Your work stays yours. Your data gets boundaries.

1. Data we collect

We collect account and contact data such as name, email address, optional phone number, creator type, verification status, and acceptance records. We collect service data such as prompts, uploaded images, generated output, selected settings, jobs, likes, shared posts, credit balance, ledger entries, and support messages. We also receive technical and security data such as IP address, browser and device information, timestamps, request identifiers, error logs, and session information.

Razorpay processes payment credentials. We receive payment and order identifiers, amount, currency, status, and limited billing details needed to verify and support the purchase; we do not store full card, bank, or UPI credentials.

2. Why we use data

We use data to create and secure accounts; verify email; recover passwords; generate, store, and deliver media; operate Explore and likes; calculate and restore credits; process and reconcile payments; prevent abuse and fraud; troubleshoot reliability; provide support; comply with law; and improve the product. We may send essential transactional messages. We will send promotional email only where permitted, and each marketing message will provide an unsubscribe mechanism.

3. Legal grounds and consent

Depending on where you live, we process data to perform our contract with you, comply with legal obligations, pursue legitimate interests such as security and product reliability, and act on consent where required. You may withdraw consent for optional processing, but this does not affect processing already completed or data needed to provide the service.

4. Service providers and disclosures

We disclose the minimum data needed to providers that help us run HeyyLabs, including Railway for hosting and infrastructure, Resend for transactional email, Razorpay for payment processing, object-storage and model-compute providers for media generation and delivery, and safety or language-model providers for moderation, prompt refinement, and title generation. We may also disclose data when required by law, to protect users or the service, with your direction, or as part of a merger, financing, acquisition, or sale subject to appropriate safeguards.

We do not sell personal data or full payment credentials. Content deliberately shared to Explore is visible to other signed-in users as described at the time of sharing.

5. International processing

Our providers may process data in India, the United States, and other countries where they operate. Those countries may have different data-protection rules. Where required, we use contractual and organisational safeguards for international transfers.

6. Retention

We retain account and profile data while your account is active; generated media and job records while needed to provide the service and your history; payment and credit-ledger records as required for reconciliation, tax, fraud prevention, and legal obligations; and security logs for a limited period appropriate to the risk. Deleting an account does not require us to delete records we must retain by law, to resolve disputes, prevent fraud, or establish legal claims. Backups may take additional time to cycle out.

7. Security

We use access controls, encrypted transport, hashed passwords, email verification, server-side payment signature checks, secret separation, rate limits, and restricted service credentials. No internet service is perfectly secure. Use a unique password and contact us promptly if you believe your account is compromised.

8. Your choices and rights

Subject to applicable law, you may request access, correction, deletion, restriction, a copy of your data, or withdrawal of consent, and may nominate another person or complain to the relevant authority. You may opt out of marketing without affecting transactional email. Send requests from your account email to privacy@heyylabs.com; we may verify your identity before acting.

9. Children

HeyyLabs is not intended for anyone under 18, and we do not knowingly collect personal data from children. Contact us if you believe a child has provided data so we can investigate and remove it where appropriate.

10. Changes and contact

We may update this Policy as our services or legal obligations change. We will post the new effective date and provide additional notice for material changes where appropriate. Privacy questions and grievances can be sent to privacy@heyylabs.com or support@heyylabs.com.