Privacy policy

1. Our two roles

Controller. We decide how to use the data of people who create a Hyvox account and of visitors to our website. Sections 2 and 6–11 describe this.

Processor. Our customers are businesses that use Hyvox to call people who filled in their lead forms ("leads"). For lead data the customer is the controller and we process it only on their behalf and instructions, under a data processing agreement. Sections 3–5 describe this. If you are a lead and want to exercise your rights, contact the business whose form you filled in — we help them respond. You can also write to us and we will pass your request on.

2. Data about our users and visitors

• Account data: name, work email, company name, password (stored only as a secure hash by our authentication provider) and settings.
• Technical data: IP address, browser and device information, and logs of requests and errors, needed to run and secure the service.
• Communication: messages you send us and our replies.

We use this data to:

• provide the service you signed up for (GDPR art. 6(1)(b));
• keep the service secure, prevent abuse and fix problems (art. 6(1)(f), our legitimate interest);
• answer your messages and send service notices (art. 6(1)(b) and (f));
• meet legal obligations, for example accounting and tax rules (art. 6(1)(c)).

Providing account data is necessary to use Hyvox. We do not use it for advertising.

3. Lead data we process for our customers

When a customer connects a lead source and turns on a flow, we process:

• Form data: name, phone number, email, answers to form questions, consent checkboxes, submission time, and identifiers of the form, ad and campaign.
• Call data: the call itself, its transcript and summary, the qualification result, information the lead gave on the call and, if the customer enables it, the recording.
• Follow-up data: meetings booked on the call, text messages sent, and results passed to the customer's tools (for example Slack, a CRM or an email list).

Calls are made by an AI voice agent, which says at the start of the call that it is an AI assistant. The qualification result is information for the customer's sales team; it does not by itself produce legal effects for the lead. We use lead data only to provide the service to that customer — never for our own marketing, never sold, and never combined across customers.

4. Data from Meta (Facebook and Instagram lead ads)

If a customer connects their Meta account, they authorise Hyvox to access:

• the list of Facebook Pages they manage (name, ID and picture), so they can choose a Page in a flow;
• the lead forms of those Pages (names and questions), so they can choose which forms to connect;
• leads submitted to the forms they selected in an active flow, so Hyvox can call those leads.

We do not read leads from forms the customer did not select, and we do not access posts, messages, ad spend or other Page data. Access tokens are stored encrypted and used only by our servers. We use data received from Meta only to provide Hyvox to that customer, in line with Meta's Platform Terms, and we do not sell it or use it for advertising.

A customer can disconnect Meta at any time in Hyvox or by removing the Hyvox app in their Facebook settings (Settings & privacy → Settings → Business integrations). How to delete data received through Meta is explained on the data deletion page.

5. Service providers

We use trusted providers to run Hyvox. They process personal data only on our instructions and under data processing agreements:

• Supabase — database, authentication and file storage (servers in Ireland, EU).
• Vercel — application hosting (servers in Ireland, EU, with a global content delivery network).
• ElevenLabs — AI voice agents: speech recognition, voice and conversation.
• Twilio — phone calls and text messages.
• Meta Platforms — the source of lead ads leads, when a customer connects it.
• Tools the customer connects (for example Slack, a CRM, Calendly or Mailchimp) — they receive lead results only because the customer chose to send them there.

6. Transfers outside the EU

Some providers are based in, or have staff in, the United States or other countries outside the European Economic Area. In those cases transfers are protected by the European Commission's standard contractual clauses or the EU–US Data Privacy Framework, together with additional safeguards where needed.

7. How long we keep data

• Account data: while your account is active, then deleted within 30 days of closing it.
• Lead and call data: for as long as the customer keeps it in Hyvox; deleted within 30 days after the customer deletes it or closes their workspace, unless the customer asks us to return it first.
• Technical logs: for a limited time, usually no longer than 90 days.
• Accounting records: as long as tax law requires.

8. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Write to hello@hyvox.ai. You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland) or the authority in your country.

9. Cookies

We use only cookies that are strictly necessary: they keep you signed in and protect your session. Your theme choice (light or dark) is saved in your browser's local storage. We do not use advertising or tracking cookies.

10. Security

Data is encrypted in transit (HTTPS) and at rest. Each customer's data is isolated, access is limited to people who need it, and third-party access tokens are encrypted. If a personal data breach affects you or our customers, we will inform them without undue delay.

11. Children

Hyvox is a business service and is not meant for children under 16.

12. Changes to this policy

We will publish any changes on this page and update the date at the top. If a change is significant, we will also notify account holders by email.

13. Contact

Piotr Prekurat Prek Developments, ul. Czerniakowska 34/90, 00-714 Warszawa, Poland, NIP 5214036601 · hello@hyvox.ai