Privacy Policy

1. Personal Information We Collect

We may collect personal information directly from you, automatically when you use the Services, and from third parties where you authorize the relevant connection or where collection is otherwise permitted by law.

The information collected depends on your account type, the features you use, and the services you access.

1.1 Information You Provide

Account and Registration Information. When you register for HeyOpen, we may collect your email address, account identifiers, authentication details, subscription status, and other information necessary to create and administer your account.

Third-Party Authentication. If you register or sign in through a supported third-party account, such as Google or another authentication provider, we may receive information made available by that provider, including your email address, account identifier, or profile information.

Payment Information. If you purchase a subscription or other paid functionality, our authorized payment processors may collect the information necessary to process your payment. HeyOpen may receive transaction confirmations, billing details, payment status, and subscription records. Additional information is provided in Payment and Billing Information below.

Communications. If you contact us, we may receive your name, email address, message contents, attachments, and other information you choose to provide. Authorized service providers may process and store these communications on our behalf.

Connected Services. If you authorize HeyOpen to connect to an external application, account, or service, we may receive information within the permissions you grant.

Other Information. We may collect information you voluntarily provide through surveys, feedback, promotional activities, events, or other interactions with HeyOpen.

1.2 Information Collected Automatically

Location Information. We may collect or infer your approximate geographic location from your IP address. This information may be used for security, fraud prevention, regulatory compliance, and service administration.

Device Information. We may collect technical information such as IP addresses, browser types, operating systems, device characteristics, language preferences, and session identifiers.

Usage Information. We may collect information about your interactions with the Services, including the features you access, models selected, request timestamps, subscription usage, token consumption, transaction activity, and service-performance information.

Technical and Security Information. We may collect error reports, authentication records, security events, and other operational information necessary to maintain and protect the Services.

Cookies and Similar Technologies. We may collect information through cookies, local storage, and similar technologies, as described in Cookies and Similar Technologies below.

1.3 AI Prompts and Outputs

The Services allow you to submit text, documents, images, audio, video, instructions, and other materials (“Prompts”) to generate responses or other content (“Outputs”).

HeyOpen processes Prompts and Outputs to provide the AI functionality you request.

Depending on the selected model, feature, and processing configuration, this information may be transmitted to authorized third-party AI providers.

We seek to minimize unnecessary access to and storage of private conversation content. Certain processing operations may require temporary handling of Prompts, Outputs, uploaded files, or generated media.

The applicable processing, retention, and privacy protections depend on the relevant technical implementation and provider arrangements.

Where a particular feature or processing route is identified as zero retention, that designation applies to the information and activities expressly covered by the relevant arrangement.

1.4 Media and Likeness Information

HeyOpen may allow users to upload or generate images, audio, video, and other media.

If you upload media depicting an identifiable individual, you must possess the necessary rights and permissions to submit and process that content.

Certain media-generation services may involve third-party providers that process uploaded images, audio, or video to complete the requested generation.

Where processing involves biometric information or other specially protected personal information, HeyOpen will comply with applicable notice, consent, and processing requirements.

The retention of uploaded and generated media depends on the applicable feature and provider arrangements.

2. Payment and Billing Information

Certain features of HeyOpen require payment through subscriptions, usage credits, APIs, or other paid services.

2.1 Payment Processing

Payments may be processed by authorized third-party payment service providers.

When you make a payment, the payment processor may collect information such as your name, billing address, payment-card details, and other information necessary to process the transaction.

Payment credentials submitted directly to a third-party payment processor are processed under that provider’s applicable privacy and security arrangements.

HeyOpen may receive limited billing information, transaction identifiers, payment confirmations, subscription information, and other records necessary to administer paid services.

2.2 Cryptocurrency Payments

Where cryptocurrency payments are supported, HeyOpen may collect or process public wallet addresses, transaction hashes, payment amounts, transaction status, and related blockchain information.

Public blockchain transactions may be accessible to third parties and may remain permanently recorded on the applicable blockchain.

2.3 Transaction Records

We may retain subscription information, purchase history, payment confirmations, invoices, and other commercial records where necessary for accounting, billing administration, fraud prevention, dispute resolution, and compliance with applicable legal obligations.

Payment-related information processed by independent payment providers may be subject to their respective privacy practices.

3. How We Process AI Prompts and Outputs

3.1 AI Processing

When you submit a Prompt, the information necessary to fulfill your request may be processed through HeyOpen’s infrastructure and transmitted to the selected AI model or service provider.

The resulting Output is returned through the Services.

3.2 Private Conversation Content

HeyOpen is designed to provide privacy-focused AI functionality.

We seek to minimize unnecessary collection and retention of private conversation content.

We do not sell private Prompts or Outputs to data brokers or disclose them for unrelated behavioral advertising.

3.3 Model Training

HeyOpen does not use private Prompts, Outputs, or Universal Memory to train its own AI models unless a separate, expressly disclosed arrangement has been authorized by the user.

Independent model providers may be subject to additional contractual restrictions concerning the use of Prompts and Outputs for training.

The applicable restrictions depend on the selected provider and processing arrangement.

3.4 Zero-Retention Processing

Certain supported models or processing routes may operate under zero-data-retention arrangements.

Where such arrangements apply, the relevant provider is restricted from retaining or reusing covered Prompt and Output content beyond the processing permitted under the applicable arrangement.

Zero-retention commitments apply only to the information, providers, and processing activities expressly covered by those arrangements.

They do not necessarily prevent the separate processing of account information, billing records, operational metadata, security information, or other information necessary for lawful service administration.

3.5 Temporary Processing

Certain functionality may require temporary processing, buffering, caching, or storage to generate and deliver Outputs, handle uploaded media, or complete authorized operations.

The handling and retention of such information depend on the applicable processing configuration.

3.6 Operational Information

We may maintain information concerning model selection, request timestamps, processing status, usage measurements, token consumption, and other service-related events.

Such information may be used for billing, service administration, security, reliability, and fraud prevention.

Operational information is distinct from the content of private conversations, although certain metadata may qualify as personal information.

4. Third-Party AI Model Providers

HeyOpen may provide access to artificial intelligence models developed, hosted, or operated by independent third-party providers.

These providers may receive Prompts and relevant contextual information as necessary to generate the Outputs requested by users.

4.1 Provider Processing

Third-party model providers may operate under different technical architectures, contractual arrangements, processing locations, and security requirements.

The applicable handling of information depends on the specific provider, model, and processing configuration.

4.2 Retention and Training Restrictions

Where supported by the relevant provider agreement, AI model providers may be contractually restricted from retaining, storing, or using Prompts and Outputs for purposes unrelated to completing the requested processing.

Such restrictions may include limitations on using user content to train or improve AI models.

HeyOpen does not represent that every third-party model provider operates under identical retention or training restrictions.

4.3 Provider Availability

HeyOpen may add, remove, replace, or restrict access to individual AI models and providers.

Changes in the available providers may affect the technical characteristics and data-processing arrangements applicable to particular models.

4.4 Third-Party Privacy Practices

Where third-party providers process information independently, their privacy practices may apply to the relevant processing activities.

Users should review any additional terms or privacy disclosures made available for the models and services they choose to use.

5. Universal Memory

5.1 Memory Functionality

Universal Memory is a HeyOpen feature designed to retain selected contextual information and make relevant information available across supported AI interactions and models.

This functionality may allow users to maintain continuity between conversations, preserve preferences, and provide supported models with relevant context from earlier interactions.

5.2 Memory Storage

Universal Memory may use local or authorized storage arrangements to retain contextual information.

The actual storage location, encryption protections, synchronization behavior, and retention mechanisms depend on the implementation made available to the user.

Where information is stored locally, its availability may depend on the user’s browser, device, or application configuration.

5.3 Memory Controls

Where supported, users may access available controls to review, modify, disable, or delete retained Memory information.

Users are responsible for determining what information they choose to retain and whether it is appropriate for use in subsequent interactions.

5.4 Cross-Model Processing

When Universal Memory is enabled, relevant contextual information may be included in requests transmitted to the selected AI model provider.

The receiving provider may process that information as necessary to generate the requested response, subject to the applicable processing arrangement.

5.5 Memory Deletion

Disabling or deleting Universal Memory does not necessarily reverse processing previously completed by external model providers.

Where deletion is requested, the treatment of relevant information will depend on the applicable storage architecture, technical controls, and legal requirements.

5.6 Privacy Protections

Universal Memory is intended to support continuity across AI models without automatically transferring ownership of retained information to HeyOpen.

HeyOpen does not use private Universal Memory content to train its own AI models unless separately disclosed and expressly authorized.

6. Consensus Mode and Multi-Model Processing

HeyOpen may offer Consensus Mode, allowing multiple artificial intelligence models to process the same Prompt and generate individual or consolidated responses.

When you use Consensus Mode, your Prompt and relevant contextual information may be transmitted to multiple selected model providers.

Where an evaluating or judging model is enabled, that model may receive responses produced by participating models to evaluate or synthesize them.

Each participating provider may operate under different processing arrangements and privacy protections.

We may maintain operational information associated with Consensus Mode, such as participating model identifiers, request status, token consumption, and usage charges, for service administration, billing, security, and reliability.

Users should consider the nature of the information submitted when selecting multiple models, particularly where confidential or sensitive information is involved.

7. Agents and Connected Services

HeyOpen may allow users to connect external applications, accounts, APIs, and other services or authorize AI agents to perform operations through those connections.

7.1 Authorized Connections

When you authorize an integration, HeyOpen may access and process information within the scope of the permissions granted.

This information may include account identifiers, files, documents, messages, transaction information, or other data accessible through the authorized connection.

7.2 Agent Processing

AI agents may transmit information to external applications or systems to perform actions authorized by users.

Such actions may create records, communications, transactions, or other effects outside HeyOpen.

7.3 Third-Party Services

Independent third-party services may process information according to their own privacy policies and applicable contractual arrangements.

This Privacy Policy does not govern processing performed independently by those third parties.

7.4 Revoking Access

Users may revoke supported integration permissions through the applicable HeyOpen controls or external service settings.

Revoking access generally prevents future activity through the revoked authorization but does not necessarily reverse actions already completed or remove information lawfully retained by independent third parties.

7.5 Blockchain-Enabled Operations

Where supported agents or integrations use x402 payments or other blockchain functionality, relevant wallet addresses, transaction identifiers, and payment records may be transmitted to external systems or recorded on public blockchains.

These records may not be reversible or deletable.

8. How We Use Personal Information

We may use personal information for the following purposes:

Providing and Maintaining the Services. To create and administer accounts, authenticate users, process AI requests, deliver Outputs, and operate requested functionality.

Improving the Services. To analyze service performance, identify technical issues, improve reliability, and develop new features using information processed consistently with this Privacy Policy.

Communication and Support. To respond to inquiries, provide requested information, resolve issues, and communicate important updates concerning the Services.

Payment Administration. To manage subscriptions, usage credits, invoices, payment confirmations, refunds, and related transactions.

Security and Abuse Prevention. To detect, investigate, and prevent fraudulent activity, unauthorized access, security incidents, misuse, and violations of applicable policies.

Legal Compliance. To comply with applicable laws, respond to valid legal requests, maintain legally required records, and establish, exercise, or defend legal claims.

Analytics. To understand how users interact with the Services and evaluate operational performance.

Marketing. To send promotional communications where permitted by applicable law and subject to any required consent or opt-out mechanisms.

User-Authorized Functionality. To enable Universal Memory, Consensus Mode, APIs, integrations, AI agents, and other functionality selected or authorized by users.

We may also generate aggregated or appropriately de-identified information for legitimate analytical, operational, and development purposes, subject to applicable law and our stated privacy commitments.

9. How We Disclose Personal Information

HeyOpen may disclose personal information to the following categories of recipients where necessary for the purposes described in this Privacy Policy.

9.1 Model Providers

We may transmit Prompts and relevant information to third-party AI model providers to generate requested Outputs.

Where applicable, these providers are subject to contractual processing, security, retention, or training-related restrictions.

9.2 Vendors and Service Providers

We may disclose information to authorized service providers assisting with hosting, infrastructure, authentication, customer support, billing, security, analytics, and other operational services.

Such providers may process information on our behalf in accordance with applicable contractual and legal requirements.

9.3 Payment Processors

Payment-related information may be processed by authorized payment providers for payment authentication, transaction processing, fraud prevention, invoicing, and related activities.

9.4 Analytics Partners

We may use third-party analytics services to understand how users interact with the Services, evaluate performance, and improve functionality.

Where analytics technologies require consent under applicable law, they will be subject to the relevant consent requirements.

9.5 Partners and Affiliates

We may disclose information to authorized affiliates, professional advisers, and business partners where reasonably necessary for legitimate business, operational, compliance, or legal purposes.

9.6 Legal Requirements

We may access, preserve, or disclose personal information where required or permitted by applicable law, including in response to valid court orders, regulatory requirements, lawful requests from competent authorities, or other legal processes.

We may also disclose information where legally justified to protect rights, property, safety, investigate fraud, or address unlawful activity.

9.7 Corporate Transactions

Personal information may be transferred or disclosed in connection with an actual or proposed merger, acquisition, restructuring, financing, sale of assets, or other corporate transaction, subject to applicable confidentiality and data-protection obligations.

9.8 User Authorization

We may disclose information to third parties where you authorize or direct the relevant disclosure.

10. Cookies and Similar Technologies

HeyOpen may use cookies, local storage, session identifiers, pixel tags, SDKs, or similar technologies to operate the Services and collect information concerning user interactions.

These technologies may be used to maintain login sessions, remember preferences, support authentication, prevent abuse, evaluate service performance, and improve functionality.

Certain technologies are necessary for the operation of the Services. Others may support optional analytics, marketing, or advertising activities.

Where applicable law requires consent for non-essential cookies or similar technologies, we will obtain the required consent before using them.

Third-party analytics or advertising providers, where integrated, may collect information according to their applicable privacy policies and the permissions and consent mechanisms governing those technologies.

Users may manage cookies through available platform controls or browser settings.

Disabling certain cookies or storage mechanisms may affect the functionality of the Services.

11. Your Rights and Choices

Depending on applicable law and your location, you may have rights concerning the personal information processed by HeyOpen.

11.1 Access and Portability

You may request confirmation of whether we process personal information about you and, where applicable, request access to that information.

You may also request a portable copy of eligible information in a structured, commonly used, and machine-readable format.

11.2 Correction and Deletion

You may request correction of inaccurate personal information or deletion of eligible information.

Certain information may be retained where necessary to comply with legal obligations, prevent fraud, resolve disputes, or establish and defend legal claims.

11.3 Restriction and Objection

Where applicable law provides such rights, you may request restrictions on particular processing activities or object to certain uses of your personal information.

11.4 Consent Withdrawal

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect processing lawfully completed before consent was withdrawn.

11.5 Marketing Communications

You may unsubscribe from promotional communications using the applicable unsubscribe mechanism or by contacting us.

Necessary administrative, transactional, account-related, and security communications may continue where legally permitted.

11.6 Privacy Complaints

Where applicable law provides such a right, you may submit a complaint to the competent data-protection authority.

11.7 Exercising Your Rights

You may exercise applicable privacy rights by contacting support@heyopen.ai.

We may request reasonable information to verify your identity before fulfilling a request.

We will respond within the timeframes required by applicable law.

Where a right to appeal is available, you may request reconsideration through the same contact address.

Nothing in this Privacy Policy limits privacy rights that cannot lawfully be waived.

12. Third-Party Websites and Services

The Services may contain links to or integrations with third-party websites, applications, platforms, and other services that are not owned or operated by HeyOpen.

This Privacy Policy does not automatically apply to information processed independently by those third parties.

HeyOpen does not control the privacy practices of every independent third-party service.

We encourage you to review the privacy policies and terms applicable to external services before providing information or authorizing connections.

13. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, unless a longer period is required or permitted by applicable law.

When determining an appropriate retention period, we consider the nature of the information, the purposes for which it is processed, the duration of our relationship with you, applicable legal obligations, security requirements, and the need to resolve disputes or enforce legal rights.

13.1 AI Prompts and Outputs

The handling and retention of Prompts and Outputs depend on the relevant model, technical configuration, and provider arrangements.

Where a verified zero-retention arrangement applies, covered content is handled according to that arrangement.

Other processing configurations may involve temporary storage or retention necessary to provide the requested functionality.

13.2 Generated Media

Certain image, audio, or video generation features may require temporary storage while processing requests or delivering completed media.

The applicable retention period depends on the relevant service, provider, and technical configuration.

13.3 Account and Usage Information

Account information and operational records may be retained for the duration necessary to administer the account and fulfill relevant legal, security, and operational requirements.

13.4 Billing Records

Payment, subscription, and transaction records may be retained for the periods necessary to satisfy accounting, taxation, regulatory, and other legal obligations.

13.5 Technical and Security Records

Technical logs and security-related information may be retained where necessary to maintain service reliability, prevent fraud and abuse, investigate incidents, and comply with applicable obligations.

13.6 Universal Memory

Universal Memory is retained according to the applicable storage implementation and available user controls.

Where supported, users may delete or modify retained information through the relevant functionality.

13.7 Deletion Requests

Where a valid deletion request is received, we will delete, de-identify, or otherwise restrict eligible information in accordance with applicable law.

Certain information may remain in backups, legally required records, or independent third-party systems where deletion is not immediately available or legally required.

14. Security

We use technical and organizational measures intended to protect personal information against unauthorized access, alteration, disclosure, and destruction.

Depending on the applicable technical implementation, these measures may include encrypted communications, access restrictions, authentication controls, infrastructure protections, and security monitoring.

Certain features may incorporate additional privacy-enhancing technologies, including client-side encryption, end-to-end encryption, or Trusted Execution Environments, where expressly implemented.

These technologies provide different forms of protection and may not apply uniformly across every model, processing route, or feature.

Although we take reasonable steps to protect personal information, no electronic transmission, storage system, or processing infrastructure can be guaranteed to be entirely secure.

Where legally required, we will notify affected individuals or competent authorities of qualifying personal-data breaches in accordance with applicable laws.

15. Children’s Privacy

The Services are intended for individuals aged thirteen (13) years or older.

Users under eighteen (18) years of age must obtain the consent of a parent or legal guardian, as described in our Terms of Service.

We do not knowingly collect, maintain, or use personal information from children under thirteen (13) years of age.

The Services are not directed toward children under 13.

Certain models or functionality involving mature content or reduced content restrictions may be limited to users aged 18 or older, or a higher age where legally required.

Where we become aware that personal information has been collected from an ineligible child in violation of applicable law, we will take appropriate measures to address the situation.

If you believe that a child has provided personal information in violation of this Privacy Policy, please contact support@heyopen.ai.

16. International Data Transfers

HeyOpen may use service providers and technical infrastructure located in different countries.

Personal information may be processed or stored outside the country in which you reside, depending on the selected model, infrastructure provider, payment service, integration, or other operational arrangement.

Where information is transferred internationally, we will comply with applicable data-protection requirements.

For transfers subject to the European Union General Data Protection Regulation or United Kingdom General Data Protection Regulation, applicable safeguards may include adequacy decisions, approved Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or other legally recognized mechanisms.

You may contact us for additional information about applicable international transfer safeguards, subject to relevant legal and confidentiality restrictions.

17. Legal Bases for Processing European Personal Information

Where the EU GDPR, UK GDPR, or similar applicable laws require a legal basis for processing personal information, HeyOpen relies on the applicable legal bases described below.

Consent. Where you have provided valid consent for specific processing activities, including certain marketing communications or optional functionality.

Contractual Necessity. Where processing is necessary to provide the Services, administer accounts, fulfill requested functionality, or perform our contractual obligations.

Legal Obligations. Where processing is necessary to comply with applicable laws, tax requirements, accounting obligations, regulatory requirements, or valid legal processes.

Legitimate Interests. Where processing is necessary for legitimate business interests, such as maintaining security, preventing fraud, improving reliability, conducting internal analytics, or operating the Services, provided those interests are not overridden by applicable rights and freedoms.

Where processing is based on consent, withdrawal of consent does not affect processing lawfully completed before withdrawal.

18. Account Deletion

You may request deletion of your HeyOpen account by contacting support@heyopen.ai or using available account-management controls.

Upon receiving and verifying a valid request, we will delete, de-identify, or otherwise restrict eligible personal information in accordance with applicable law.

Certain information may be retained where necessary to meet legal obligations, maintain transaction records, prevent fraud, investigate security incidents, or resolve disputes.

Account deletion does not necessarily erase information independently retained by external model providers, connected applications, payment processors, or other third parties.

Information recorded on public blockchains may be permanent and generally cannot be deleted or modified by HeyOpen.

Deleting your account may result in the loss of access to subscriptions, account settings, API credentials, connected services, and other functionality.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Services, technical infrastructure, provider arrangements, data-processing activities, applicable laws, or security practices.

When changes are made, the updated Privacy Policy will be published through https://heyopen.ai with a revised effective date.

Where required by applicable law, we will provide additional notice of material changes or obtain consent before implementing relevant processing activities.

We encourage users to review this Privacy Policy periodically.

20. Contact Information

Hey Open is responsible for the processing activities described in this Privacy Policy to the extent it acts as the applicable data controller or business under relevant privacy laws.

For questions, requests, complaints, or concerns regarding this Privacy Policy or the processing of personal information, please contact:

Privacy Inquiries: support@heyopen.ai

General Support: support@heyopen.ai

We will review privacy-related requests and respond in accordance with applicable legal obligations.