Data processing and sub-processors
Last updated October 18, 2026 · Provided by Ravinaro LLC, a Wyoming limited liability company.
1. Who controls what
For your own account data, Hailyo is the controller. For lead data you discover and process through Hailyo, you are the controller and Hailyo acts as processor: you choose who to contact and the lawful basis for it, and Hailyo processes that data on your instructions. The privacy policy has the full detail.
2. Sub-processors
These are the kinds of third parties Hailyo uses to run the product. For security we don't publish provider names.
| Provider | What it does for Hailyo |
|---|---|
| Cloud hosting provider | Hosting, databases and file storage, in the US or the EU as each workspace chooses |
| Payment processor | Payments, invoices and tax |
| AI model providers | Researching leads and drafting emails |
| Web search providers | Searching the web for leads |
| Web page reading service | Reading public web pages |
| Email verification | Checking that an address can receive email |
| Transactional email provider | Account, security and billing emails from Hailyo |
| The mailbox providers you connect | Sending the emails you approve and reading the replies |
Customers can ask for the named list, under confidentiality, at [email protected]. Every provider is bound by data protection terms at least as protective as ours.
3. Where data is stored
Each workspace chooses US or EU residency. EU workspaces are kept in a separate EU database and EU file storage. Mailbox credentials are encrypted at rest with AES-GCM. See security.
4. Requests from you and your leads
EU and UK users have GDPR rights including access, rectification, erasure and portability. Hailyo has built-in tools so you, as controller, can handle requests about lead data; an erasure request goes onto your suppression list straight away. For anything about your own data, write to [email protected].
5. Retention
Data is backed up daily with 30-day point-in-time recovery. Account data is deleted within 30 days of a verified account deletion.