Privacy Policy

Heyly is an AI phone assistant for small businesses. It answers, places and assists on phone calls on your behalf, and turns those calls into transcripts, summaries and follow-up actions. Doing that requires handling some genuinely sensitive material, the contents of your phone calls above all. This policy sets out exactly what we collect, why, who else touches it, and what you can demand we do with it.

This policy covers the Heyly mobile application (Android package ai.heyly.app) and the Heyly service behind it.

Recording calls is your responsibility as well as ours. Heyly can record and transcribe phone calls. In many US states, and in most countries outside the US, recording a call requires the consent of some or all parties, and the rules differ depending on where each person is physically located. You are responsible for obtaining any consent the law requires of you before recording a call through Heyly. We give you controls to disable recording, and an announcement option, but we cannot know which laws apply to your calls.

1. Who we are

Heyly is operated by Anaki. For any privacy question, request or complaint, contact us at adar@anaki.co.il. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

2. What we collect

Information you give us

Account details - your name, email address and profile picture when you sign in with Google, or your phone number when you sign in by SMS verification code.
Business setup - your business name, the greeting your AI assistant uses, and how you want calls handled.
Payment details - handled entirely by Stripe. We never see or store your full card number; we keep only a Stripe customer reference and your plan status.

Information from your phone

Contacts - so a caller shows up as a name rather than a number, and so your assistant knows who it is speaking to.
Call log - so your call history in the app matches the calls that actually happened on your phone.
Microphone audio - during calls and meetings you choose to capture.
Phone state and phone number - to know when a call starts and ends, and which of your lines is in use.

Information generated by using Heyly

Call metadata - the numbers involved, direction, time, duration and outcome of each call.
Call recordings - audio of calls handled or captured by Heyly, where recording is enabled.
Transcripts, summaries and AI notes - text derived from those recordings, including facts your assistant remembers about people and jobs so it is useful on the next call.

Information from services you connect

Connecting Google is optional, and Heyly works without it. If you do connect it, we request these scopes and use them only as stated:

Scope	What we do with it
`calendar`, `calendar.events`	Read your availability and create or update events when a call results in an appointment.
`gmail.send`	Send follow-up emails you or your assistant compose as a result of a call.
`gmail.readonly`	Read email context relevant to a caller so your assistant can act on an existing thread.

Heyly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve advertising, we do not sell it, and we do not use it to train generalised AI models. You can disconnect Google at any time in the app, or revoke access from your Google account permissions page.

3. Why we use it, and our legal basis

Purpose	Legal basis (GDPR/UK GDPR)
Answering, placing and assisting on your calls	Performance of a contract
Transcribing and summarising calls; assistant memory	Performance of a contract
Matching callers to your contacts	Performance of a contract
Billing, and preventing abuse or runaway usage	Contract, and our legitimate interests
Keeping the service secure and diagnosing faults	Legitimate interests
Meeting legal, tax and telecoms obligations	Legal obligation

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not use your call content or Google data to train generalised AI models.

4. Who else touches your data

We use a small number of processors, each for one job:

Provider	Role
Telnyx	Carries the calls and provides your phone numbers. Processes call audio and metadata in transit.
Cloudflare	Hosts the service and stores recordings, transcripts and account data.
AI processing providers	Speech-to-text and language models that produce transcripts, summaries and in-call assistance.
Google	Sign-in, and Calendar/Gmail features if you connect them.
Stripe	Subscription payments.

These providers act on our instructions under contract. We may also disclose data where legally compelled, or to protect our rights, users or the public. If Heyly is ever acquired or merged, data may transfer as part of that transaction, and we will tell you before it becomes subject to a different policy.

5. Where your data is held

Heyly runs on globally distributed infrastructure, so your data may be processed in the United States, the European Union, Israel and other countries where our providers operate. Where data leaves the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep it

Data	Retention
Call recordings	Kept while your account is active, unless you delete them sooner. Deleted within 30 days of account closure.
Transcripts, summaries and assistant memory	Same as recordings.
Call metadata	Retained for billing and dispute resolution, then deleted or aggregated.
Contacts	Held while your account is active; removed when you disconnect contacts or close your account.
Account and billing records	Kept as long as required by tax and accounting law.

7. Your rights and controls

In the app you can delete individual recordings and transcripts, disconnect Google, disable contact and call-log sync, turn recording off, and close your account.

Depending on where you live, you may also have the right to access a copy of your data, correct it, delete it, restrict or object to processing, port it elsewhere, and withdraw consent. California residents have the rights to know, delete, correct and opt out of sale or sharing under the CCPA/CPRA, and as stated above, we do not sell or share personal information in that sense. We will not discriminate against you for exercising any right.

To make a request, email adar@anaki.co.il. We respond within the period the applicable law requires, and we may need to verify your identity first.

8. People who call you

Heyly necessarily processes information about third parties, the people on the other end of your calls. Where we do this on your behalf, you are the controller of that data and we are your processor, and it is your responsibility to have a lawful basis for it, including any recording consent. If you have called or been called by a Heyly user and want to exercise rights over that data, contact us and we will route your request to the responsible business.

9. Children

Heyly is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

10. Security

Data is encrypted in transit and at rest, access to production systems is restricted, and telephony webhooks are cryptographically verified. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant regulators as the law requires.

11. Changes

If we change this policy materially, we will update the date above and notify you in the app or by email before the change takes effect.

Heyly is operated by Anaki. Contact: adar@anaki.co.il.