Privacy Policy

Version 2026-08-13. Effective 2026-08-13.

This Privacy Policy explains how HeyClients LLC, Grayling, Michigan, USA, processes personal data through Heyla, including data received through connected Instagram, email, CRM, payment, and other authorised services. Last updated 13 August 2026.

Data we process

Heyla may process:

Through the official Instagram Platform API, Heyla may process direct messages and comments sent to a connected account, Instagram-scoped user identifiers and usernames, engagement events the API provides, and attachments included in messages.

Heyla does not track or collect profile visits, post or story views, saves, dwell time, or similar signals that the Instagram API does not provide.

Why and how we use data

Heyla uses personal data to provide and administer accounts; connect authorised services; show and organise conversations; identify and explain sales opportunities; match contacts to offers; prepare suggested messages; support follow-ups and appointments; provide notifications and analytics; process billing; respond to support; prevent fraud and misuse; secure the service; comply with law; and improve Heyla and its models.

During the human-approval version of Heyla, a coach reviews and approves customer-facing messages before they are sent. Heyla does not send cold Instagram direct messages.

Instagram limits when a business may reply through the API. A direct message or supported public comment may open Meta's applicable 24-hour window for responses. Heyla does not treat unrelated email permission as permission to send an Instagram message.

Our roles and lawful bases

When Heyla processes a coach's lead, contact, or conversation data on the coach's behalf, the coach determines the applicable legal basis and HeyClients LLC acts as processor. That processing is also governed by the Data Processing Agreement.

For processing HeyClients LLC undertakes for its own purposes, HeyClients LLC relies on contractual necessity to provide and administer Heyla; legitimate interests to secure, support, improve, and prevent misuse of the service; consent where required for optional tracking or marketing; and legal obligation where processing is required by law.

AI and service improvement

HeyClients LLC may use customer and contact data, prompts, feedback, and outputs to operate and improve Heyla and its models, subject to applicable law, contractual obligations, and the rights described in this policy.

HeyClients LLC may create aggregated or deidentified learning information where it cannot reasonably identify a customer or individual and will maintain that information in deidentified form.

Sharing and connected services

Heyla shares data with service providers that help host, secure, operate, support, analyse, and deliver the service. The dated Sub-processor Register identifies providers engaged to process personal data on Heyla's behalf.

Data may also be disclosed to connected services selected by the customer; legal authorities where required by law; professional advisers under confidentiality; or a buyer or successor in connection with a merger, financing, reorganisation, or sale of the business, subject to appropriate safeguards.

International transfers

Personal data may be stored or processed in the United States and other countries where HeyClients LLC or its providers operate. Where applicable law requires a safeguard for an international transfer, HeyClients LLC will use an appropriate lawful transfer mechanism.

Retention

Heyla retains personal data only for as long as reasonably necessary to provide and secure the service, maintain conversation continuity and reporting, meet legal obligations, resolve disputes, prevent fraud or repeated unwanted contact, and enforce agreements. Retention depends on the type of data, how it is used, customer instructions, connected-provider behaviour, and applicable legal requirements.

Cancellation, export, deletion, default retention, backup expiration, and limited records retained for billing, legal, security, suppression, fraud-prevention, dispute-resolution, or compliance reasons are separate matters. Genuinely deidentified aggregate information may be retained for service improvement.

Access, export, deletion, and other rights

Depending on applicable law, individuals may have rights to access, correct, delete, restrict, object to, or export their personal data. Where processing relies on consent, consent may be withdrawn. These rights are not always absolute and may depend on the applicable lawful basis.

Requests can be sent to contact@heyclients.io. Heyla may need to verify the requester's identity. Instagram users may also follow the data deletion instructions. Individuals may complain to the data-protection authority that applies to them.

Children

Heyla is intended for business users aged 18 or older. Customers must not intentionally use Heyla to collect or process children's data unless HeyClients LLC has expressly agreed in writing and required safeguards are in place.

Security

HeyClients LLC uses administrative, technical, and organisational safeguards designed to protect personal data, including authenticated access, tenant-scoped controls, encryption in transit, restricted production access, monitoring, and incident-response procedures. No system can guarantee absolute security.

Changes to this policy

HeyClients LLC may update this policy as Heyla, applicable law, or data practices change. The published version and effective date identify the policy that applies. Material changes will be communicated through the service or account contact information where appropriate.

See the Terms of Service, Data Processing Agreement, Sub-processor Register, and data deletion instructions. Questions and requests may be sent to contact@heyclients.io.