Privacy Policy

1. Who we are

Hailyo ("we", "us") is operated by Ravinaro LLC-FZ. This policy covers the Hailyo platform at app.hailyo.com and the marketing site at www.hailyo.com.

2. What we process

• Account data: your name, email, password (hashed), workspace details.
• Connected mailboxes: credentials for the mailboxes you explicitly connect (Microsoft 365 sign-in tokens, Google Workspace app passwords or SMTP/IMAP logins), used only to send messages you approve and read replies to those messages.
• Lead data: publicly available business information (company name, website content, published business contact emails) discovered from the open web at your direction, plus your communications with those leads.

3. Roles: controller vs processor

For your own account data, we are the controller. For lead data you discover and process through Hailyo, you are the controller and we act as processor: you choose who to contact, determine the lawful basis (our campaign tools require a jurisdiction attestation), and we process on your documented instructions.

4. How we use data

• Operating the service (discovery, drafting, sending, tracking, attribution).
• Protecting the platform and email ecosystem from abuse (rate limits, content screening, suppression lists).
• Billing and service communication. We do not sell data, and we do not email your leads for our own marketing.

5. Subprocessors

We use third parties to operate the platform: Cloudflare (hosting, databases), Stripe (payments), the LLM/search/scraping/verification providers you or we configure (OpenAI/Anthropic or equivalent, Serper, Exa, Firecrawl, email verifiers), and Google/Microsoft APIs for mailbox access. The current list is available on request.

6. Your rights (and your leads' rights)

EU/UK users have GDPR rights including access, rectification, erasure, and portability. Hailyo provides built-in data-subject-request tooling so you (as controller) can fulfil requests relating to lead data — erasure requests propagate to suppression lists instantly. Contact [email protected] for anything about your own data.

7. Security & retention

Mailbox credentials and secrets are encrypted at rest (AES-GCM). Data is stored in Cloudflare D1 with daily backups (30-day point-in-time recovery). EU-tenant data can be pinned to EU-resident storage. We delete account data within 30 days of verified account deletion.

8. Contact

Privacy questions: [email protected] · Ravinaro LLC-FZ.