Privacy Policy
This policy explains how HMH Labz LLP (“HMH Labz”, “we”) handles personal data in connection with Heyozo, our AI assistant for WhatsApp Business and Telegram, and the website heyozo.com. HMH Labz LLP is a limited liability partnership registered in India. We follow India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and, where our clients or their customers are elsewhere, the data protection laws that apply to them.
Two different roles
- When a business uses Heyozo to talk to its customers on WhatsApp or Telegram, that business decides why and how its customers' data is used. It is the data fiduciary (or “controller”); we process the data on its behalf and on its instructions, as its data processor. If you are a customer of such a business, its own privacy notice applies, and requests about your data should go to that business first. We will help it respond. How we process data for businesses is described on our Data Processing page.
- For our own relationships (people who visit heyozo.com, contact us, or sign in to a Heyozo dashboard on behalf of a client) we are the data fiduciary, and this policy applies directly.
What we collect for our own purposes
- Website visitors. heyozo.com sets no cookies and runs no analytics, advertising or third-party scripts. If you switch the page to Arabic, that choice is saved in your own browser only. Our servers handle your IP address to deliver the page and to protect sign-in pages from abuse (rate limiting); it is not used to profile you.
- People who contact us by email or for a demo: your name, contact details, company and what you tell us, used to reply and to arrange the demo.
- Dashboard users at a client: your email, name, role, sign-in times, and an audit log of changes you make. Passwords are stored only as salted hashes.
- Client business details needed to run the contract and invoice it.
What Heyozo processes for businesses
On a business's instructions, Heyozo processes its customers' WhatsApp number and profile name, or their Telegram user ID, username and display name, any name, area, address note and language they share, the content of messages in both directions, the text transcript of voice notes (audio files are not kept), orders, appointments and coupons they make, and their marketing consent with its evidence. Heyozo does not ask for special categories of data and never handles payment card details. Full detail is on the Data Processing page.
Why we use it
- To provide, secure and support Heyozo under our contract with each client.
- To answer enquiries and run demos you asked for.
- To meet legal, tax and accounting obligations.
We do not sell personal data, and we do not use clients' customer conversations to train AI models.
Who receives it
Only the service providers we need to run Heyozo, each bound by contract and listed on the Data Processing page (hosting, WhatsApp and Telegram delivery, AI model providers, DNS and backups), and authorities where the law requires it.
Where it is processed
The application and database run on Amazon Web Services in the United States. Model providers, Meta and Telegram may process data in other countries. We transfer data outside India only as the DPDP Act permits and, for clients in other countries, as their laws permit.
How long we keep it
- Client conversation and customer records: for the life of the client's contract, then deleted or returned on the client's instruction. A shorter period can be agreed.
- Encrypted backups expire after 30 days, so deleted data leaves the backups within 30 days.
- Enquiries that do not lead to a contract: up to 12 months.
- Invoicing records: as long as tax law requires.
How we protect it
Each client's data is separated inside the database by row-level security enforced by the database itself. Traffic is encrypted with TLS. WhatsApp access tokens and Telegram bot tokens are encrypted at rest, and message content is never written to our logs. Dashboard accounts are per person with roles; our own staff console requires two-factor authentication. Backups are encrypted before they leave the server with a key held off the server.
Your rights
Under the DPDP Act and similar laws you can ask to access, correct, complete or erase your personal data, withdraw consent you gave, nominate someone to act for you, and raise a grievance. Customers of a business that uses Heyozo can reply STOP on WhatsApp or Telegram at any time to stop marketing messages; this takes effect immediately. For anything else, contact the business, or us at hello@hmhlabz.com. If you are not satisfied with our response, you may complain to the Data Protection Board of India or your local data protection authority.
Children
Heyozo and heyozo.com are meant for businesses and are not directed at children.
Changes
We will update this page when our practices change and change the date at the top. Significant changes will be told to clients directly.
Contact and grievances
HMH Labz LLP, India. Email hello@hmhlabz.com.