Privacy Policy

At Hedy AI, we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. By using or accessing our Services in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use and share your information as described in this Privacy Policy.

Remember that your use of Hedy AI's Services is at all times subject to our Terms of Use, which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Use.

As we continually work to improve our Services, we may need to change this Privacy Policy from time to time. We will alert you of material changes by sending you an email and/or by some other means. Please note that if you've opted not to receive legal notice emails from us (or you haven't provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them. If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes.

What this Privacy Policy Covers

This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. "Personal Data" means any information that identifies or relates to a particular individual and also includes information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws, rules or regulations. This Privacy Policy does not cover the practices of companies we don't own or control or people we don't manage.

Personal Data

AI-Specific Data Processing

Understanding How Hedy Uses Artificial Intelligence

Hedy leverages advanced artificial intelligence to provide real-time conversation insights while maintaining the highest standards of user privacy and data protection.

1. Local-First Processing

• By default, audio capture and transcription happen directly on your device
• In this default configuration, no audio is transmitted to our servers or to any third party
• Optional cloud alternatives: if you enable a cloud speech-to-text provider with your own API key, connect an OMI wearable, or turn on iCloud audio sync, audio or transcript content is handled by that service under your own account with it

2. Contextual Analysis

Our AI provides insights by:

• Analyzing conversation context
• Generating relevant suggestions
• Creating summaries and highlights
• Identifying key themes and action items

3. AI Service Provider Relationship

• Cloud AI analysis is routed through our AI gateway to inference providers determined by your account's data region. For accounts in the European Union region, inference runs on EU-based infrastructure; for all other accounts, on US-based infrastructure. The current list is published at trust.hedy.ai/subprocessors
• Inference providers process transcripts solely to generate Hedy's insights, on our documented instructions
• Inference providers do not retain conversation content after processing and do not use it for model training. The gateway retains request metadata, not conversation content, for 30 days
• Requests carry no user-identifying metadata: your name, email address, and account identifier are not included in what the provider receives

4. User Data Control

• You can delete individual sessions or your entire account at any time from within the app
• On our native apps, conversation content is stored on our servers when you enable Cloud Sync, and when you explicitly share a session. The web app always stores content in the cloud, as it has no local storage
• Turning Cloud Sync off stops future content from syncing, but does not delete content that was already synced

Consent and Transparency

By using Hedy, you understand and consent to this privacy-preserving AI analysis approach. We are committed to continuous improvement of our privacy protections while delivering intelligent, context-aware conversation support.

Data Processing Limitations

• AI analysis does not build behavioral profiles of you across sessions
• Your conversations are not used to train or improve AI models, by us or by our inference providers

Categories of Personal Data We Collect

Profile or Contact Data: First and last name, Email. Shared with: Service Providers, Analytics Partners, Parties You Authorize.

Conversation Data: Transcripts of your conversations, Chat interactions with Hedy, Highlights, Summaries, Detailed Notes. Shared with: Service Providers, Parties You Authorize.

Device/IP Data: IP address, IP-address-based location information, Device ID, Type of device/operating system/browser used to access the Services. Shared with: Analytics Partners, Parties You Authorize.

Web and App Analytics: Web page and app interactions, Referring webpage/source through which you accessed the Services. Shared with: Analytics Partners, Parties You Authorize.

Other Identifying Information that You Voluntarily Choose to Provide: Identifying information in emails, letters, texts, or other communication you send us. Shared with: Service Providers, Analytics Partners, Parties You Authorize.

Google API Data

To the extent we collect Personal Data about you through use of a Google API, our use and transfer of such Personal Data to any other third-party will be in compliance with the Google API Services User Data Policy, including the Limited Use Requirements.

Experimental Features and Pre-GA Offerings

Hedy AI may offer features labeled as "Experimental" or similar designations. These features operate under different terms regarding data processing and privacy.

When using Experimental Features:

• Modified Data Handling: Your Personal Data may be processed differently from our standard services
• Third-Party Services: Experimental Features may use additional third-party services. Any such service is bound by the same data protection obligations that apply to our other sub-processors
• Limited Warranties: Experimental Features are provided "AS IS" and may be changed or discontinued without notice

Categories of Sources of Personal Data

You: When you provide information directly, create an account, use interactive tools, send us emails, or through cookies and location-enabled browsers.

Third Parties - Vendors: We may use analytics providers and vendors to generate leads and create user profiles.

Third Party Accounts: If you sign in through a third-party site, some content may be transmitted into your account.

Our Commercial or Business Purposes for Collecting Personal Data

Providing, Customizing and Improving the Services: Creating accounts, processing transactions, providing support, improving services, personalization, fraud protection.

Marketing the Services: Marketing and selling the Services.

Corresponding with You: Responding to correspondence, sending information and communications.

Meeting Legal Requirements: Fulfilling legal obligations, protecting rights, enforcing agreements, resolving disputes.

How We Disclose Your Personal Data

Service Providers: Hosting, security, support, payment processors.

Analytics Partners: Companies tracking web traffic and usage.

Parties You Authorize: Organizations, third parties, social media services, other users.

Data Sales Prohibition

Hedy AI does not sell, lease, rent, or trade your Personal Data to any third parties.

Tracking Tools and Opt-Out

The Services use cookies and similar technologies. Types include Essential Cookies, Functional Cookies, and Performance/Analytical Cookies. You can manage cookie settings in your browser.

Data Security

We seek to protect your Personal Data using appropriate physical, technical, organizational and administrative security measures. No method of transmitting or storing data is completely secure.

Data Retention

We retain Personal Data as long as necessary to provide the Services or to meet legal obligations. Conversation content stored on our servers is retained until you delete it or delete your account; there is no automatic deletion schedule. Content held on your device is retained until you delete it within the app. Gateway request metadata is retained for 30 days.

Personal Data of Children

We do not knowingly collect Personal Data from children under 16.

Other State Law Privacy Rights

California Resident Rights

California residents can request access, deletion, and information about data usage. Contact support@hedy.bot.

Nevada Resident Rights

Nevada residents can request data access, deletion, and transparency. Contact support@hedy.bot.

European Union, United Kingdom, and Swiss Data Subject Rights

EU/UK/Swiss residents have rights including Access, Rectification, Erasure, Withdrawal of Consent, Portability, Objection, Restriction of Processing, and Right to File Complaint.

Transfers of Personal Data

Where your data is stored depends on the data region set when your account was created. Accounts in the European Union region have their conversation content, including sessions, transcripts, and AI-generated content, stored on our servers in a European database (Google Cloud eur3, with replicas in Belgium and the Netherlands); for all other accounts that content is stored in the United States. Some processing is not region-specific regardless of your region, including authentication, routing metadata, our AI gateway, error diagnostics, analytics, subscription management, payment processing, support, and email. Transfers to the United States are made under Standard Contractual Clauses, or under the EU-US Data Privacy Framework where the provider is certified. Our Data Processing Addendum and its annexes describe these safeguards and the current sub-processors, and are available at hedy.ai/dpa.

Contact Information

• support@hedy.bot
• Hedy AI, 5331 S Macadam Ave, Ste 258 PMB 1137, Portland, OR 97239-3871
• EU Representative: EU-REP.Global GmbH, hedy@eu-rep.global, Hopfenstraße 1d, 24114 Kiel, Germany
• UK Representative: DP Data Protection Services UK Ltd., hedy@eu-rep.global, 16 Great Queen Street, Covent Garden, London, WC2B 5AH

Previous version: January 28, 2025