HeyChat
Log in

Last updated October 23, 2026

Privacy Policy

Effective date: October 23, 2026

heychat.cc (“HeyChat,” “we,” “us,” or “our”) provides an online customer communication platform that lets businesses and organizations chat with their customers, answer common questions automatically from knowledge the business provides, and book appointments through a Sales Agent.

This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use heychat.cc, our websites, applications, and related services (collectively, the “Services”).

HeyChat is headquartered in the United States. Because our Services may be used by people and businesses located in other countries, this Privacy Policy also describes certain rights and protections that may apply under laws such as the California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (“CPRA”), the European Union General Data Protection Regulation (“GDPR”), and the UK GDPR.

By using the Services, you acknowledge the practices described in this Privacy Policy.

1. Information We Collect

We collect information necessary to provide, secure, maintain, and improve the Services.

A. Account Information

When you create a HeyChat account, we may collect:

  • Name
  • Email address
  • A password, if you sign in with one. It is stored only as a one-way hash, never as the password itself.
  • Google account identifier
  • Profile information provided through Google Sign-In, such as your profile photo
  • If you use Sign in with Apple, your Apple account identifier and the name and email address Apple shares
  • Account and authentication information
  • Business or organization information that you choose to provide, such as the business name, link, color, and settings
  • Subscription and billing information, such as your plan and payment history. Stripe holds your card details; we don’t.

HeyChat lets you sign in with an email address and password, Google Sign-In or Sign in with Apple, on the web and in the HeyChat app. We generally request only the information necessary to authenticate your account and provide the Services. We do not use your Google or Apple account information for advertising or unrelated purposes.

B. Business Knowledge

If you use HeyChat to answer customer questions automatically, you may provide information such as:

  • Frequently asked questions and answers
  • Business descriptions
  • Product or service information, such as services, hours, and prices
  • Website content
  • Customer-support documentation
  • Policies and procedures
  • Other information that you choose to add to your HeyChat knowledge

This information is used to build and maintain your business knowledge and to answer questions customers send in your chat. HeyChat may send a passage from it to a customer word for word as an automatic answer, so write only what customers may see.

You are responsible for ensuring that you have the rights and permissions necessary to provide this information to heychat.

C. Customer Messages

When someone chats with a business on HeyChat, we may collect and process:

  • Messages, photos, and files sent in the chat
  • Automatic answers sent on the business’s behalf
  • Conversation history
  • The name or contact details a customer chooses to give
  • Technical information associated with the conversation
  • Information that the business chooses to collect from its customers

To help a business follow up, HeyChat saves the name, email address or phone number a customer types in a message as a contact for that business. Its team can see, edit and unlink these contacts. A customer may also sign in with Google or Apple on a business's page to keep their conversation, which shares their name and email address, and with Google their profile photo, with HeyChat and that business. A business's team sees when a message has been read, and a check mark beside a customer's name when they signed in with Google or Apple.

A team member or customer can be invited with an invite link or QR code. We record who made the link, who used it, and whether they were let in.

A customer can mute a conversation, which stops its notifications for them, or remove it from their own list; the business keeps it and isn't told. Closing the chat on a business's website clears it from that device.

Businesses using HeyChat are responsible for determining what information they collect from their customers and for providing any additional notices required by applicable law.

D. Automatically Collected Information

We may automatically collect certain technical information when you use the Services, including:

  • IP address
  • Browser type
  • Device type
  • Operating system
  • Approximate geographic information derived from IP address
  • Time zone and language
  • Notification settings, if you turn notifications on
  • Pages or features accessed
  • Date and time of access
  • Referral information
  • Log and diagnostic information
  • Information about how the Services are used

We use this information primarily for security, fraud prevention, troubleshooting, analytics, service operation, and improving the Services. Our page and performance measurements are privacy-friendly and are not used to build advertising profiles.

E. Cookies and Similar Technologies

HeyChat may use cookies, local storage, session technologies, and similar technologies to:

  • Keep users signed in
  • Maintain sessions
  • Remember preferences
  • Provide security features
  • Understand how the Services are used
  • Improve performance

We use a cookie to keep you signed in. The chat a business's customers use (the chat widget on the business's website and its chat page on heychat.cc) uses only essential cookies and local storage: one to recognize the visitor so their conversation continues on that device, and one to show times in their time zone. It has no analytics or advertising cookies. Our own website and web app use Google Analytics, which sets cookies to understand how they are used, and a performance service that does not use cookies. The pages the HeyChat app opens in its in-app browser, such as a business's settings, its appointment book, this policy and an order's payment page, use no analytics. We do not use advertising cookies. Where required by applicable law, we will request consent before using non-essential cookies or similar technologies.

You may control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Services.

F. Waitlist and Updates

If you join the waitlist, we collect your email address and team size, send you a welcome email, and may send you updates about heychat. You can unsubscribe at any time using the link in any of these emails.

G. The HeyChat App

The HeyChat app for iPhone and Android collects what the Services above do, for the same purposes, and in addition:

  • A photo from your library or camera, or a file, only when you choose one to send
  • A notification token for your phone, if you allow notifications, so we can tell you about new messages
  • If you chat with a business in the app without an account, a random identifier for your phone, so the conversation stays yours. If you later sign in, the conversation moves to that account.
  • With each sign-in, the app’s version and your phone’s operating system, and whether it is a phone or a tablet, to keep your sign-ins secure

We also keep a record of the kinds of device you have signed in on, such as the iPhone app or a computer browser, and when you last did, so we can see which kinds of device people use HeyChat on and support them well. The website does the same with your browser and device type when you sign in there.

The app contains no advertising, analytics or crash-reporting code, and does not track you across other apps or websites. It does not read your phone's contacts or location. Signing out removes the notification token, and deleting your account removes your sign-ins.

If you turn on Face ID to unlock the app, your phone checks your face itself: that data never leaves your phone, and HeyChat never receives it.

H. Sales Agent, Flows and Appointments

A business can turn on a Sales Agent that asks customers the questions the business set, answers from its knowledge, and books visits or takes requests such as a quote. When it does, we collect for that business:

  • the answers a customer gives to the business’s questions, such as the service they need
  • the name, phone number, email address and address a customer gives for a booking or request
  • the visit time, and any change, confirmation or cancellation by the customer or the team
  • which flows a conversation went through and how it ended, so the business can see how its flows perform

HeyChat emails the customer about the booking when they give an email address, with links to add it to their calendar, and a private link where they can answer a new time the team proposes. The team gets the booking in its appointment book, by email and by notification, and can subscribe to its appointments through a private calendar link; anyone with that link can see those appointments, so the business should keep it private.

An admin may connect a Google Calendar. HeyChat then reads that calendar's busy times, so it only offers times the team is free, and writes each visit to it with the customer's answers, contact details and a link to the chat. It does not read the details of other events. We keep the connection's access encrypted, and the admin can disconnect it at any time.

I. Orders and Payments

A business can let its customers order from its menu in the chat, for example food to pick up. When a customer orders, we collect for that business:

  • the name and phone number the customer gives for the order
  • what was ordered, with any choices and notes, the pickup time, and the prices, tax and total
  • the order’s progress, such as paid, done, cancelled or refunded, and who on the team changed it

The customer pays through the business's own Stripe account, on a Stripe payment page. Stripe collects the card details under its own privacy policy, and HeyChat never receives the card number; we receive only whether the payment succeeded and its amount. The business's team sees the order in the chat and on its Orders page, in the app or on the web, and it can be printed on the business's kitchen printers.

2. How We Use Information

We may use information we collect to:

  1. Create and manage accounts.
  2. Authenticate users.
  3. Provide and operate heychat.
  4. Deliver and translate messages.
  5. Create and maintain business knowledge.
  6. Answer common customer questions automatically with text the business wrote or approved.
  7. Save the contact details customers share, so a business can follow up.
  8. Run a business's Sales Agent: ask its questions, offer open times, book and manage visits, and send booking emails.
  9. Send the notifications and emails you ask for.
  10. Provide customer support.
  11. Process subscriptions and payments.
  12. Maintain security and prevent fraud, abuse, and unauthorized access.
  13. Monitor and troubleshoot technical problems.
  14. Analyze usage and improve the Services.
  15. Develop new features and functionality.
  16. Communicate with users about their accounts, subscriptions, security, service changes, and support requests.
  17. Comply with applicable laws and legal obligations.
  18. Protect the rights, property, security, and safety of HeyChat, our users, and others.

We do not sell personal information.

We do not use business knowledge or customer conversations to build advertising profiles.

3. Artificial Intelligence and OpenAI

HeyChat uses AI services provided by OpenAI for these features:

  • to match customer questions to a business’s knowledge. OpenAI receives the text of the customer’s question and the business knowledge to do this.
  • to tidy business knowledge that an admin pastes in into short replies, for the admin to review before use.
  • to draft suggested questions and answers from business knowledge, for an admin to approve, edit, or dismiss.
  • to understand a message typed during a Sales Agent flow, unless the business turns this off: for example which of its questions the message answers, which time or service it means, or whether the customer wants a person. OpenAI receives only that one message, with the business’s questions, open times, flows and services, not the rest of the conversation. Its result is checked before use.

No AI writes the replies customers receive. An automatic answer or Sales Agent message is always text the business wrote or approved, or HeyChat's default wording, sent word for word. Tidied replies and suggested answers are written from business knowledge alone, never from customer conversations, and reach customers only after an admin approves them. We never share one business's knowledge with another business or its customers.

OpenAI states that data submitted through its API is not used to train or improve OpenAI models by default unless the customer explicitly opts in. OpenAI may nevertheless retain certain API data for purposes such as abuse monitoring and security, subject to its applicable data-retention policies.

You should not provide highly sensitive personal information to HeyChat unless the relevant feature specifically requires it and you have determined that doing so is appropriate and lawful.

4. Google and Apple Sign-In

HeyChat uses Google authentication services to allow users to create accounts and sign in. Depending on the authentication configuration, Google may provide HeyChat with information such as:

  • Name
  • Email address
  • Google account identifier
  • Profile information, such as your profile photo

HeyChat uses this information to authenticate your identity, create and manage your HeyChat account, and provide account-related functionality.

HeyChat does not request access to your Gmail, Google Drive, Google Photos, contacts, or other Google services. If an admin chooses to connect a Google Calendar for the Sales Agent, HeyChat asks for permission to see free and busy times, list calendars, and add, change and remove the events it books, and uses that access only as described in section 1.H. Disconnecting it, or revoking access in your Google Account, stops it.

You can revoke an application's Google authorization through your Google Account settings.

On the web, and in the HeyChat app on iPhone, you can also use Sign in with Apple. Apple provides your Apple account identifier and an email address, which may be a private relay address that forwards to you, and the first time you sign in, your name. HeyChat uses them only as described above for Google.

If you use Google and Apple with the same email address as an existing HeyChat account, both sign-ins open that one account. You can stop using Sign in with Apple with HeyChat in your Apple Account settings. When you delete your HeyChat account, we ask Apple to revoke HeyChat's access.

5. How We Share Information

We may disclose information to third parties when reasonably necessary to operate heychat.

Service Providers

We use these service providers, and share only what each one needs:

  • Google, for sign-in, to translate messages, and for Google Calendar when a business connects one
  • Apple, for Sign in with Apple
  • OpenAI, for the features described in section 3
  • Stripe, for payments, including when customers pay a business for an order through that business’s own Stripe account
  • Cloud hosting and infrastructure providers, which host HeyChat, store our database and the photos and files sent in chats, and measure performance
  • Resend, which sends our emails, including booking emails to a business’s customers, and manages the waitlist
  • Your browser’s push service, for notifications you turn on
  • Expo, Apple and Google, which deliver the HeyChat app’s notifications, including the sender’s name and the message

These providers process information on our behalf and are generally contractually restricted from using information for purposes unrelated to providing their services to us. If we add providers for purposes such as security, error monitoring, or customer support, we will update this list.

Legal Requirements

We may disclose information when reasonably necessary to:

  • Comply with a legal obligation, court order, subpoena, or lawful government request
  • Protect our rights or property
  • Investigate fraud or security issues
  • Prevent abuse or illegal activity
  • Protect the safety of users or other persons
  • Enforce our agreements

Business Transfers

If HeyChat is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, information may be transferred as part of that transaction, subject to applicable law.

6. Customer Data and Business Customers

If a business uses HeyChat to communicate with its customers, the business may control the information contained in its business knowledge and customer conversations. In these circumstances, HeyChat generally acts as a service provider or processor on behalf of the business with respect to information that the business submits to heychat.

The business is responsible for:

  • Determining what personal information it collects
  • Providing appropriate privacy notices to its customers
  • Obtaining legally required consent
  • Ensuring that its use of HeyChat complies with applicable laws
  • Ensuring that information submitted to HeyChat is collected and used lawfully
  • Responding to customer requests where the business is the responsible controller

If you chat with a business on HeyChat, that business may have its own privacy policy that applies to its collection and use of your information.

7. International Data Transfers

HeyChat is headquartered in the United States and may use service providers located in the United States and other countries. As a result, your information may be transferred to, stored in, or processed in a country different from the country where you live. Some countries provide different levels of data protection than your home country.

Where required by applicable law, HeyChat will use appropriate safeguards for international data transfers, which may include contractual safeguards such as Standard Contractual Clauses or other legally recognized transfer mechanisms.

8. European Economic Area and UK Users

If you are located in the European Economic Area (“EEA”), the United Kingdom, or another jurisdiction where similar data protection laws apply, you may have additional rights regarding your personal information. Depending on applicable law, these rights may include:

  • Right to access your personal information
  • Right to correct inaccurate information
  • Right to request deletion
  • Right to restrict processing
  • Right to object to certain processing
  • Right to data portability
  • Right to withdraw consent where processing is based on consent
  • Right to lodge a complaint with a data protection authority

We rely on these legal bases:

  • Performance of a contract: to create your account, run your business’s chat, deliver and translate messages, send automatic answers, run its Sales Agent and appointment book, and bill for your plan.
  • Legitimate interests: to keep HeyChat secure, prevent abuse, measure and improve performance, save contact details customers share so a business can follow up, measure how a business’s flows perform, and support customers.
  • Consent: for push notifications and waitlist emails. You can withdraw consent at any time, without affecting processing before you did.
  • Compliance with legal obligations: to keep billing records and respond to lawful requests.

Where a business uses HeyChat to chat with its customers, that business is the controller of its customers' information and decides the legal basis for it (see section 6).

9. California Privacy Rights

If you are a California resident, California privacy laws may provide additional rights. Depending on the circumstances and applicable law, California residents may have rights to:

  • Know what categories of personal information we collect
  • Know how personal information is used
  • Know the categories of sources from which information is collected
  • Know the categories of third parties to whom information is disclosed
  • Request access to personal information
  • Request deletion of personal information, subject to legal exceptions
  • Request correction of inaccurate personal information
  • Opt out of the sale or sharing of personal information, where applicable
  • Limit certain uses of sensitive personal information, where applicable
  • Receive equal treatment for exercising privacy rights

In the last 12 months, we collected these categories of personal information:

  • Identifiers, such as name, email address, phone number, address, Google or Apple account identifier, and IP address
  • Commercial information, such as your plan and payment history, and orders placed with a business
  • Internet or other electronic network activity, such as pages visited and how the Services are used
  • Approximate geolocation derived from IP address
  • Audio, electronic, or visual information, such as photos and files sent in chats
  • Professional information, such as the business you work for
  • The contents of messages sent through the Services

We collect these from you, from the businesses and customers who use HeyChat, from Google when you sign in, and automatically from your device. We use them for the purposes in section 2, disclose them only to the service providers in section 5 for those purposes, and keep them as described in section 11. We do not use sensitive personal information to infer characteristics about you.

HeyChat does not sell personal information as defined by applicable California privacy law.

If we engage in activities that constitute “sharing” of personal information for cross-context behavioral advertising, we will provide any legally required opt-out mechanisms.

How to Exercise California Rights

You may submit a privacy request by contacting us using the information in the “Contact Us” section below. We may need to verify your identity before completing certain requests to protect your account and personal information. If you have an account, we may use information associated with your account to verify your request. You may also use an authorized agent to submit a request on your behalf; we may ask the agent for proof that you authorized them and ask you to verify your identity with us directly.

We will not discriminate against you for exercising rights provided by applicable privacy laws.

10. Other U.S. State Privacy Laws

Several U.S. states have enacted comprehensive privacy laws that may provide residents with rights regarding personal information. Depending on where you live and the laws applicable to HeyChat, you may have rights concerning:

  • Access
  • Correction
  • Deletion
  • Data portability
  • Objection to certain processing
  • Opt-out of targeted advertising
  • Opt-out of certain profiling
  • Opt-out of sale of personal information
  • Appeal of a privacy-rights decision

HeyChat will provide rights required by applicable state privacy laws. Because state privacy laws differ and may change over time, the specific rights available to you depend on your jurisdiction and the circumstances of our processing.

11. Data Retention

We retain personal information for as long as reasonably necessary to:

  • Provide the Services
  • Maintain your account
  • Provide customer support
  • Maintain security
  • Prevent fraud and abuse
  • Comply with legal obligations
  • Resolve disputes
  • Enforce agreements
  • Maintain appropriate business and financial records

We keep a business's data while it has an account. When a business is deleted, its conversations and business knowledge, flows, appointments and orders are deleted with it. An order stays on the business's Orders page when its chat is deleted. When an admin deletes a knowledge entry, it is deleted too, and disconnecting a Google Calendar deletes our access to it; visits already written to that calendar stay there. Billing records are kept as long as tax and accounting laws require.

When information is no longer reasonably necessary for these purposes, we may delete it, anonymize it, or securely dispose of it. Some information may remain in backups for a limited period after deletion.

Deletion from HeyChat does not necessarily cause immediate deletion from the systems of independent third-party service providers where retention is required by their policies, legal obligations, or security requirements.

12. Account and Data Deletion

You can delete your HeyChat account yourself, at any time: in the app, open Settings and tap Delete account; on the web, choose Delete account from the account menu. heychat.cc/delete-account explains the steps and lets you sign in to do it. The account is deleted at once: your name, email address, photo, sign-ins and team memberships are removed, and a business where you are the only person is deleted with it, including its conversations, contacts, appointments and files.

Messages you sent stay in their conversations, shown as from “Deleted user”, with the business they were sent to, because they are part of that business's conversation history. Contact details a business saved, such as a name, email address or phone number typed in a chat or given for a booking, are that business's records; ask the business to remove them. A customer who chatted with a business can also ask that business, or us, to delete their conversation.

Beyond what you delete yourself, we will take reasonable steps to delete or de-identify information, subject to:

  • Legal retention requirements
  • Security and fraud-prevention requirements
  • Financial and accounting requirements
  • Dispute resolution
  • Enforcement of agreements
  • Backup systems that are automatically overwritten according to their retention cycles

Business customers may have additional contractual requirements concerning deletion of customer data.

13. Security

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, disclosure, alteration, and destruction. These measures may include:

  • Encryption in transit and at rest
  • Access controls
  • Authentication controls
  • Secure infrastructure
  • Monitoring and logging
  • Security updates
  • Least-privilege access
  • Protection of authentication credentials

However, no Internet-based service can guarantee absolute security.

You are responsible for protecting your account credentials and for notifying us if you believe your account has been compromised.

14. Children's Privacy

HeyChat is not intended for children under the age of 13. We do not knowingly collect personal information directly from children under 13. If you believe that a child under 13 has provided personal information to HeyChat, please contact us so that we can take appropriate action.

If a different minimum age is required by the laws applicable to your location, that higher age requirement may apply.

15. Do Not Sell or Share

HeyChat does not sell personal information for monetary consideration.

We also do not use business knowledge or customer conversations to create advertising profiles for sale to advertisers.

If our practices change in a manner that creates an applicable right to opt out of sale or sharing under privacy law, we will provide the required notice and opt-out mechanism.

16. Third-Party Services

HeyChat relies on the third-party services listed in section 5 to operate portions of the Services. Third-party services have their own privacy policies and terms. Our privacy policy does not control the privacy practices of third-party providers.

17. Links to Other Websites

The Services may contain links to third-party websites. We are not responsible for the privacy practices, security, or content of third-party websites. We encourage you to review the privacy policy of any third-party website you visit.

18. Do Not Track

Some browsers provide “Do Not Track” signals or similar privacy preferences. Because there is currently no universally accepted standard for responding to all such signals, HeyChat may not respond to every browser-based Do Not Track signal.

Where applicable law requires recognition of a legally recognized global privacy control or similar signal, we will process the signal as required by law.

19. Your Responsibility When Uploading Information

HeyChat is a business communication platform. You should not upload sensitive personal information, confidential information, passwords, authentication credentials, financial account information, health information, government identification numbers, or other highly sensitive information unless:

  1. The feature requires it;
  2. You have a lawful basis to provide it;
  3. You have obtained any required consent; and
  4. You have determined that using HeyChat for that information is appropriate.

Businesses are responsible for ensuring that information provided to HeyChat is collected and processed lawfully.

20. Accuracy of Automatic Answers and AI Drafts

Automatic answers are text the business wrote or approved, but HeyChat chooses which one to send, and it may not fit the question exactly. Suggested answers and tidied replies drafted by AI may contain errors, omissions, or inaccurate statements, which is why an admin reviews them before any customer sees them.

Automatic answers should not be treated as professional legal, medical, financial, or other professional advice.

Businesses using HeyChat are responsible for reviewing their business knowledge and drafts and determining whether automatic answers are appropriate for their customers.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date at the top of this policy.

If we make a material change, we will tell business admins, and we may provide additional notice through the Services, email, or another appropriate method.

22. Contact Us

If you have questions about this Privacy Policy, want to exercise a privacy right, or want to submit a privacy request, chat with us at heychat.cc/chat.

heychat.cc
Website: https://heychat.cc
Headquarters: United States

For privacy requests, please include enough information for us to identify your account or understand your request. We may request additional information to verify your identity when required or permitted by applicable law.

23. Privacy Requests

You may contact us to request:

  • Access to your personal information
  • Correction of inaccurate information
  • Deletion of your information
  • Information about how your information is used
  • Information about categories of third parties receiving your information
  • Withdrawal of consent where applicable
  • Other privacy rights available under applicable law

We will process requests in accordance with the laws applicable to you.

If you are located in the EEA or UK and believe that your privacy rights have been violated, you may also have the right to lodge a complaint with the data protection authority in your country.

24. Additional Notice for Business Customers

If you use HeyChat on behalf of a business, organization, or other entity, you represent that you have the authority to provide information to HeyChat and to authorize its processing in accordance with your agreement with heychat.

Business customers should not use HeyChat to process regulated or highly sensitive information unless the applicable HeyChat service and contractual terms expressly support such processing.

If your organization requires a Data Processing Agreement (“DPA”), security documentation, or additional contractual privacy terms, please contact us before using HeyChat for regulated or sensitive data.

25. Governing Law

HeyChat is headquartered in the United States. This Privacy Policy is intended to describe our privacy practices globally while recognizing that privacy rights and obligations may vary depending on your jurisdiction.

Nothing in this Privacy Policy is intended to limit privacy rights that cannot legally be limited under the laws applicable to you.