🔒privacy policy

Plain language, because that's the point. Last updated: September 2026.

$ who we are

heraldQ is operated by Dylan Viranyi, a sole proprietorship registered in South Africa ("we", "us"). Contact for anything in this policy: dylan@heraldq.com.

$ what we collect

• Account data — your name and email address, provided at signup.
• Credentials — your API key is stored only as a SHA-256 hash; your HMAC signing secret is stored to sign your deliveries. Neither is ever displayed after issue.
• Operational data — the destination URLs you send us, the payloads you enqueue (held only until delivered, then discarded — we keep the outcome, not the body), delivery records (status, attempts, timestamps), and monthly usage counts used to enforce your plan's quota.
• Technical logs — request logs with a request ID, route, and status, for debugging and abuse prevention.

$ payments

heraldQ does not process payments and never sees your card details. Paddle is our merchant of record: they are the legal seller of every subscription, and your payment information is processed by Paddle under their privacy policy. We receive from Paddle only your email address and the state of your subscription (plan, status) so we can set your plan's limits.

$ cookies

This website sets no cookies and includes no analytics or tracking. Paddle's checkout, when you open it, may set its own cookies — see their policy above.

$ how long we keep things

• Account data — while your account is active. Deleted on request, at which point your API keys are revoked immediately.
• Delivery records — 1 day (free plan) to 30 days (Pro), per your plan's retention; then automatically swept.
• Dead-lettered webhooks — 7 to 90 days by plan, so you can replay them.
• Enqueued payloads — only until delivered or abandoned; payloads are never retained after their delivery resolves.

$ who else sees your data

No one buys it, and we don't share it for marketing. Three service providers process data on our behalf: Railway (application and database hosting), Cloudflare (this website's CDN), and Paddle (billing). We may disclose data where required by law.

$ security

TLS everywhere. API keys stored hashed. Every delivery we make on your behalf is HMAC-signed so your customers can verify it came from you. If a security incident ever affects your data, we will tell you promptly.

$ your rights

Email dylan@heraldq.com to access, correct, export, or delete your personal data, or to close your account. We handle requests in a reasonable timeframe and treat your data in line with South Africa's POPIA and the GDPR's principles.

$ changes

If this policy changes materially, we'll notify account holders by email before it takes effect. The live version always lives at this URL.