Privacy Policy

Heaven Eco Hub (Bodhisla LTD) · Last updated: 4 October 2026

What changed on 4 October 2026. We added "Your Life Journey roadmap": what we keep when you set a goal and mark steps as done, and that Luna Heaven reads it. On 30 September 2026we added two sections, "Luna's personal greeting" and "Emails we send"; named Google Cloud Text-to-Speech and our email delivery provider among the services we use; explained the one-way fingerprint that keeps the welcome gift to one per person; and set out exactly what closing your account removes and what it keeps.

This Privacy Policy describes how Heaven Eco Hub (operated by Bodhisla LTD, Saint George's, Grenada) collects, uses, stores, and protects information when you visit www.heavenecohub.com, use the Heaven Eco Hub mobile application, or engage with any related Heaven platforms and services (collectively, the "Services").

Summary of what we collect and what we do not:

• If you only browse the site — Visitor behaviour analytics via Google Analytics, only if you accept analytics cookies, and pseudonymous (a random cookie ID, no name or email; advertising features off); technical server log data (IP address, browser type, pages visited, timestamps), and any information you voluntarily send to us by email.
• If you open a Heaven account (on this website or in the Heaven Eco Hub mobile app) — your name and email address, a handle derived from them, your country, your $HEAVEN balance, and the ledger of energy charges the Heaven apps report against your account. If you tell us which journey you are here for (Money, Health, Children or Love), that choice is stored on your account too (see "Your journey" below). Your first name is also used for Luna's spoken greeting (see "Luna's personal greeting"). Authentication is handled by Firebase Authentication, which stores your password only as a salted hash; we never see it.
• If you link a wallet or buy energy — your Heaven Wallet address and the permissions you approved inside the wallet, and, where you pay by card, the PayPal subscription or order reference. We never receive or store your card details, and we never hold your wallet keys.
• What is NOT collected — We do not collect card numbers, wallet private keys or seed phrases, biometric data, precise location, or contacts. We do not sell personal data, and we do not use it for cross-app or cross-site tracking.

We are committed to protecting your privacy and handling your data transparently and responsibly. If you have any questions or concerns about this policy, please contact us at support@heavenecohub.com.

1. Who We Are

The data controller for the purposes of applicable data protection legislation is:

Bodhisla LTD
Saint George's, Grenada
Email: support@heavenecohub.com
Website: www.heavenecohub.com

2. Information We Collect

Website (heavenecohub.com). Browsing the website needs no account. If you open a Heaven account here, the account data listed in the summary above is collected through Firebase Authentication and stored in Cloud Firestore; card payments are taken by PayPal, and we never receive your card details. If you accept analytics cookies, visitor behaviour is measured with Google Analytics, pseudonymous (a random cookie ID, no name or email; advertising features off), as described below.

The following data may be collected automatically when you use our Services:

• Technical log data — IP address, browser type and version, operating system, referring URL, pages visited, and timestamps. Used for security monitoring and performance optimisation only.
• Analytics data — Visitor behaviour collected via Google Analytics, only after you accept, and pseudonymous (a random cookie ID, no name or email; advertising features off): session duration, page views, which buttons, links and sections are used, the steps of signing up and getting started (for example confirming your email, connecting Luna, connecting a first app, and buying energy, with its amount), and general geographic region. Page addresses are reported without their query strings, so codes and payment references in a link are never sent. If you are signed in, your account's internal ID (a random string, never your name or email) is attached, so that your visits on a phone and a laptop count as one person. Error reports carry a short code (such as "email_unverified"), never what you typed.
• Cookie data — Identifiers set by first- and third-party cookies as described in Section 4.
• The mobile app — The Heaven Eco Hub mobile app collects no device identifiers, analytics or crash reports. What it sends us is your account and, once you sign in, your Life Journey roadmap, both described above; its requests reach our servers like any other and appear in the technical log data above. Your reflections, daily check-ins, keepsakes, reminders and sound settings stay on your phone and are never sent to us, unless you choose to share a keepsake yourself. To delete your account and what it holds, see how to delete your Heaven account.
• Communications — If you contact us directly (e.g. by email), we retain the content of that communication and your contact details in order to respond to your enquiry.

3. Legal Basis for Processing

Where data protection law requires a legal basis, we rely on the following:

• Legitimate interests — Security monitoring, fraud prevention, and improving our Services, where those interests are not overridden by your rights.
• Consent — Analytics and non-essential cookies, where we obtain your consent via cookie controls.
• Legal obligation — Compliance with applicable laws and regulatory requirements.
• Contract performance — Where you engage with Heaven products or the $HEAVEN token ecosystem and we need to process data to fulfil that relationship.

4. Cookies

We use the following categories of cookies on this website:

• Strictly necessary cookies — Essential for the website to function correctly. These cannot be disabled.
• Analytics cookies — Google Analytics sets its _ga cookies, which are pseudonymous (a random cookie ID, no name or email; advertising features off), and only after you accept. Your answer is remembered in your browser for 12 months, after which we ask again. You may withdraw consent at any time with the Cookie Settings link at the foot of the home page or the "Cookie settings" button on every other page; withdrawing deletes the _ga cookies from your browser. You can also use your browser settings, or install the Google Analytics Opt-out Browser Add-on.

You can manage or disable cookies through your browser's privacy settings at any time. Disabling strictly necessary cookies may impair site functionality.

Cookie Consent. Analytics cookies require your consent before they are set. If you visit this website without having given explicit consent (for example, by dismissing or ignoring any cookie notice), only strictly necessary cookies required for the site to function will be active. No analytics or non-essential tracking cookies will be placed until you have provided consent. You may withdraw consent at any time with the Cookie Settings link in the website footer or the "Cookie settings" button on every other page, by adjusting your browser settings, or using the Google Analytics Opt-out Browser Add-on linked above.

5. How We Use Your Information

• To operate, maintain, and improve the website and mobile application
• To monitor site security and detect or prevent fraudulent or malicious activity
• To analyse aggregate visitor behaviour and optimise user experience
• To respond to enquiries or support requests you send to us
• To comply with applicable legal and regulatory obligations
• To send the emails described in "Emails we send" below: Luna's short welcome series, which you can unsubscribe from at any time, and notices about your own account and energy balance
• To send the Heaven newsletter, only if you subscribed to it yourself and confirmed that subscription

We do not sell, rent, or share your personal information with third parties for their own marketing purposes.

Your journey. When you choose a journey (Money, Health, Children or Love), on the home page or in your account, we store that choice on your account so your client area can show the tools for it first. When you open Luna Heaven from your account, the journey is passed to Luna Heaven in the link, so Luna can greet you with it. If you have accepted analytics cookies, the choice is also recorded in Google Analytics, as an event and as a property of your visits, so we can see which journeys people choose and where they need more help. You can change it at any time in your account.

Your Life Journey roadmap. If you set a goal for a journey, in your account or in the Heaven Eco Hub app, we store on your account the goal you chose, anything you write about it in your own words, which steps of the roadmap you have marked as done and when, when you started, and whether you are following the guided roadmap or one Luna made for you. We also record, once, when you first chose a journey, first opened Luna from your account and first opened one of your tools, so your setup steps can show what is done. On the Health journey, your goal and your own words may describe something about your health; write only what you are comfortable keeping on your account. Luna Heaven can read all of this, through our service, so she can help you with your next step and suggest a roadmap made for you; when you open Luna Heaven from a roadmap step, the link also tells her which goal and step you came from. While you are signed out of the app, your roadmap is kept only on your phone; when you sign in, it is added to your account. Deleting your account deletes all of it, including anything the app had not yet sent.

Welcome gift. Every person can claim a welcome gift once: $200 of energy, granted after you confirm your email address. We record on your account that it was claimed, when, and the amount and rate used. So that it is given once per person rather than once per account, we also keep a one-way fingerprint of your email address: a SHA-256 hash of the address after letter case, anything after a "+" and, for Gmail addresses, dots are set aside, stored with the ID of the account that received the gift. The address itself is not stored with it. We keep this fingerprint after you close your account, because it is what stops the same mailbox receiving a second gift on a new account. When a second account for the same mailbox asks for the gift, we count that on the same record, again without any address, and note on that account that its gift was already given.

Luna's personal greeting. When you open your account, Luna can greet you by name in her voice. To make that greeting, the first word of the name on your account, cut down to letters only and at most 24 characters, is sent to Google Cloud Text-to-Speech, which turns the greeting into audio. The text of the greeting and the audio file are stored with your account, so the same greeting is not made twice, and both are deleted when you close your account. If you would rather your name were never sent, leave the name blank when you sign up, or change it in your profile; Luna then greets you without it.

Emails we send. If you open a Heaven account, Luna may write to you a few times while you settle in: a reminder to confirm your email address if you have not yet, a welcome once you have, and an invitation to connect Luna if you have not done so. Each of those is sent at most once, never two in one day, and each carries an unsubscribe link; mail apps that offer their own one-click unsubscribe button use the same link. Separately, if your energy balance falls below the low mark, we send one notice about it, because it concerns your own balance; unsubscribing from Luna's welcome emails does not stop that notice. Emails that confirm your address or reset your password are sent by Firebase Authentication. Our own emails are sent through our email delivery provider, which receives your email address and the email itself in order to deliver it. Until a delivery provider is connected, we hold these emails and send none of them.

6. Third-Party Services

Heaven Eco Hub uses the following third-party services. Each is governed by its own privacy policy — we encourage you to review them:

• Google Analytics — website usage analytics, only with your consent; pseudonymous (a random cookie ID, no name or email; advertising features off)
• Firebase Hosting (Google) — website hosting and content delivery. Our fonts are served from our own site, not fetched from a font service.
• Firebase Authentication (Google) — account sign-in, email confirmation and password resets
• Cloud Firestore and Cloud Functions (Google) — storing your account, balance and energy ledger, and running the account and payment services that change them
• PayPal — card and PayPal payments for energy. PayPal receives your payment details directly; we receive only the order or subscription reference and whether it was paid.
• Google Cloud Text-to-Speech — turns Luna's personal greeting, which contains your first name, into audio (see "Luna's personal greeting")
• Our email delivery provider — delivers the emails described in "Emails we send", and receives your email address and those emails to do it. We will name the provider here once one is connected; until then, none of these emails are sent.
• Luna Heaven — the Heaven guide you can connect to your account. When you open it from your account, the journey you chose is passed to it in the link.
• Telegram — community communication channel (t.me/HeavenEcoHub). Messages sent in public channels are publicly visible.
• BNB Smart Chain — public blockchain for $HEAVEN token transactions (see Section 7)
• Apple App Store / Google Play — mobile app distribution. Their respective privacy policies govern any data collected during download or installation.

7. Blockchain Transactions

All $HEAVEN token transactions take place on the BNB Smart Chain, a public blockchain. By design, wallet addresses, transaction amounts, and timestamps are permanently and publicly visible to anyone on the network. We do not control, store, or have access to your private keys or seed phrases.

Before initiating any blockchain transaction, be aware that such records are immutable and cannot be deleted. We are not responsible for any loss of funds resulting from user error, phishing, or compromise of your own wallet credentials.

8. Data Security

We take reasonable technical and organisational measures to protect information against unauthorised access, loss, or disclosure. These measures include encrypted connections (HTTPS/TLS), access controls on our hosting infrastructure, and regular security reviews.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

Data Breach Notification. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and any relevant supervisory authorities as required by applicable law. Where legally required (for example, under GDPR or equivalent legislation), we will endeavour to notify affected individuals within 72 hours of becoming aware of the breach, providing details of the nature of the breach, the categories of data involved, the likely consequences, and the measures taken or proposed to address it.

9. International Data Transfers

Bodhisla LTD is based in Grenada. Some of our third-party service providers (including Google) may process data in countries outside your own, including the United States and European Economic Area member states. Where such transfers occur, we ensure that appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions) in accordance with applicable data protection law.

10. Data Retention

We retain data only for as long as necessary for the purposes described in this policy:

• Server logs — retained for up to 90 days for security and diagnostic purposes, then deleted.
• Analytics data — retained by Google Analytics for 14 months, after which it is automatically deleted.
• Support correspondence — retained for as long as reasonably necessary to resolve your enquiry and for up to 3 years thereafter for record-keeping purposes.
• Blockchain records — permanent and immutable by the nature of the BNB Smart Chain; not within our control to delete.
• Welcome gift fingerprint and closed-account marker — kept after you close your account, holding a one-way hash of your email address and your account ID but never the address itself, so that a closed account cannot be reopened and the welcome gift is not given twice (see Section 11).

11. Data Deletion

You have the right to request that we delete personal data we hold about you. We take deletion requests seriously and will act on them promptly in accordance with applicable law.

Closing your account yourself

If you have a Heaven account, you can close it without asking us. On this website, open Account → Security → Delete account. In the Heaven Eco Hub mobile app, open Account → Settings → Close my account. It cannot be undone.

Closing your account removes:

• your account record: your profile, your energy balance and your energy ledger, and any energy held for work in progress
• Luna's personal greeting: its text and its audio
• the record of which of Luna's welcome emails you have had, and your unsubscribe choice with it (there is no account left to write to)
• the record of your low-energy notices
• every email addressed to you that is still waiting to be sent, and our copies of the ones already sent
• your sign-in, so your email and password stop working here

It keeps, on purpose:

• a closed-account marker with your account ID and a one-way hash of your email address, never the address itself, so the closed account cannot be reopened
• the welcome gift fingerprint described in Section 5, so the same mailbox cannot receive the gift a second time
• our records of payments made through PayPal or Heaven Wallet and of charges connected apps made to your energy, which name your account ID and the amounts, because money that has moved must stay accountable; PayPal also keeps its own records on its side
• anything already public on the BNB Smart Chain

You can open a new Heaven account with the same email address later if you wish; it will not receive the welcome gift again.

Two things are worth doing first, because we cannot do them for you: any $HEAVEN balance you are holding is lost on closure and there is no withdrawal from the app, and a monthly package paid through PayPal must be cancelled in PayPal or it will keep charging you.

How to submit a deletion request

If you would rather we did it, or you no longer have access to the app, email us at support@heavenecohub.com with the subject line "Data Deletion Request". Please include enough information to allow us to identify you (e.g. the email address you used to contact us, or your approximate location and date of contact). We may ask for additional verification to protect against unauthorised deletion requests.

What we will delete

• Any support correspondence or contact records associated with your identity
• Any personal data held in our internal systems that we can reasonably attribute to you
• Analytics data linked to your account ID or your analytics cookie ID, where technically feasible

Timescales

We will confirm receipt of your request within 5 business days and complete the deletion within 30 days. In complex cases we may extend this by a further 60 days, in which case we will inform you of the reason for the delay.

Exceptions — when we may be unable to delete

Certain data cannot be deleted or is exempt from deletion requests under applicable law:

• Blockchain records — wallet addresses and $HEAVEN token transaction data on the BNB Smart Chain are permanently recorded on a public, immutable ledger. This data is not within our control and cannot be altered or erased by us or anyone else.
• Legal obligations — we may be required by law to retain certain records (e.g. for fraud prevention, regulatory compliance, or legal proceedings) even after a deletion request.
• Anonymised data — data that has been fully anonymised and can no longer be attributed to any individual is not considered personal data and falls outside the scope of deletion rights.
• Third-party systems — data held by third-party providers (e.g. Google Analytics, Telegram) is subject to their own deletion policies. We will provide guidance on how to exercise your rights directly with those providers where relevant.

Where we are unable to fully honour a deletion request, we will explain the specific reason and, where possible, offer partial deletion or restriction of processing as an alternative.

12. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of your data where it is no longer necessary or lawfully held
• Right to restriction — to request that we limit how we process your data in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint — with your local data protection supervisory authority

To exercise any of these rights, please contact us at support@heavenecohub.com. We will respond within 30 days. We may need to verify your identity before fulfilling your request.

13. Children's Privacy

Heaven Eco Hub services are not directed at children under the age of 13 (or 16 where applicable under local law). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at support@heavenecohub.com and we will take steps to delete that information promptly.

14. Links to Third-Party Websites

Our website and communications may contain links to third-party websites and services. This Privacy Policy applies solely to Heaven Eco Hub's own Services. We are not responsible for the privacy practices or content of any third-party sites and encourage you to read their privacy policies before providing any personal information.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. Where required by law, we will notify you more directly (e.g. by email or prominent notice on the website). Continued use of our Services after any update constitutes your acceptance of the revised policy.

16. Contact Us

For any privacy-related questions, data requests, or concerns, please contact:

Heaven Eco Hub · Bodhisla LTD
Saint George's, Grenada
support@heavenecohub.com

We aim to respond to all privacy enquiries within 5 business days and to resolve all requests within 30 days.