Privacy Policy

The controller for your personal data is Brand Boosting Media SRL, CUI 24548001, registered with the Bucharest Trade Registry under J40/16828/2008, Str. Râul Doamnei Nr. 1, Bl. M1, Sc. A, Et. 1, Ap. 7, Sector 6, Bucharest, Romania ("we", "us").

For anything in this policy — questions, requests, complaints — write to [email protected]. We do not have a separate data-protection officer: privacy requests go to that same address and are answered by our team.

This policy covers heyoli.io and the Heyoli Service. It does not cover websites linked from ours or services you connect through integrations; their privacy terms apply instead.

We update this policy as the product changes. The version here always applies, dated below; material changes are announced in the product before they take effect.

Contact and account data: your name or handle, email address, subscription status, and — where you use magic-link sign-in — the verification codes and session tokens that authenticate you.

Content and usage data: your prompts, designs, uploads, schedules, and integration configurations, plus how you use the product (pages, features, events you trigger). Content you explicitly publish is shown where you publish it — social platforms, scheduled jobs.

Communication data: emails and messages you send our support, including attachments.

Traffic and device data: IP address, browser and operating-system details, timestamps, and security logs from our servers.

Billing data: subscription and invoice records. Your card details go to our payment processor Paddle (Section 5), never to us.

Heyoli is not aimed at children and we do not knowingly collect data from anyone under 16. Accounts found to be held by children are closed and their data deleted.

Performance of our contract (GDPR Art. 6(1)(b)): running your account, generating your AI results, storing and scheduling your content, billing you, and providing support about your account. Providing account and billing data is necessary to enter into this contract: without an email address and a paid subscription we cannot create or run your account.

Legitimate interests (Art. 6(1)(f)): keeping the Service secure and abuse-free, fixing bugs, measuring and improving product quality, and defending against claims. We weigh these against your rights in every case before relying on them.

Your consent (Art. 6(1)(a)): product emails you opt into and any optional feature that asks for extra data; you can withdraw consent at any time, without affecting what was already processed lawfully.

Legal obligations (Art. 6(1)(c)): accounting and tax records, and responding to lawful requests from authorities.

We use your data only for the purpose it was collected or a compatible one — never sold, never rented, never shared for someone else's marketing.

Billing runs through Paddle.com, our merchant of record. Paddle processes your name, email, location, and payment details to charge your subscription, calculate tax, issue invoices, and meet its own legal duties — under its own privacy policy, as an independent controller.

What we get from Paddle are operational events about your subscription (active, paid, cancelled, refunded) tied to your Paddle customer ID, which we store to keep your plan and entitlements correct.

Your prompts and the files you attach go to our AI model providers to generate results at your direction, and the results come back to your account. Providers process this data solely to deliver the feature — under contract, not to train their models on it, and we do not use Your Content or outputs to train machine-learning models either.

If you connect your own AI provider keys, that provider's terms and data handling apply to what you send through them.

We share data only with the processors that run the Service — hosting and infrastructure in the EU, connectivity and security services, email delivery, billing, and AI model providers — each under a data-processing agreement and instructed to process only for us. We disclose data to authorities only where the law requires it, and to a successor only in a merger or acquisition, on notice.

Some processors are in the United States or process data there. For transfers outside the EEA we rely on the safeguards the GDPR requires: adequacy decisions where available, the EU Standard Contractual Clauses, and — where a processor is certified — the EU–US Data Privacy Framework. You can ask [email protected] for a copy of the relevant safeguards.

We use strictly necessary cookies only: the session cookie that keeps you signed in and your theme preference. No analytics, no advertising, no cross-site trackers — so there is no consent banner, because there is nothing to consent to. Blocking cookies in your browser may sign you out or reset your theme.

We do not make automated decisions or profile you in a way that produces legal or similarly significant effects (GDPR Art. 22). AI features assist your work at your direction — they do not decide anything about you.

Account and content data are kept for the life of your account and deleted within 30 days after you delete it; backups containing them age out on their normal rotation.

Operational and security logs are kept for up to 90 days. Support correspondence is kept for 2 years after the case closes. Invoices and accounting records are kept for 10 years, as Romanian accounting law requires.

You have the GDPR rights: to access your data (Art. 15), correct it (Art. 16), erase it (Art. 17), restrict it (Art. 18), take it with you (Art. 20), object to processing on legitimate interests (Art. 21), and withdraw consent (Art. 7) — plus the right to complain to the Romanian supervisory authority ANSPDCP (anspdcp.ro) and to an effective judicial remedy (Art. 77–82).

Send requests to [email protected] from your account email; we answer within one month, extendable by two more months for complex cases. We may ask you to verify your identity first — we would rather be slow than hand your data to the wrong person.

We protect your data with encryption in transit (TLS), encrypted secrets and backups, least-privilege access for the few people who operate the Service, and review of processor security practices. If a breach risks your rights, we notify the supervisory authority and — where the law requires it — you, without undue delay.

This policy is effective October 9, 2026. When we change it materially, we announce the change in the product before it takes effect; continued use after that is acceptance.