in to the application | session | always (necessary) |
hs_aid | our analytics identifier, shared by helecos.com and app.helecos.com | 2 years | after consent |
hs_ft | the source of your first visit | 90 days | after consent |
_ga, _ga_* | Google Analytics | up to 2 years | after consent |
_gcl_* | Google Ads | 90 days | after consent |
_hj* | Hotjar (application only) | up to 1 year | after consent |
jv_* | JivoSite chat | set by the provider | after consent |
Your rights
You can ask us to show you the data we hold about you, correct it, delete it, restrict its use or hand it over in a machine-readable form, and you can object to processing based on legitimate interest or withdraw your consent. Write to [email protected]; we reply within one month. An objection to the measurement described above needs no reason: we delete the records and stop. You also have the right to complain to the Spanish Data Protection Agency (AEPD, aepd.es) or to the authority of your own country.
We make no automated decisions about you. The service is meant for businesses and is not aimed at children.
Changes
When this policy changes, we publish the new version on this page with a new date.