Privacy notice

How personal data is used with HEIDI. Last updated 17 September 2026.

Who is responsible

UpQuAI Solutions AG, Poststrasse 13, 6300 Zug, Switzerland, is responsible for personal data it processes for its own account administration, support and service-security purposes. Contact contact@upquai.com for privacy questions or requests.

When your organization uses HEIDI to process business information, it generally determines the purpose of that processing. UpQuAI processes workspace information on its behalf under the applicable service agreement and data-processing terms. Your workspace administrator can explain your organization’s use of HEIDI.

Information used by HEIDI

Depending on the features you use, HEIDI processes account and workspace details, messages, selected files, generated results, connection information and records of authorized actions. Voice input processes your recording to produce a transcript. Browser or computer access can process page contents and screenshots; interviews can involve participant information and recordings.

Support enquiries may include your contact details, app version, error information and anything you choose to share. Remove confidential information from support screenshots and attachments unless it is needed to resolve your request.

Why information is processed

Information is used to provide your workspace, carry out the work you request, manage access, respond to support enquiries and protect the service against misuse.

Where the GDPR applies, the relevant grounds are performance of a contract, compliance with legal obligations, legitimate interests in reliable and secure service operation, and consent where required. Your organization determines the lawful basis for business information it provides. Where processing relies on consent, you may withdraw it for the future without affecting earlier lawful processing.

Local work and hosting

HEIDI keeps local work on your computer. Requests and relevant context may be sent to the AI service you select, and connected workspace features use the services linked to your account. Voice transcription sends your recording to your workspace’s transcription service.

HEIDI workspace data is hosted in Switzerland or the European Union. Contact us for the locations and processing terms applicable to your workspace, including backups.

Service providers and international processing

We use service providers for hosting, AI, transcription and communication. Depending on the services used with HEIDI, requests may be processed outside Switzerland and the European Union, including in the United States. Connected services have their own processing locations and terms.

Retention, model-training settings and access for support or safety monitoring depend on the service and account configuration.

Your organization should approve the services used for its information. Ask your administrator or contact UpQuAI for the relevant providers, processing locations and data-processing terms. Where UpQuAI transfers personal data internationally, the applicable transfer requirements must be met, including an adequacy decision or appropriate contractual safeguards where required. Information about applicable safeguards is available on request.

Retention and deletion

Local history and files remain on your device until removed. Disconnecting an account does not automatically delete saved work or records held by a connected service. Removing the app may leave local data or backups behind.

Workspace retention and deletion follow your organization’s settings, service agreement and applicable legal requirements. Account, support and security records are retained for the purposes described here and for any required legal, security or dispute-resolution period. Contact your administrator or UpQuAI to request the retention details and deletion options applicable to your data.

Access and security

Workspace permissions and the access you grant determine which information and actions are available to a bot. Review those permissions, use approved services, and protect your computer and accounts. UpQuAI service connections use HTTPS. Standard HEIDI desktop builds do not send optional product-usage analytics.

Provide the account information necessary for sign-in to use connected workspace features. Voice, computer access and individual app connections depend on the permissions you choose to grant. You can stop a bot, disconnect an app or change access through the product and your device settings.

Your rights

Depending on the applicable law, you may request access, correction, deletion, restriction or portability of your personal data, and object to certain processing. You may also have rights concerning decisions based solely on automated processing. Contact contact@upquai.com or your organization’s privacy contact; we may need to verify your identity before handling a request.

HEIDI can generate suggestions and perform actions within the permissions you give it. Ask your workspace administrator how automated processing is used in your organization and how to obtain review of a decision affecting you.

You may raise concerns with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the competent data-protection authority in your country, including an EU supervisory authority where applicable.

Applicable law and updates

Processing is subject to the Swiss Federal Act on Data Protection and the GDPR where applicable. This notice describes the service; your organization’s privacy notice and the relevant data-processing agreement provide additional information about its use of HEIDI.

We update this notice when relevant service or processing arrangements change. The date above identifies the current version.