Privacy Policy

HeyEmil, Inc.

Effective Date: May 5, 2026

Last Updated: May 5, 2026

Overview

HeyEmil ("we," "us," or "our") provides an AI-powered chief of staff service for family businesses, delivered primarily over email. This Privacy Policy explains how we collect, use, store, and protect your information when you use our service.

We built HeyEmil to handle sensitive business data responsibly. This policy reflects that commitment in plain language.

1. Information We Collect

1.1 Account Information

When you onboard with HeyEmil, we collect:

• Your name, email address, and business name
• Billing information (processed by Stripe; we do not store full payment card numbers)
• Organizational context you provide during setup (team members, business priorities, preferences)

1.2 Data Accessed Through Connected Services

With your explicit authorization via OAuth, HeyEmil may access the following Google Workspace data:

• Gmail: Read and send email on your behalf to provide executive assistance
• Google Calendar: Read and write calendar events to manage your schedule
• Google Drive: Read-only access to documents you reference or request summaries of

If you connect additional services (e.g., QuickBooks), we access only the data scopes you authorize during the connection process.

1.3 Email Content and Interactions

When you email emil@heyemil.com or when HeyEmil processes emails on your behalf, we collect:

• The content of those emails (including attachments)
• Metadata such as sender, recipient, subject, and timestamps
• Your instructions and preferences expressed in those emails

1.4 Derived Knowledge

From the data above, HeyEmil generates:

• Summaries, briefs, and extracted action items
• Contextual memory about your business, priorities, and preferences
• Calendar analyses and scheduling recommendations

2. How We Use Your Information

We use your data exclusively to provide and improve the HeyEmil service. Specifically:

• Deliver the service: Process your emails, manage your calendar, generate briefings, draft communications, and execute tasks you delegate to Emil
• Maintain context: Build and update a knowledge base about your business so Emil can provide informed, personalized assistance over time
• Improve service quality: Analyze aggregate usage patterns to improve our AI systems (never using identifiable client data for model training without explicit consent)
• Billing and account management: Process payments and communicate about your account
• Security and compliance: Detect and prevent unauthorized access or abuse

We do not sell, rent, or trade your personal data or business information to third parties. Ever.

3. Google API Services User Data Policy

HeyEmil's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use Google user data to provide and improve the HeyEmil service as described in this policy
• We do not transfer Google user data to third parties except as necessary to provide the service (see Section 4), with your consent, or as required by law
• We do not use Google user data for advertising or to serve ads
• We do not allow humans to read your Google user data unless: (a) we have your explicit consent, (b) it is necessary for security purposes or to comply with applicable law, or (c) the data is aggregated and anonymized for internal operations
• Our use of Google user data is limited to the practices disclosed in this Privacy Policy

4. Third-Party Services

HeyEmil relies on the following third-party services to operate. Each processes only the minimum data necessary for its function:

We require all sub-processors to maintain appropriate security controls. AI model providers accessed through OpenRouter process data in transit but do not retain your data for training purposes under our commercial agreements.

5. Data Storage and Security

5.1 Where Your Data Is Stored

Your data is stored in PostgreSQL databases hosted on Hetzner VPS infrastructure. Depending on your preference, this may be located in Germany (EU) or the United States.

5.2 Security Measures

We implement the following security controls:

• Encryption at rest: All stored data is encrypted using AES-256-GCM
• Encryption in transit: All data transmitted between systems uses TLS 1.2+
• Per-client data isolation: Your data is logically separated from other clients using row-level security and per-tenant encryption keys
• Access controls: Strict role-based access; only authorized personnel can access client data, and only when necessary for service delivery or support
• Regular security reviews: We conduct ongoing security assessments of our infrastructure and processes

We are actively working toward SOC 2 Type II certification. We are happy to share our current security posture in detail under NDA upon request.

5.3 Incident Response

In the event of a data breach that affects your information, we will notify you within 72 hours of becoming aware of the incident, including details of what occurred and what steps we are taking.

6. Data Retention and Deletion

• Email content: Raw email content is retained for a maximum of 30 days, after which it is permanently purged from our systems
• Extracted knowledge: Summaries, action items, and contextual knowledge derived from your emails are retained for the duration of your service engagement
• Account information: Retained for the duration of your engagement plus 12 months for accounting and legal compliance purposes
• Billing records: Retained as required by applicable tax and financial regulations

Upon termination of service, we will:

1. Export your data to you in a standard format upon request (see Section 7)
2. Delete all your data within 30 days of termination, except where retention is required by law
3. Provide written confirmation of deletion upon request

7. Your Rights

7.1 Access and Export

You may request at any time:

• A copy of all data we hold about you and your business
• An export of your extracted knowledge base in a machine-readable format
• Details of which third-party services have processed your data

7.2 Correction

You may request correction of any inaccurate information in your account or knowledge base.

7.3 Deletion

You may request deletion of your data at any time. We will comply within 30 days, except where retention is legally required. Deletion of your data will necessarily end your service engagement.

7.4 Revocation of Access

You may revoke HeyEmil's access to your Google Workspace or other connected services at any time through those services' settings. This will limit or end our ability to provide the service.

7.5 Objection to Processing

You may object to specific processing activities. We will accommodate reasonable objections, though some may affect our ability to deliver the service.

To exercise any of these rights, email us at zackfairsldrfrst@gmail.com.

8. California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out of Sale: We do not sell personal information. There is nothing to opt out of
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To submit a CCPA request, contact us at zackfairsldrfrst@gmail.com. We will verify your identity before processing the request.

9. Children's Privacy

HeyEmil is a B2B service designed for business professionals. We do not knowingly collect information from anyone under 18 years of age.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 30 days before they take effect. Continued use of the service after the effective date constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

HeyEmil, Inc.
Email: zackfairsldrfrst@gmail.com
Website: https://heyemil.com