Privacy Policy

The short version

Hyegro Pty Ltd ("Hyegro", "we") makes Hyegro, a business platform for sales, marketing, operations and support. This policy explains what personal information we handle, why, who helps us, where it goes and what you can do about it.

• We don't sell personal information, and we don't share it for cross-context behavioural advertising.
• Data in your workspace belongs to your organisation. We process it on your organisation's instructions.
• Our servers are in Indonesia and several of our providers are in the United States, so your information leaves your country. Section 7 explains how we protect it.
• You can ask to see, correct, export or delete your information at privacy@hyegro.com.

1. Who is responsible for your information

For information about website visitors, people who contact us, prospective customers and the people who hold Hyegro accounts, Hyegro Pty Ltd (Victoria, Australia) decides how it's used. Under the GDPR and UK GDPR we are the controller; under the CCPA we are a business.

For information that customers put into their Hyegro workspace (their own customers, leads, employees, conversations and files), the customer organisation is responsible and we act on its behalf: a processor under the GDPR, a service provider under the CCPA. If you are a contact in one of our customers' workspaces, please send privacy requests to that organisation first. We will help them respond.

2. What we collect

You give us

• Contact and company details: name, work email, phone, company, role, country, team size.
• What you tell us about your business when you request early access, take the assessment, chat with our website assistant or go through onboarding.
• Account details: username, password (stored as a one-way hash), multi-factor authentication settings.
• Billing details: billing contact and plan. Card details go straight to Stripe; we don't store full card numbers.
• Messages to our team and support requests.

Collected automatically

• Website usage: pages viewed, referrer, campaign tags (UTM), approximate location from IP address, device and browser. Collected with Google Analytics and Microsoft Clarity, which records how pages are used, such as clicks and scrolling.
• Product usage and security data: sign-in history, IP address, device, feature use and error logs, used to run, secure and improve Hyegro.

From connected services

If your organisation connects Gmail, Outlook, WhatsApp Business, Messenger, Xero or another integration, we receive the data that integration provides (for example emails, messages, contacts and invoices) and store it in your workspace.

Hyegro is built for businesses. We don't knowingly collect information from anyone under 18, and Hyegro is not designed to store sensitive information such as health or biometric data. Please don't put it into your workspace unless your contract with us allows it.

3. How we use it, and our legal bases

• To provide Hyegro: create and run your account and workspace, set it up with you, sync your integrations and support you. Basis: performing our contract with you or your organisation.
• To bill you and keep financial records. Basis: contract and legal obligation.
• To keep Hyegro secure: detect abuse, investigate incidents, enforce our terms. Basis: legitimate interests and legal obligation.
• To improve Hyegro and our website, using usage and error data. Basis: legitimate interests; for non-essential website cookies in the EU/UK, your consent.
• To reply to enquiries and send relevant updates about Hyegro to business contacts. You can unsubscribe at any time. Basis: legitimate interests or consent where the law requires it.

We do not use the content of customer workspaces to train our own AI models, and we do not make decisions with legal or similarly significant effects about you solely by automated means.

4. AI features

Some Hyegro features use AI models from third-party providers (listed in section 6), for example setting up a workspace from a description, drafting emails and automations, voice features and our website chat assistant. When you use one, we send the provider the prompt and the record content the feature needs, and nothing more than that feature requires.

We use these providers through their business APIs, under their commercial terms. AI output can be wrong; review it before relying on it. If you connect your own AI assistant to Hyegro through our MCP server, that assistant's provider handles the data under your agreement with them, and it can only reach what your Hyegro permissions allow.

5. Who we share it with

• Service providers who run parts of Hyegro for us (section 6), under contracts that limit them to providing their service.
• Integrations and people your organisation chooses: connected apps, your workspace's users and, if your organisation uses it, its customer portal.
• Professional advisers, and authorities where the law requires it or to protect rights, safety and property.
• A buyer or successor if Hyegro is involved in a merger, acquisition or sale of assets, who must keep honouring this policy.

6. Sub-processors

These companies process personal information for us. Integrations marked as such only receive data when your organisation connects them. We will update this list and the date at the top before adding a sub-processor; customers who need advance notice can ask us for it.

7. International transfers

Hyegro's application and database are hosted in Indonesia. Files and backups, email, payments, AI and monitoring use providers mainly in the United States, with some processing in the European Union, New Zealand and on global networks. Your information will be disclosed to recipients in these countries.

For Australian and New Zealand individuals, we take reasonable steps under APP 8 and IPP 12 so that overseas recipients protect your information to a comparable standard, chiefly through contractual terms. For transfers from the EU, EEA, UK and Switzerland to countries without an adequacy decision (including Indonesia and, where the EU-US Data Privacy Framework doesn't apply, the United States), we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Ask us for a copy of the relevant safeguards.

8. How long we keep it

• Workspace data: for as long as your organisation's account is active. When an account closes, we give the account admin a chance to export, then delete the workspace from live systems; backups roll off on their normal cycle.
• Account, billing and tax records: for as long as the law requires (in Australia, generally 7 years for tax records).
• Enquiries and leads sent to Hyegro: while they're useful for the conversation they relate to, and deleted sooner if you ask.
• Security and error logs: only as long as needed to run and protect the service.
• For a specific retention period for your data, email privacy@hyegro.com.

9. Security

We use encryption in transit (TLS), one-way hashed passwords, authenticator-app two-factor authentication, role-based access inside workspaces, an extra layer of application encryption for secrets such as integration tokens, sign-in history and nightly backups. No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify affected people and regulators as the law requires, including under Australia's Notifiable Data Breaches scheme and within 72 hours where the GDPR applies. Report a security issue to security@hyegro.com.

10. Your choices and rights

Wherever you are, you can ask us for access to your personal information, to correct it, to export it or to delete it, and you can opt out of marketing email at any time. Email privacy@hyegro.com. We'll verify it's you, reply within 30 days (45 days for California requests, with one extension where the law allows), and won't treat you differently for asking.

EU, EEA and UK

You can also object to processing based on legitimate interests, restrict processing, withdraw consent at any time, and complain to your local data protection authority (in the UK, the ICO).

California

You have the right to know, delete and correct, and to opt out of the sale or sharing of personal information. We don't sell or share it, and we don't use sensitive personal information for purposes that would require a right to limit. The categories we collect are identifiers, commercial information, internet activity, approximate geolocation and professional information, for the purposes in section 3. An authorised agent can make a request for you.

Australia and New Zealand

If you're unhappy with how we handled your information, tell us first. If we don't resolve it, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or New Zealand's Office of the Privacy Commissioner (privacy.org.nz). You can deal with us without identifying yourself where that's practical, though we can't provide an account that way.

11. Cookies

Our product uses cookies and local storage that are essential for signing in and keeping your session secure. Our website uses Google Analytics and Microsoft Clarity to understand how it's used, but only after you accept them in the cookie banner. You can change your choice any time with the Cookie settings link in the footer, and block or delete cookies in your browser; essential ones are needed for the product to work.

12. Changes and contact

If we change this policy in a way that matters, we'll update the date at the top and tell account holders by email or in the product before the change takes effect.

Questions or requests: privacy@hyegro.com. Hyegro Pty Ltd, Victoria, Australia.