Privacy Policy

1. Who we are

Hailyo ("we", "us") is provided by Ravinaro LLC, a Wyoming (United States) limited liability company. This policy covers the Hailyo platform at app.hailyo.com and the marketing site at www.hailyo.com. It is part of the Terms of Service.

2. What we process

• Account data: your name, email, password (hashed), workspace and billing details, and a record of each time you accepted our terms (version, time, IP address and browser).
• Connected mailboxes: credentials for the mailboxes you explicitly connect (Microsoft 365 sign-in tokens, Google Workspace app passwords or SMTP/IMAP logins), used only to send messages you approve and read replies to those messages.
• Lead data: publicly available business information (company name, website content, published business contact emails) discovered from the open web at your direction, plus your communications with those leads.
• Usage and device data: logs of how the Service is used, IP addresses and browser details, kept to run, secure and improve it.

3. Roles: controller vs processor

For your own account, billing and usage data, we are the controller. For lead data you discover and process through Hailyo, you are the controller and we act as processor: you choose who to contact, determine the lawful basis (our campaign tools require a jurisdiction attestation), and we process on your documented instructions under the data processing terms.

4. How and why we use data

• Providing the Service you signed up for (discovery, drafting, sending, tracking, replies): performance of our contract with you.
• Protecting the platform and the email ecosystem from abuse (rate limits, content screening, suppression lists), and improving the Service: our legitimate interests.
• Billing, tax, keeping records of your acceptance of our terms, and answering lawful requests: legal obligations and our legitimate interest in being able to prove our agreements.
• Service emails about your account. We do not sell data, and we do not email your leads for our own marketing.

5. Subprocessors and international transfers

We use carefully chosen third parties to operate the platform: a cloud hosting provider, a payment processor, AI model providers, web search and page-reading services, email verification, a transactional email provider, and the mailbox providers you connect. The categories are on the sub-processors page; for security we share provider names with customers on request, under confidentiality.

We are a US company, and some providers process data in the US and other countries. Where data from the EU, UK or UAE is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum) in our providers' terms. EU workspaces can keep their workspace data in EU-resident storage.

6. Your rights (and your leads' rights)

Depending on where you are, you may have rights to access, correct, delete, restrict or port your data, to object to processing, and to complain to your data protection authority. That includes the GDPR and UK GDPR, the UAE Personal Data Protection Law, and US state privacy laws. Write to [email protected] for anything about your own data; we answer within the time the law sets.

Hailyo provides built-in data-subject-request tooling so you (as controller) can fulfil requests relating to lead data — erasure requests propagate to suppression lists instantly.

7. If you received an email sent through Hailyo

The business that emailed you chose to contact you and is responsible for that email; Hailyo is the software it used. Use the opt-out link in the email, or reply to the sender, to stop further messages. You can also write to [email protected] (or forward the email to [email protected]): we will tell the sender, add your address to its suppression list, and help with access or deletion requests.

8. Security & retention

Mailbox credentials and secrets are encrypted at rest (AES-GCM). Data is stored with our cloud hosting provider with daily backups (30-day point-in-time recovery). EU-tenant data can be pinned to EU-resident storage. We delete account data within 30 days of verified account deletion, except what we must keep by law or to establish or defend legal claims (such as invoices and records of your acceptance of our terms), which we keep only as long as needed for that purpose.

9. Changes

We will tell you about material changes to this policy by email or in the app before they take effect.

10. Contact

Privacy questions: [email protected] · Ravinaro LLC.