GDPR & Your Data Rights

This page explains your rights under the EU General Data Protection Regulation (GDPR), the UK GDPR and India's Digital Personal Data Protection Act, 2023 (DPDP Act). We offer the same rights to everyone, wherever they live. It adds to our Privacy Policy, which describes what we collect and why.

Heyperai is the controller of the personal data described in the Privacy Policy (a “data fiduciary” under the DPDP Act). You can contact us about data protection at hello@heyperai.com.

We only process personal data where the law allows it:

• Contract — to provide the Service you signed up for, including running your jobs and managing your subscription.
• Legal obligation — for example, keeping invoices for tax purposes.
• Legitimate interests — keeping the Service secure, preventing abuse, and improving it with aggregated usage. We only rely on this where our interests are not outweighed by yours.
• Consent — only where we ask for it, and you can withdraw it at any time.

The Privacy Policy lists the basis for each purpose.

• Access — get a copy of the personal data we hold about you, and a summary of how we use it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted, including your whole account, unless we must keep something by law (such as invoices).
• Portability — receive the data you gave us in a structured, machine-readable format. Your generated outputs can also be downloaded from your library at any time.
• Restriction — ask us to pause using your data while a concern is resolved.
• Objection — object to processing based on legitimate interests, including any direct marketing.
• Withdraw consent — at any time, without affecting earlier processing.
• Nominate — under the DPDP Act, nominate someone to exercise your rights if you die or become unable to.

Email hello@heyperai.com from the address on your account and tell us which right you want to use. If you write from another address, we may ask you to confirm your identity before acting, to protect your data from someone pretending to be you.

Requests are free. We reply within one month. If a request is complex, we may extend that by up to two further months, and will tell you why within the first month.

Some of our providers process data outside the European Economic Area, the United Kingdom and India, including in the United States. Where a country has not been found to protect data adequately, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for a copy of the relevant safeguards.

The providers that process personal data for us are listed on our Subprocessors page, and are bound by contracts that require them to protect it. If you use Heyperai for a business and need a data processing agreement, email hello@heyperai.com.

If a breach puts your personal data at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the law requires, and tell you without undue delay if it is likely to affect you significantly.

Please contact us first — we would like the chance to put things right. You also have the right to complain to a data protection authority: in the EU, the authority in the country where you live or work; in the UK, the Information Commissioner's Office; in India, the Data Protection Board of India.