GDPR Information

This page summarizes how the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and Switzerland's revFADP apply to your use of CleanOS, and how to exercise your rights. It supplements our Privacy Policy, which contains the full disclosures.

1. Who is the controller?

Heros Consulting Inc., a California corporation, is the controller of personal data you submit when you create a CleanOS account or use the Service for your own business operations.

When you use CleanOS to process information about your prospects, customers, or employees, you are the controller of that data and Heros Consulting is your processor for those activities. You are responsible for having a lawful basis to process it.

2. Legal bases we rely on

• Contract (Art. 6(1)(b)): to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)): to keep the Service secure, prevent abuse, debug, and improve product quality.
• Legal obligation (Art. 6(1)(c)): to keep tax and accounting records, respond to lawful requests.
• Consent (Art. 6(1)(a)): for optional marketing emails (you can withdraw at any time).

3. Your rights

If you are in the EU, EEA, UK, or Switzerland, you have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectification — ask us to correct inaccurate data (Art. 16).
• Erasure — ask us to delete your data ("right to be forgotten," Art. 17), subject to legal exceptions.
• Restriction of processing in certain circumstances (Art. 18).
• Portability — receive your data in a structured, machine-readable format (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Withdraw consent at any time for processing based on consent.
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22). CleanOS does not make such decisions.
• Lodge a complaint with your local data-protection authority. A list of EU authorities is here.

4. How to exercise your rights

We may need to verify your identity before fulfilling a request — typically by confirming you control the email on the account, and where the request relates to bulk data export or deletion, by an additional confirmation step.

5. International transfers

We are based in the United States. When personal data is transferred from the EEA, UK, or Switzerland to the US, we rely on:

• The EU–US Data Privacy Framework (and its UK Extension and Swiss–US framework), where applicable.
• The European Commission's Standard Contractual Clauses with our sub-processors that are not certified under the DPF.

Our sub-processors (Supabase, Netlify, Stripe, OpenAI, Anthropic, RapidAPI, Instantly.ai) are listed in our Privacy Policy and are contractually bound to safeguard your data.

6. Data Processing Addendum (DPA)

If your business needs a signed Data Processing Addendum (e.g., because you are a controller under GDPR and Heros Consulting processes data on your behalf), email oscar@herosconsulting.com and we will provide one.

7. Data Protection Officer

We are not required to appoint a Data Protection Officer under Art. 37. Privacy questions should be addressed to oscar@herosconsulting.com.

8. EU representative

We do not currently have an EU representative under Art. 27 because we are not regularly targeting individuals in the EU. If this changes, we will appoint one and list them here.

9. Retention

See Section 6 ("Data retention") of our Privacy Policy.

10. Contact