Privacy Policy

1. Who we are

HeyEveryone Inc., Dover, Delaware, United States, is the controller of the personal information described here. This policy covers the HeyEveryone web application and website, which is the whole of what we operate.

For any privacy question or request, write to hey@heyeveryone.io.

2. Information we collect

Account information

Your email address, a display name, and your account role. If you sign in with Google, we receive your email address from Google to identify the account. Google is the only external sign-in provider we support.

We do not collect a phone number, a postal address, or a date of birth, and we never receive your payment card details.

Your Company Profile

This is the substance of what you give us: company name, founder name, sectors, a company overview, your unique value proposition, the problem you solve, your solution, target market, traction, funding stage, the amount you are raising, use of funds, team background, and a booking link. It is confidential fundraising material and we treat it as such.

We also store a model-generated interpretation of your profile: a structured summary of your investment thesis fit, derived from the text you wrote. It is a copy of your information in another form, so everything in this policy applies to it too.

Your connected mailbox

The email address and provider of the mailbox you connect for sending, your access and refresh tokens (encrypted, see section 4), your sending rate preference, an optional custom signature, and an optional reply-to address.

When you run a deliverability check on your own sending domain, we look up that domain's public DNS records. Those lookups go through a third-party public DNS resolver, so your mail domain is disclosed to that resolver as part of the check.

Files you upload

Attachments you add to outgoing emails, in practice usually a pitch deck. They are stored privately, with access restricted to your own account, and are limited by size and to common document and image formats.

Removing an attachment from an email DETACHES it: the email no longer carries the file, but the uploaded object itself stays in storage. We are telling you this rather than describing it as deletion, because it is your pitch deck. To have an uploaded file actually deleted, ask us (section 12) and we will delete it by hand.

Emails you generate and send

The subject and body of each draft, its version history, which investor it is addressed to, the personalization the model used and where that came from, the send and delivery status, and, if the message bounces, the bounce reason, which can include the recipient's email address.

Activity records

We keep application logs against your account for essentially every action, holding your user id and structured detail about what happened. We also store lifecycle state used to decide which system emails you should receive.

3. We collect your Company Profile before you have an account

This is unusual enough to deserve its own section. You can fill in the Company Profile before registering. When you do, there is no account to attach it to, so we store it against a random identifier that your browser generates and keeps in its local storage. That identifier is saved alongside the profile.

If you go on to register, the profile is linked to your new account and the anonymous identifier stops mattering. If you never register, the profile stays with us keyed only by that identifier, and we have no practical way to connect it to you, which also means we cannot easily find it to delete it on request. If you want a pre-registration profile removed, tell us the company name you entered and we will find and delete it.

4. Your connected mailbox, tokens and scopes

Emails send from your own mailbox, so we hold credentials for it. Both the access token and the refresh token are encrypted at rest with AES-256-GCM, using a key held only in our server environment, and are re-encrypted when they rotate. They are never sent to your browser and never written to logs.

Exactly which permissions we request

For Google, we request three scopes and no others:

• gmail.send, to send the emails you approve.
• gmail.readonly, used for one narrow purpose only, described in section 5.
• userinfo.email, to know which address the mailbox is.

For Microsoft: offline_access, Mail.Send and User.Read. Only one mailbox is connected at a time, and connecting a new one deletes the previous connection and its tokens.

You can disconnect the mailbox at any time in Settings, which deletes the connection and the stored tokens. You can also revoke our access from your Google or Microsoft account security settings.

5. Google API Services Limited Use disclosure

HeyEveryone's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Why we request gmail.readonly, and what we do with it

We request the restricted gmail.readonly scope for exactly one operation. Immediately after you send an email, we read back a single header, the Message-Id, from that one message. We need it because Gmail replaces any Message-Id we set, and the real value is the anchor that makes your follow-up appear in the same conversation thread as the original email instead of as a disconnected new message.

Specifically:

• We request one message by its id, asking only for header metadata, and we read only the Message-Id header.
• We do this only for messages you just sent through HeyEveryone.
• We do not list, search, browse, index or store your inbox or any other message.
• We do not read incoming mail, and we have no automated reply detection. If you want to record that an investor replied, you mark it yourself in the product.
• We do not use Gmail data for advertising, we do not sell it, and we do not use it to train models.
• No human at HeyEveryone reads your Gmail data.

In the interest of being accurate rather than flattering: the gmail.readonly scope Google grants is broader than the single use described above, because Google does not offer a scope narrow enough to read one header of one message. Our commitment is that the use above is the only use our software makes of it.

6. How we use your information

• To match you with investors, by comparing your Company Profile against our investor database.
• To draft your emails, by sending your profile and public information about the investor to a model provider.
• To send the emails you approve, through your connected mailbox.
• To show you whether those emails were opened or clicked (section 9).
• To run your account and billing, including credits, plans and invoices.
• To send you service messages you cannot opt out of, such as password resets, payment receipts and security notices.
• To send you product and marketing messages you can opt out of at any time (section 10).
• To provide support, and to investigate abuse, fraud and technical faults.
• To meet legal obligations.

We do not use your Company Profile or your emails to train our own models, and the model providers we use do not train on the data we send them under our agreements with them.

Where we rely on a legal basis under the GDPR, it is: performance of our contract with you for running the service; your consent for optional marketing and for connecting your mailbox; and our legitimate interests in securing the service and preventing abuse.

7. Who we share information with

We do not sell or rent your personal information. We do share it with service providers we rely on to operate the platform, and we reserve the right to share it with the providers without which the service cannot technically function. Each of them processes it on our behalf, for the purpose it was engaged for and nothing else, under a contract that requires it. We share the minimum each provider needs.

By category, those providers are:

• Cloud hosting, database and file storage, which necessarily hold the information described in section 2, including uploaded attachments.
• AI model providers, which receive your Company Profile and the investor's public content in order to extract your thesis, assess investor fit, and draft your emails.
• The mail provider whose mailbox you connect, which receives the outgoing email itself because it is the one sending it as you, along with the requests described in section 4.
• Email infrastructure used to deliver our own system messages to you.
• A payment processor, which receives your email address and plan details. Card details go directly to its own hosted checkout page and never touch our servers.
• Public data sources and collection services used to gather investors' publicly posted content. These receive information about the investor, not about you or your company.
• Public DNS resolvers, queried with your sending domain when you run a deliverability check on it.
• Customer support tooling, including the chat widget on our public marketing pages, which receives whatever you type into it.
• Internal operational alerting, which notifies our team about events such as a registration, a payment, or a system alert affecting an account. Those notifications can include your email address.

We keep the specific identity of our providers current rather than fixed, so that we can change one without rewriting this policy. If you want to know exactly which companies we use today and what each receives, ask us at hey@heyeveryone.io and we will tell you. Section 5 separately names Google, because the permissions you grant to your Gmail account require it.

We may also disclose information if the law requires it, to enforce our terms, to protect our rights or someone's safety, or in connection with a merger, acquisition or sale of assets, in which case we will tell you before your information becomes subject to a different policy.

Internal access

Our own staff can see your account and your full Company Profile through an internal administrative interface, and do so for support, troubleshooting and quality purposes. In particular, if matching returns no investors for you, we review your profile to work out why. Staff can also enter a read-only view of your account to reproduce a problem you report; entering and leaving that view is recorded. Access is limited to staff who need it.

International transfers

We are based in the United States and our providers are largely US-based, so if you are outside the United States your information is transferred there. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on the transfer mechanisms our providers offer, typically the European Commission's standard contractual clauses.

8. Investor information and public social content

Our investor database is compiled from public sources, including venture firm websites where investors publish their investment focus. It includes professional contact details.

To personalize your emails, we also collect investors' recent public posts from public social and professional profiles. We collect posts only. We do not collect comments or reactions, and we do not access anything that is not publicly visible. This content is cached for a short period and refreshed when it is used again.

When you generate an email, that investor's public post content is sent to the model provider together with your Company Profile, so the draft can reference something the investor actually said.

If you are an investor in our database and want to see, correct or remove your record, write to us and we will handle it.

9. Open and click tracking of your outgoing emails

When you send an investor email through HeyEveryone, we add a small tracking image to it and route links in it through us, so we can show you whether the message was opened and whether a link was clicked. This tracking is of your recipient's behaviour, carried out on your behalf, which is why the sender obligations in the Terms of Use are yours.

For each open or click we store:

• which email it relates to, and whether it was an open or a click,
• the clicked URL,
• a cryptographic hash of the recipient's IP address, rather than the address itself,
• the recipient's browser user agent string, in full.

To be accurate rather than flattering: we do not describe the hashed IP address as anonymized. Treat it as personal information that we store in hashed form, and nothing more than that. The raw IP address is not stored. The user agent string is stored as received.

Clicked URLs are also recorded in our application logs, which are covered by the retention period in section 12.

10. Cookies, local storage and marketing email

We use no third-party analytics at all. No analytics suite, tag manager, social advertising pixel or product-analytics tool of any kind is loaded anywhere in the product. Nothing on our site profiles you across other websites, and we run no advertising cookies. This is the full list of what we do set:

• Session cookies, which keep you logged in and are refreshed as you browse. Strictly necessary; they last as long as your session.
• A short-lived security cookie used when you connect a mailbox, to protect that flow against cross-site request forgery. Expires within minutes.
• An interface preference cookie, remembering how you left the layout. Lasts about a week.
• A support cookie set only for our own staff during a read-only review of an account.
• Browser storage holding the identifier that keys a Company Profile filled in before registration (section 3), and your light or dark theme preference. These are stored in your browser, not as cookies.
• Browser session storage used to remember that you dismissed an in-app notice. Cleared when you close the tab.

Third-party scripts

Two third-party scripts run in your browser on our site, and both may set cookies we do not control. One is the support chat widget, which loads on our public marketing pages only and never inside the application. The other is Google's sign-in script, which loads where you can create or access an account, and is named here because signing in with Google means Google is involved by definition. No payment script runs on our domain: checkout happens on our payment processor's own hosted page.

Marketing email and how to stop it

You can unsubscribe from our product and marketing email at any time, using the link in any such message, and you can set preferences per category. Service messages are different: password resets, payment receipts, security notices and similar messages are part of running your account, and unsubscribing does not stop them. If you want those to stop, close your account.

11. How we protect information

Traffic to and from HeyEveryone is encrypted in transit with TLS. Mailbox tokens are encrypted at rest with AES-256-GCM, as described in section 4. Uploaded files are stored privately and access to them is restricted to your own account, as is access to your records in our database. We apply industry-standard protections at the application and infrastructure level, and we review them as the product changes.

No service is perfectly secure, and we do not publish the details of our security configuration. If you believe your account has been compromised, or you have found a vulnerability, tell us and we will act on it.

12. How long we keep information

The retention periods we set are:

• Technical and operational logs: 90 days.
• Records of internal administrative access to accounts: up to 400 days, because a longer trail is what makes that access auditable.

Everything else is kept for the life of your account: your Company Profile, your generated and sent emails, your credit and subscription history, uploaded attachments, and open and click records. We do not currently run an automated job that deletes older data, so assume data persists until you ask us to remove it or we close your account.

Some records we keep after deletion of the rest, where we have to: billing and transaction history for tax and accounting purposes, and the minimum needed to resolve disputes or enforce our terms.

13. Your rights, and how to exercise them

You have the rights below regardless of where you live. We deliberately do not promise self-service buttons that do not exist: except where noted, exercise a right by writing to hey@heyeveryone.io and we will respond within 30 days. We may need to verify your identity first, usually by confirming control of the account email.

Access

You can ask for a copy of the personal information we hold about you, and for confirmation of the categories we collect, where we got them, why we process them, and who we share them with. Send the request and we will assemble it. There is no self-service export screen in the product today.

Correction

You can correct your information yourself: your Company Profile is editable in Settings at any time, and re-running matching will use the corrected version. For anything you cannot reach from the interface, including your account email, ask us.

Deletion

You can ask us to delete your account and your personal information. This is a manual process handled by our team: there is no delete-account button in the product, and we would rather say so than send you looking for one. On request we delete your Company Profile, your generated emails, your uploaded files including any attachment that was previously only detached, and your account, keeping only what the retention section says we must. You can already disconnect your mailbox yourself in Settings, which deletes the stored tokens immediately.

Export and portability

You can ask for your information in a portable, machine-readable format, and where the GDPR gives you the right, for it to be transmitted to another provider. Again, this is a request, not a button.

Objection and restriction

You can object to processing based on our legitimate interests, ask us to restrict processing while a dispute is resolved, and withdraw consent you have given, including by disconnecting your mailbox or unsubscribing from marketing email.

If you are in California

The categories of personal information we collect are: identifiers, such as your name and email address; commercial information, such as your plan, credit and payment history; internet and network activity, such as application logs and the open and click records described in section 9; and the professional and business information in your Company Profile and uploaded files. Sections 2 and 3 describe each in detail, section 6 gives the purpose, and section 7 gives the categories of provider we disclose them to for a business purpose, along with how to ask us for the specific list.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either, and we run no advertising or data-broker integrations at all. You have the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing, which in our case is nothing to opt out of. We will not discriminate against you for exercising any of these rights: your service, price and credit allocation do not change because you made a request. You may use an authorized agent, and we will ask for proof of their authority.

If you are in the EEA or the UK

You also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to put things right first.

14. Children

HeyEveryone is a business tool for adults and is not directed to children. You must be 18 or older to use it, and we do not knowingly collect personal information from anyone under 18. We do not verify age, so if you believe a child has given us information, tell us and we will delete it.

15. Changes to this policy

We may update this policy. The version and last-updated date at the top of this page always reflect the current one. If a change materially affects how we handle your information, we will notify you by email or in the product before it takes effect, rather than quietly changing the page.

16. Contact

For any privacy question, request or complaint: hey@heyeveryone.io.

HeyEveryone Inc., Dover, Delaware, United States.

See also our Terms of Use.