Privacy policy

1. Who controls your data

The data controller is Hey.ai, Rua de Pinto Bessa 272, office 2, 4300-427 Porto, Portugal. For any privacy matter, write to [email protected].

2. What we collect

• Contact details you give us, name, work email, company and the message you send through our contact form or by email.
• Engagement data, the information, documents and accounts you share so we can scope and deliver a project.
• Newsletter data, your email, if you subscribe to our notes.
• Technical data, basic, mostly anonymous information your browser sends (approximate location, device and browser type), and, with your consent, analytics and advertising cookies (see 'Cookies' below).
• Client systems data, during a project we may process data held in your systems strictly to build and run what we agreed. We act on your instructions as a processor for that data.

3. Why we use it, and our legal basis

We use contact and engagement data to reply to you, prepare proposals and deliver our services, on the basis of taking steps at your request and performing our contract. We use newsletter data with your consent, which you can withdraw at any time. We use essential technical data for our legitimate interest in keeping the site secure and working. Analytics and advertising cookies are used only with your consent, which you can withdraw at any time.

4. AI providers and your data

Delivering AI automations often means sending data to third-party model providers (such as Anthropic) to produce a result. We only send what's needed for the task, we configure these tools to avoid using your content to train their models where that option exists, and we tell you which providers a project relies on.

Where a project involves sensitive or large-scale personal data, we agree a separate data-processing agreement with you before any such data is processed.

5. Who we share data with

We don't sell your data. We share it only with service providers who help us operate, hosting, email, analytics and the AI providers a project needs, and only as far as needed. They're bound to protect it. We may also disclose data if the law requires it.

6. International transfers

Some providers are outside the European Economic Area. When data is transferred there, we rely on safeguards recognised under the GDPR, such as the European Commission's standard contractual clauses, to keep your data protected.

7. How long we keep it

We keep contact enquiries for as long as needed to follow up, and engagement records for the duration of our work plus the period the law requires (for tax and accounting, typically up to 10 years). Newsletter data is kept until you unsubscribe. Client systems data is deleted or returned at the end of a project, as we agree.

8. How we keep it safe

We use appropriate technical and organisational measures, access controls, encryption in transit, least-privilege access and reputable providers. No system is perfectly secure, but we work to reduce risk and we'll tell you and the authorities if a breach ever requires it.

9. Your rights

• Access, get a copy of the personal data we hold about you.
• Rectification, have inaccurate data corrected.
• Erasure, ask us to delete your data where there's no overriding reason to keep it.
• Restriction & objection, limit or object to certain uses, including direct marketing.
• Portability, receive your data in a portable format.
• Withdraw consent, at any time, without affecting what we did before.

To exercise any of these, write to [email protected]. You also have the right to complain to the Portuguese data protection authority (CNPD).

10. Cookies

This site uses cookies and local storage in two groups. Essential ones make the site work and remember your choices, for example your language and your cookie preference itself; these don't need consent. We also use a privacy-friendly, cookieless measurement of page performance and traffic that doesn't identify you.

Analytics and advertising cookies are optional: we use Google Analytics 4 (provided by Google) to understand how the site is used, and the Meta Pixel (provided by Meta Platforms) to measure and improve our advertising, including when a visit leads to a contact request. These load only after you accept them in the cookie banner, they are off by default, and using them means sharing data with Google and Meta as our providers, which can involve transfers outside the EEA (see 'International transfers').

You can accept or decline when you first visit, and change or withdraw your choice at any time through the 'Cookies' link in the footer.

11. Children

Our services and site are meant for businesses and adults. We don't knowingly collect data from children.

12. Changes to this policy

We may update this policy as our services or the law change. We'll post the new version here with a fresh date, and flag any significant change.