Privacy Policy

1. Introduction

Welcome to HeyCue.ai ("HeyCue," "we," "us," or "our"). HeyCue is an AI-powered personal assistant platform operated by RippleCue LLC. We are committed to protecting your privacy and ensuring you understand how we collect, use, and safeguard your personal information.

This Privacy Policy explains our practices regarding data collection, use, and disclosure when you use our AI services, mobile applications, web applications, and related services (collectively, the "Services").

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Name, email address, phone number, and password when you create an account
• Profile Information: Profile picture, preferences, and settings you configure
• Communications: Messages, queries, and content you submit through our AI chat interface
• Payment Information: Billing address, payment method details (processed securely through third-party payment processors)
• Support Requests: Information you provide when contacting our customer support

2.2 Information from Connected Services

When you authorize HeyCue to connect with third-party services, we may collect:

• Email Services (Gmail, Outlook): Email metadata, subject lines, sender/recipient information, and email content to enable search and AI assistance
• Calendar Services (Google Calendar, Outlook Calendar): Event titles, dates, times, locations, attendees, and descriptions
• Cloud Storage (Google Drive, OneDrive, Dropbox): File names, metadata, and content for files you explicitly grant access to
• Financial Services (via Plaid): Account balances, transaction history, merchant names, and categories
• Communication Platforms (Slack, WhatsApp Business): Messages and metadata necessary to provide AI assistance. For WhatsApp Business, see Section 13 for details on the data we receive from Meta and how we use it.

2.2.1 Google User Data — Limited Use Disclosure

HeyCue's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, for data obtained through Google APIs (Gmail, Google Calendar, Google Drive, Google Contacts):

• We only use Google user data to provide and improve the user-facing features you see in HeyCue (searching your mail, answering questions about your calendar and files, creating events, and sending email you explicitly compose or approve). We do not use it for any other purpose.
• We do not transfer or sell Google user data to third parties, and we do not use it for advertising, market research, retargeting, or credit-worthiness assessment.
• We do not allow humans to read Google user data, except (a) with your explicit consent for a specific message or file, (b) as necessary for security purposes (such as abuse investigation), (c) to comply with applicable law, or (d) when the data is aggregated and anonymized for internal operations.
• We do not use Google user data to train, develop, or improve generalized artificial intelligence or machine-learning models. Google user data is passed to our AI subprocessors (Section 4.3) only transiently to answer your specific request and is never used for model training.
• Access is limited to the narrowest scopes needed; you can disconnect Google at any time in Settings → Connections (Section 8.4), which deletes our stored tokens.

2.3 Information Collected Automatically

• Device Information: Device type, operating system, unique device identifiers, browser type
• Usage Data: Features used, queries made, interaction patterns, timestamps
• Log Data: IP address, access times, pages viewed, app crashes, and system activity
• Location Data: General location based on IP address (we do not collect precise GPS location unless explicitly enabled)

2.4 AI-Generated Information

• Derived Insights: Patterns, summaries, and insights generated by our AI from your connected data
• Conversation History: Your interactions with our AI assistant to provide context and improve responses
• Embeddings and Vectors: Mathematical representations of your data used for semantic search and retrieval

3. How We Use Your Information

Purpose	Data Used	Legal Basis
Provide AI Assistant Services	All connected data, queries, conversation history	Contract performance
Account Management	Account information, profile data	Contract performance
Process Payments	Payment and billing information	Contract performance
Improve Our Services	Usage data, anonymized interactions	Legitimate interest
Customer Support	Account info, support communications	Contract performance
Security & Fraud Prevention	Device info, log data, usage patterns	Legitimate interest
Legal Compliance	As required by applicable law	Legal obligation

4. AI Processing and Machine Learning

4.1 How Our AI Processes Your Data

HeyCue uses artificial intelligence and machine learning to provide personalized assistance. This includes:

• Natural Language Processing: Understanding and responding to your queries in natural language
• Semantic Search: Finding relevant information across your connected services using context and meaning, not just keywords
• Pattern Recognition: Identifying trends in your financial data, scheduling patterns, and communication habits
• Personalization: Adapting responses based on your preferences and interaction history

4.2 AI Model Training

4.3 Third-Party AI Services (AI & Your Data)

HeyCue's assistant is powered by third-party AI providers (our “AI subprocessors”). To generate a response or run an AI feature, we send the content of your request to one of these providers:

AI Provider	What it does for HeyCue	Data categories sent
Anthropic (Claude API)	Understands your messages, writes the assistant's replies, and reads images/documents you share.	Chat messages; attached photos, receipts, and PDFs; the content you ask HeyCue to act on.
Google (Gemini API)	Generates some assistant responses and extracts information from photos and documents (for example, scanning a receipt).	Chat messages; attached photos, receipts, and PDFs.
Microsoft (Azure AI Document Intelligence)	Optical character recognition (OCR) for receipts and documents you upload.	Photos and PDFs of receipts and documents you choose to scan.

The specific provider used depends on the feature and our current configuration. What we send for a given request is limited to:

• The message you send to the assistant;
• Any photos, receipts, documents, or other files you attach to that request; and
• The specific content you ask HeyCue to read or act on.

When we use these services:

• Data is transmitted securely using encryption (TLS).
• Your data is not used to train these providers' AI models. We use these providers under their paid, commercial API agreements, under which inputs and outputs are not used to train or improve their models by default. (Note: this differs from the providers' free consumer apps and free API tiers.)
• Providers may retain data for a short period solely to monitor for abuse and ensure service safety — for example, up to approximately 30 days (Microsoft Azure) or up to approximately 55 days (Google) — after which it is deleted, except where a longer period is required by law or to investigate a policy violation.
• These providers are contractually prohibited from using your data for their own purposes.
• We minimize the personal data sent to only what's necessary for the request — we do not send your bank logins or payment credentials.
• We require, by contract, that each of these providers protects your data with safeguards that are the same as or equivalent to those described in this Privacy Policy.

Your permission: We ask for your explicit consent inside the app before any of your personal data is sent to these third-party AI providers. You grant this permission the first time you use HeyCue, and you can withdraw it at any time under Settings → Privacy → “AI & your data.” If you withdraw consent, HeyCue's AI features become unavailable until you grant it again. You can review this disclosure at any time on the same screen. You may also request deletion of your HeyCue data at any time as described in Section 8.

4.4 Interacting with AI and Automated Decisions

HeyCue's assistant is an artificial-intelligence system. When you chat with HeyCue, you are interacting with AI, not a human. AI-generated responses can be inaccurate or incomplete, so you should review them before relying on them.

HeyCue's AI features are assistive: they help you draft, search, organize, and act on your information with your confirmation. HeyCue does not use AI to make legally or similarly significant decisions about you on a solely automated basis (such as decisions about credit, employment, housing, insurance, or eligibility) without human involvement. Where applicable law gives you rights regarding automated decision-making (for example, the EU/UK GDPR or the California CCPA/ADMT rules), you may contact us to exercise them as described in Section 8.

5. Data Sharing and Disclosure

5.1 We Do NOT Sell Your Data

We will never sell, rent, or lease your personal information to third parties for their marketing purposes.

5.2 Service Providers

We share data with trusted service providers who assist us in operating our Services:

• Cloud Infrastructure: Microsoft Azure, Google Cloud Platform for secure data storage and processing
• Payment Processing: Stripe for secure payment handling
• Financial Data: Plaid for secure bank account connections
• Analytics: Google Analytics, to understand how our website is used and improve our services (see Section 5.5)
• Customer Support: Help desk platforms for support ticket management

5.3 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal process (subpoenas, court orders)
• Government requests that meet legal requirements
• Protect our rights, privacy, safety, or property
• Enforce our Terms of Service

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will provide notice before your data becomes subject to a different privacy policy.

5.5 Cookies and Tracking Technologies

Our website (heycue.ai) uses cookies and similar tracking technologies to operate the site and understand how it is used:

• Essential cookies: Required for the site and your signed-in session to function.
• Analytics cookies: We use Google Analytics to collect aggregated, statistical information about how visitors use our website (for example, pages visited, approximate location, device and browser type, and time spent). This helps us improve the site. Google processes this data as described in Google's Privacy Policy; you can opt out using the Google Analytics Opt-out Browser Add-on.

You can control or delete cookies through your browser settings. Note that our mobile apps do not use third-party advertising trackers. Because there is no industry-standard, our site does not currently respond to browser “Do Not Track” signals.

6. Data Security

We implement comprehensive security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Strict role-based access controls for our team members
• Authentication: OAuth 2.0 for third-party service connections; optional two-factor authentication for your account
• Infrastructure Security: Enterprise-grade cloud infrastructure with SOC 2 compliance
• Regular Audits: Periodic security assessments and penetration testing
• Monitoring: 24/7 security monitoring and incident response procedures

7. Data Retention

• Active Account Data: Retained while your account is active and as needed to provide Services
• Conversation History: Retained for 2 years or until you delete it, whichever comes first
• Connected Service Data: Synced data is refreshed regularly; cached data is retained for up to 90 days after disconnection
• Account Deletion: Upon account deletion request, we delete your data within 30 days, except where retention is required by law
• Backup Retention: Encrypted backups may be retained for up to 90 days for disaster recovery purposes

8. Your Rights and Choices

8.1 Access and Portability

You can request a copy of your personal data in a portable format at any time through your account settings or by contacting us.

8.2 Correction

You can update or correct your account information through your account settings.

8.3 Deletion

You can delete your account and associated data at any time. This action is irreversible.

8.4 Disconnect Services

You can disconnect any third-party service at any time through your account settings. We will stop accessing new data immediately and delete cached data within 90 days.

8.5 Opt-Out of Communications

You can opt out of marketing communications by clicking "unsubscribe" in any email or updating your notification preferences.

8.6 Additional Rights for EEA/UK Residents

If you are located in the European Economic Area or United Kingdom, you have additional rights under GDPR including:

• Right to restrict processing
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

8.7 California Residents (CCPA)

California residents have the right to:

• Know what personal information is collected
• Know if personal information is sold or disclosed and to whom
• Opt out of the sale of personal information (we do not sell your data)
• Access your personal information
• Request deletion of your personal information
• Non-discrimination for exercising these rights

9. Children's Privacy

HeyCue is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will delete that information promptly.

10. International Data Transfers

HeyCue is operated from the United States. If you are accessing our Services from outside the United States, please be aware that your data may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For transfers from the EEA/UK, we use Standard Contractual Clauses approved by the European Commission and implement appropriate safeguards.

11. Third-Party Links and Services

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

12. SMS Mobile Information

When you opt in to receive SMS messages from HeyCue or businesses using HeyCue ("Tenants"), the phone numbers and consent records you provide are used solely to deliver the messages you have opted into — booking confirmations, appointment reminders, two-way customer-care replies, and account/payment notifications.

We will not share, sell, or rent your mobile information (including phone numbers and consent records) to any third parties or affiliates for their marketing or promotional purposes. Mobile information may be shared only with sub-processors strictly necessary to deliver SMS (e.g. Twilio as our messaging carrier), and will never be transferred to third parties for marketing.

Message frequency varies. Standard message and data rates may apply. To stop receiving messages, reply STOP at any time. For help, reply HELP. Carriers are not liable for delayed or undelivered messages.

Consent to receive SMS messages is optional and is never a condition of booking, purchasing, completing a payment, or using the Services. You can book, pay, and use HeyCue in full without opting in to text messages.

You may opt in via:

• Tenant booking pages on publish.heycue.ai/<tenant-slug>/, where a phone-number field is paired with an unchecked consent checkbox you must tick before submitting.
• Sending an inbound text to a Tenant's HeyCue-issued number, which triggers a confirmation auto-reply.

Consent is auditable: every booking record stores phone number, opt-in timestamp, and the version of the consent text presented at the moment of opt-in.

13. WhatsApp and Meta Platform Data

HeyCue integrates with the WhatsApp Business Platform provided by Meta Platforms, Inc. ("Meta"). If you choose to connect your WhatsApp Business account, you do so through Meta's Embedded Signup, and we receive information from Meta ("Platform Data") that is necessary to provide the service you request.

What we receive from Meta. With your explicit consent during Embedded Signup, we receive: your WhatsApp Business Account (WABA) and phone number identifiers, your WhatsApp business profile details, the access token that authorizes the connection, and the customer messages and related metadata sent to or from your connected number.

How we use it. We use this Platform Data only to provide HeyCue's messaging features to you — namely, to display your WhatsApp Business connection, let you read incoming customer messages, help you draft replies, and send WhatsApp messages from your number only after you confirm each message. We do not send messages on your behalf without your action.

What we do not do. We do not sell Platform Data, and we do not use it for advertising or for any purpose other than providing the service described above. We use Platform Data in accordance with the Meta Platform Terms, the Meta Developer Policies, and the WhatsApp Business Messaging Policy.

Storage and security. Access tokens are encrypted at rest using AES-256-GCM. Platform Data is processed and stored on Microsoft Azure (United States). Access is limited to the systems and personnel necessary to provide the service.

Retention and deletion. You can disconnect your WhatsApp Business account at any time from HeyCue's Connections screen, which revokes our access and stops further processing. On disconnection or upon a deletion request to privacy@heycue.ai, we delete the associated access tokens and Platform Data we hold, except where we are required to retain limited records to comply with law.

14. Point-of-Sale (POS) Integrations

HeyCue integrates with third-party point-of-sale (POS) platforms such as Clover and Square. If you choose to connect your POS account, you do so through the provider's OAuth authorization, and we receive information from the provider that is necessary to provide the service you request.

What we receive. With your authorization, we receive: your merchant/business identifiers and basic business and tax configuration; your menu/inventory items, categories, and prices; your orders and their status; and the access and refresh tokens that authorize the connection.

How we use it. We use this data only to provide HeyCue's ordering features to you — namely, to import your menu so our AI assistant can take accurate orders, to create orders on your POS from orders placed through HeyCue, and to reflect order status back to you. HeyCue does not process payments.

What we do not do. We do not sell this data, and we do not use it for advertising or for any purpose other than providing the service described above. We use it in accordance with the applicable provider's developer and API terms.

Storage and security. Access and refresh tokens are encrypted at rest using AES-256-GCM. Data is processed and stored on Microsoft Azure (United States). Access is limited to the systems and personnel necessary to provide the service.

Retention and deletion. You can disconnect your POS account at any time from HeyCue's Connections screen, which revokes our access and stops further processing. On disconnection or upon a deletion request to privacy@heycue.ai, we delete the associated tokens and provider data we hold, except where we are required to retain limited records to comply with law.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending you an email notification for significant changes

We encourage you to review this Privacy Policy periodically.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: privacy@heycue.ai
• Mail: RippleCue LLC, Attn: Privacy Team

For data protection inquiries from EEA/UK residents, you may also contact our Data Protection Officer at dpo@heycue.ai.