Who we are

Heybound is operated by Elemental Tecnologia LTDA., CNPJ 56.124.079/0001-17, based in Uberlândia (MG), Brazil, postal code 38411-096 (“Heybound” or “we”).

We are the controller of your account data: name, email, phone, password, linked sign-in accounts, personal profile, contacts, blocks, sessions and devices, and of the reports made on Heybound.

When you take part in an organization on Heybound — as a member of a team, or when a company invites you — the organization is the controller of what it records about you: the name it registered, the invitations it sent, and the organization’s conversations and their history. Heybound processes that data on the organization’s behalf. Requests about it should go to the organization; if they reach us, we forward them.

Data we collect

We collect what the app needs to work and to keep your account secure:

  • Account: name, email, username and password, and phone, if you provide one. The password is stored only as a hash; we have no access to it. We also keep your linked sign-in accounts (such as Google or Apple), if you use them.
  • Profile: photo and description, if you add them, and your profiles in the organizations you belong to.
  • Messages and files: the text of your messages and the files you send — photos, videos, audio and documents — and anything else you create in the app, such as conversations and cases.
  • Contacts: the contacts you add in the app (name, email, phone and notes). The app does not read your device’s address book.
  • Reports: when you report a message, a conversation or a profile, we keep the reason, the comment, if any, internal identifiers of the reporter and of the person reported, without names, and a copy taken when the report arrives: the reported messages with up to 5 messages before and after each one, the last 10 messages of the conversation, or the profile’s name, @handle, photo, description and organization. Files are included only as references. If a message was already deleted, the copy keeps what is left of it and, if the organization keeps an audit, the audited version. Only the Heybound team reads reports; there is no access through the app or by organizations. A report made offline stays on your device until it is sent, and we count each profile’s and account’s reports for up to 24 hours to limit abuse.
  • Blocks: when you block a profile, we keep which of your profiles blocked which profile, and when the block started and ended. The list is also kept on your device. What the blocked profile tries to send in the direct conversation during the block is refused and not stored.
  • Searches: what you search for is used only to return results and is not stored on our servers. Recent searches stay on your device only.
  • App activity: actions such as signing in and out, and sending, reading, editing and deleting messages, used for the app to work and to keep your account secure.
  • Device and sessions: device model, operating system, app version, a session identifier and the device’s notification token.
  • Access logs: date, time, IP address and port of each sign-in, sign-out and account deletion, and of each time a session reconnects from a new IP address.
  • Diagnostics: technical records of errors and performance, without the content of messages, emails, phone numbers or searches.

We do not collect your location or advertising identifiers. We do not sell personal data or use it for advertising.

Device permissions

The app asks for a permission only when you use the feature that needs it. You can deny or revoke it in your device settings, and the rest of the app keeps working.

  • Camera and photos: to take or pick the photos and videos you send or use on your profile.
  • Microphone: to record audio, when you use that feature.
  • Notifications: to let you know about new messages. Notifications do not carry message content.

How we use data

We use your data for these purposes, each with its legal basis under Brazil’s LGPD:

  • Providing the service (performance of a contract): creating and maintaining your account, delivering messages and files, syncing your devices, sending notifications and enforcing the blocks you make.
  • Security and fraud prevention (legitimate interest): protecting accounts, receiving and reviewing reports, investigating abuse and keeping the service stable.
  • Keeping conversation history (legitimate interest): the messages you sent stay with the other people in the conversation, who rely on that history too.
  • Legal obligations: keeping access logs, as Brazil’s Marco Civil da Internet requires, complying with court orders and preservation requests from authorities, and preserving what a report records where the law requires it.
  • Consent: device permissions and the site’s analytics cookies.

Who we share data with

We do not sell or rent personal data. It is shared only:

  • With the people you talk to: the people and organizations in your conversations see your messages, your files and your profile.
  • With the organizations you belong to: they hold what happens in their conversations. If an organization turns on auditing, it also keeps earlier versions of edited or deleted messages, for the period it sets. When you leave the organization or delete your account, its owners are notified in the app.
  • With an organization’s agents: if an organization connects an agent (an automation) to its conversations, the messages in those conversations reach the service the organization set up, under its responsibility.
  • With the providers that run our infrastructure, under contract and only for that purpose: Vultr (servers and storage), Cloudflare (network, protection and secure connections), Google Firebase Cloud Messaging (notification delivery, without message content) and Grafana Labs (technical monitoring).
  • With authorities: only under a court order, as Brazil’s Marco Civil da Internet provides (Law 12.965/2014, art. 10), or where the law requires it.

International transfers

Some of our providers are located or process data outside Brazil; today, our servers are in the United States. These transfers are necessary to provide the service you use (LGPD, art. 33, IX) and are made only to the providers listed above.

How long we keep data

  • Account and profile: for as long as the account exists.
  • Messages and files: for as long as the conversation exists. In a direct conversation with someone who deleted their account, you can delete the whole conversation.
  • Deleted contacts: permanently erased within 30 days.
  • Organization audit and settings history: the audit, for the period the organization chooses for all its conversations or for each one (30 days unless it changes it); the settings history, for as long as the organization exists. Both are erased 90 days after the organization is deleted. Personal conversations are not audited.
  • Records of agent actions: 5 years.
  • Access logs: 6 months, as Brazil’s Marco Civil da Internet requires (art. 15), even if the account is deleted. For the same period we keep the @handle a deleted profile used, so that a court order citing it can still find those records.
  • Account deletion record: 3 years, without your name, email or phone.
  • Technical diagnostic records: up to 14 days.
  • Data under a court order or an authority’s preservation request: for as long as the request lasts.
  • Reports: a report keeps the reported conversation and the reported person’s account for up to 5 years from the report, or less if the case is closed sooner, even if that person deletes their account. The reporter’s account is never held. The report and the copy it records are kept while they are needed and the law allows, for at most 5 years from the report.
  • Blocks: for as long as the block lasts; after unblocking, erased within 30 days. On the device, unblocking erases the record right away.

Deleting your account or your data

You can delete your account at any time in the app — under Settings (tap your photo and name at the top of the home screen) → Account → Account → Delete account, typing your username to confirm — or request deletion by email at hey@heybound.com. Deletion takes effect right away: your email, phone, password, linked sign-in accounts, sessions and devices are erased, your profiles are deactivated, your @handle is freed, and the account remains only as a pseudonymised internal identifier.

The messages you sent stay in the conversations with other people, and so does what organizations recorded about you. The blocks you made are erased with the account. If you were reported, the rest of the account’s data is erased only when the report’s retention ends.

Without deleting the account, you can use the app to delete messages you sent within the allowed time, contacts, sessions and devices, and the photo and description of your profiles, change your email and password, and leave an organization; anything else, by email. Archiving, leaving a conversation and deleting for me only remove the conversation or the message from your list or your devices and erase nothing on the server. The step-by-step guide, what is deleted and what is kept are in Delete your account.

Your rights

Under the LGPD (art. 18), you can:

  • confirm whether we process your data and access it;
  • correct incomplete, inaccurate or outdated data;
  • request the anonymisation, blocking or erasure of data that is unnecessary, excessive or processed unlawfully;
  • request the portability of your data;
  • withdraw consent and request erasure of the data processed under it;
  • know who we share your data with;
  • object to processing carried out unlawfully.

To exercise these rights, write to hey@heybound.com from the address registered on your account. We respond within the legal deadlines. Requests about the data an organization holds about you are forwarded to that organization.

You can also file a complaint with Brazil’s data protection authority (ANPD). If you are in the European Union, you have the equivalent rights under the GDPR and can complain to your country’s data protection authority.

Security

All communication between the app and our servers is encrypted (HTTPS/TLS). Passwords are stored as Argon2 hashes, and sign-in credentials are kept in your device’s secure storage.

Messages are not end-to-end encrypted: they are stored on our servers so the history is available on all your devices and to the organizations in the conversations.

No system is completely secure. If an incident could bring you significant risk or harm, we notify you and the ANPD, as the law requires. We record every security incident and keep that record for at least 5 years.

Children

Heybound is not intended for children under 13 and does not knowingly collect their data. If we learn that an account belongs to a child, it will be deleted.

This site

On heybound.com, we store only your theme preference and your cookie choice in your browser. Analytics cookies (Google Analytics) are used only if you accept them in the cookie notice, and you can change that choice at any time with the button in the corner of the page. If you write to us by email or WhatsApp, we use your data only to reply.

Changes to this policy

We may update this policy. The date at the top shows the last update. If a change significantly affects how your data is used, we let you know in the app before it takes effect.

Contact

Questions or requests about privacy, including contacting our data protection officer: hey@heybound.com.