Privacy Policy

Last updated: 2026

This policy explains what data heyly.co (the “Service”) collects, how it’s used, and who it’s shared with. It may be updated as our practices evolve.

What we collect

  • Account information — your name, email, and profile picture from Google sign-in, and your business profile (hours, services, pricing, custom instructions).
  • Conversations — the text of web-chat conversations and, for phone calls, a transcript of the call. We do not record or store raw call audio.
  • Caller-provided details — information a caller shares with the receptionist, such as their name, phone number, email, address, appointment details, and any message they leave.
  • Usage & billing data — call metadata (time, duration, cost), and, for paid accounts, subscription status via our payment processor.

How we use it

Conversation and caller data is used to generate the receptionist’s responses, book and manage appointments, notify the business owner, and let the business owner review past conversations and callers. We don’t sell your data or use it to train AI models.

AI processing & data sent to language models

To generate replies, the text of a conversation is sent to a third-party large language model provider. For a returning caller, a short summary of details they previously provided (such as their name or an upcoming appointment) may also be included so the receptionist can recognize them. Language models can behave unpredictably and their responses are not guaranteed to be accurate.

Callers and consent

If you are a business using the Service, the people who call you are not the users of this Service and may not see this policy. You are responsible for providing any legally required notice to your callers (for example, that the call is recorded or handled by an automated assistant) and for obtaining any consent required by the laws that apply to you, including two-party (all-party) consent rules. The Service provides an optional setting that has the receptionist disclose it is an automated assistant and that the call may be recorded.

Third parties & sub-processors

We share data with service providers only as needed to run the Service. Each has its own privacy policy:

  • Language model provider (OpenRouter) — generating replies
  • ElevenLabs (optional) — text-to-speech voice
  • Retell — phone call handling and transcription
  • Google Calendar — booking appointments, if connected
  • Resend — sending notification emails
  • Stripe — subscription billing
  • Hosting & database providers — running the Service

Data retention & deletion

We retain conversation, caller, and account data for as long as an account is active or as needed to provide the Service. You can request deletion of your account data, and a caller can ask the business to delete information about them, by contacting us at the address below. Some data may be retained where required for legal, security, or billing reasons.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object to certain processing (for example under the GDPR or CCPA). We do not sell personal data. To exercise a right, contact us at the address below.

Security

We use reasonable technical and organizational measures to protect data, but no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International transfers & children

Data may be processed in countries other than yours. The Service is intended for businesses and is not directed to children under 13, and we do not knowingly collect their data.

Contact

Questions or requests about this policy can be directed to the business operating this Service at [contact email].