heka
← Back to heka

Privacy

Last updated 10 November 2026.

This page covers how heka handles the information you share with the skin plan at quiz.hekaskin.com.au, and anything you send us by email. It's written in plain English. Our terms cover the rest of how the site works.

Who we are

heka is a trading name of Angus O'Connell, a sole trader based in New South Wales (ABN 15 102 316 219). “We” on this page means heka. You can reach us at team@hekaskin.com.au.

What you share with us

  • Your answers to the nine questions (age band, where you live, time in the sun, skin type, shaving, what skincare has gone wrong before, your current routine, your goal and your monthly budget).
  • Your first name and email, and optionally a mobile number for launch texts.
  • Optionally, a single photo of your face. You can get a skin plan without one.
  • If you save starter picks, which products you chose.
  • Your approximate location, which our host works out from your IP address so we can show the UV and weather for your nearest capital city. We use it for that one lookup and don't store it.

The skin plan is for people aged 18 and over.

How your skin plan is made

Your first name, your answers and your photo (if you add one) are sent to Anthropic, the company behind the Claude AI model, which writes your skin plan. The model describes visible things like skin tone, oil and texture, and suggests a routine from the heka range. It is general skincare information, not medical advice or a diagnosis, and it doesn't make any decision about you beyond which steps and products to suggest.

Your photo is used once, to write your read. heka does not store it. Anthropic handles what we send under its commercial API terms; see its privacy policy.

What we keep and why

Your email, first name, quiz answers, skin plan summary and product picks are stored in Klaviyo, our email platform. We use them to:

  • Email you your skin plan and follow-up tips.
  • Tell you when heka launches and when stock is available.
  • Send you content that fits the answers you gave.

Texts: If you opt in, we store your mobile number in Klaviyo to send launch messages. Reply STOP to opt out.

We keep your profile until you ask us to delete it. Unsubscribing stops our emails but leaves your profile in place, so email us if you want it gone.

Who we share it with

We do not sell or rent your data. We only share it with the services that run the skin plan:

  • Anthropic, to write your skin plan (above).
  • Klaviyo, for email and texts.
  • Google, for site analytics, and Meta, for measuring our ads (both below).
  • Vercel, which hosts the site, and Redis Cloud, which holds short-lived counters keyed by IP address to stop abuse. The counters expire after a short time and aren't linked to your answers.
  • Google Workspace, which holds our email, if you write to us.

Cookies and analytics

We use Google Analytics, loaded through Google Tag Manager, to count visits and see which of the skin plan questions people finish. It sets cookies and receives your browser and device type, approximate location, the pages you view and the answer options you pick (for example your age band or your goal). It never receives your name, email, mobile number or photo. You can block it in your browser settings or with Google's opt-out add-on.

We also use the Meta Pixel, loaded the same way, to see which Facebook and Instagram ads lead to people getting a skin plan. It sets cookies and tells Meta when you start the questions, submit your email, see your skin plan, save starter picks or turn on texts. When you submit your email, a hashed copy of it (a one-way code, not the address itself) goes to Meta with your IP address and browser type, so Meta can match the sign-up to an ad you saw. Meta never receives your name, answers, mobile number or photo. You can change how Meta uses this in your ad preferences.

If you arrive from an ad or a shared link, the campaign tags in the link (such as utm_source) are kept in your browser and saved with your profile when you submit, so we know which ads bring people in.

Your answers, first name, email and skin plan are kept in this browser tab's session storage until you close the tab. The photo is never stored there.

Data held outside Australia

We follow the Australian Privacy Principles under the Privacy Act 1988 (Cth). Anthropic, Klaviyo, Google, Meta and Vercel are US-based, so your data is processed and stored outside Australia, mostly in the United States. We chose these providers for their published privacy and security practices, but overseas privacy law may not protect you in the same way as Australian law. By using the skin plan you consent to this overseas handling.

See, correct or delete your data

Email team@hekaskin.com.au from the address you submitted. You can ask for a copy of what we hold about you, ask us to fix something that's wrong, or ask us to delete your profile. We'll delete it from Klaviyo within 7 days and reply when it's done. heka does not hold your photo, so there is nothing of it to delete on our side.

Complaints

If you think we've mishandled your information, email team@hekaskin.com.au and we'll reply within 30 days. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this page

If we change how we handle your data, we'll update this page and the date at the top.