Privacy Policy
What personal data we collect, why we collect it, who we share it with, how long we keep it, and the choices you have.
This summary is here to help you find your way. The full text below is what applies.
Who we are
This policy explains how Heyperai (“we”, “us”) handles personal data when you use heyperai.com and the Heyperai service. For data protection law we are the controller of your personal data, except where we process it on behalf of a business customer.
Questions or requests about your data go to hello@heyperai.com.
What we collect
Account data. Your email address and password (stored as a secure hash, never in plain text), or — if you sign in with Google or X — the name, email address and profile picture those services share with us, along with an account identifier.
Your content. Prompts, images, video, audio and other files you upload; the outputs generated for you; and projects, collections, workflows and transcripts you create in the app.
Billing data. Your plan, payment and invoice records, and the identifiers Razorpay gives us for your payments and subscription. Card and bank details are collected and held by Razorpay, not by us.
Usage data. Records of the jobs you run, the models used, and the credits spent and returned, which we need to charge you correctly and to answer billing questions.
Technical data. IP address, browser and device details in the security and request logs kept by us and our infrastructure providers.
Communications. Emails you send us, and details you give when you request an invite, such as your email address and social media profiles.
Blog readers. Reading the blog doesn't require an account. We count page views, and when you follow an affiliate link we record which link was clicked, when, and which page it was on. These counts are not linked to you.
How we use it
| Purpose | Legal basis |
|---|---|
| Creating your account, running your jobs, storing your library | Performing our contract with you |
| Taking payments, managing subscriptions and credits, issuing invoices | Contract; legal obligations (tax and accounting) |
| Answering support requests and sending service emails | Contract; legitimate interests |
| Preventing fraud and abuse, and keeping the Service secure | Legitimate interests; legal obligations |
| Understanding aggregate usage to improve the Service | Legitimate interests |
| Complying with the law and responding to lawful requests | Legal obligations |
If we ever want to use your data for something that needs your consent — such as marketing emails — we will ask first, and you can withdraw consent at any time.
What we don't do
- We don't sell or rent your personal data.
- We don't show ads, and we don't use advertising or cross-site trackers.
- We don't use your inputs or outputs to train our own AI models.
- We don't make decisions about you by automated means that have legal effect.
Who we share it with
We share personal data only as needed to run the Service:
- AI model providers receive your prompt and any files the job needs, only to generate your output.
- Infrastructure providers host our database, file storage and sign-in.
- Razorpay processes payments and subscriptions.
- Google and X, if you choose to sign in with them.
Each one is listed on our Subprocessors page. We may also disclose data when the law requires it, to protect people's safety or our rights, or to a buyer if our business is sold — in which case this policy would continue to apply to your data.
International transfers
Our providers operate in several countries, including the United States and India, so your data may be processed outside the country where you live. Where the law requires it, we protect those transfers with safeguards such as the European Commission's Standard Contractual Clauses. See GDPR & Your Data Rights for more.
How long we keep it
- Account data and your content — while your account is open. When you delete something, or ask us to delete your account, we delete it from our live systems within 30 days. Copies in backups are overwritten on a rolling schedule.
- Billing records — as long as tax and accounting law requires, which can be up to eight years.
- Security logs — for a limited period, then deleted or aggregated.
- Support emails — as long as needed to deal with your request and any follow-up.
Security
We protect your data with encryption in transit, access controls that limit each account to its own data, and restricted, audited access for our team. No system is perfectly secure; if a breach affects your personal data, we will tell you and the relevant authorities as the law requires.
Your rights and choices
Depending on where you live, you can ask to access, correct, export or delete your personal data, or object to or restrict how we use it. Email hello@heyperai.com — the GDPR & Your Data Rights page explains each right and how we handle requests. You can manage cookies as described in the Cookie Policy.
Children
The Service is not intended for anyone under 18, and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We will update this policy when our practices change, and change the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.
Contact
For anything about your privacy, write to hello@heyperai.com.