Legal notice: The German version of this Privacy Policy is the legally binding document. Any English or French versions are provided for information only.
Privacy Policy
Last Updated: October 2026 · Version 2.2
1. Introduction and Scope
HeyEla AI AG ("HeyEla", "we", "us") is committed to protecting your personal data. This Privacy Policy explains how HeyEla processes personal data collected in connection with the use of the website www.heyela.ai.
This Policy applies to the website only.
For the processing of personal data within the HeyEla platform by contracted customers, the data protection provisions of the Service Agreement (SA) and its annexes apply additionally and prevailingly - in particular the Data Protection Appendix / Data Processing Agreement (Annex 2). Current versions of all relevant documents are available in the HeyEla Trust Center.
We process personal data in accordance with the revised Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
2. Data Controller
HeyEla AI AG
Limmatquai 122
8001 Zürich
Switzerland
Data protection email: trust@heyela.ai
General contact: hello@heyela.ai
3. Personal Data We Process
When you visit the website, we process the following categories of personal data:
Automatically collected data: When the website is accessed, technically necessary data is processed - in particular IP address, date and time of access, browser type, operating system, referrer URL, pages visited, and duration of visit. This data is necessary for the provision and security of the website.
Actively submitted data: When you fill out a contact form, book a demo, contact us by email, or submit any other inquiry, we process the information you provide - typically name, email, role, organization, request, and other voluntarily provided information.
Cookies: We use only strictly necessary cookies for the operation and security of the website (e.g. session management). We do not use marketing or tracking cookies.
4. Website Analytics
To measure website reach, we use Umami, self-hosted on our infrastructure at Nine Internet Solutions AG in Switzerland. Umami does not use cookies and does not store IP addresses; analysis is performed on an aggregated basis.
5. Purposes and Legal Bases of Data Processing
| Processing purpose | Legal basis |
|---|---|
| Provision, operation, and security of the website | Legitimate interest (Art. 31 para. 1 revFADP; Art. 6(1)(f) GDPR) |
| Handling of contact inquiries and demo bookings | Pre-contractual measure or contract performance (Art. 31 para. 2 lit. a revFADP; Art. 6(1)(b) GDPR) |
| Sending transactional confirmation emails | Legitimate interest / contract performance |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c) GDPR) |
6. Recipients and External Service Providers
We use the following external service providers in connection with the operation of the website. They are contractually obliged to confidentiality, purpose limitation, and compliance with applicable data protection regulations.
| Service provider | Legal entity and registered office | Data processing | Purpose |
|---|---|---|---|
| Nine Internet Solutions AG | Nine Internet Solutions AG, 8047 Zürich, Switzerland | Switzerland | Hosting of the website infrastructure |
| Cal.com (cal.eu) | Cal.com, Inc., Delaware, USA | European Union (Frankfurt) | Booking of demo and sales meetings |
| Mailomat | mailXpert GmbH, Zürich, Switzerland | Switzerland / EEA | Sending transactional emails |
| Google Workspace | Google Ireland Limited, Dublin, Ireland | Primarily European Union; partial USA for telemetry, security, and operational data | Handling of contact inquiries, internal business communication (no processing of platform content data) |
The complete and current list of all subprocessors - including those operating exclusively in the context of the HeyEla platform (platform data hosting, AI providers, identity providers) - is available in the HeyEla Trust Center or in Annex 4 to the SA.
7. Data Transfers to Third Countries
We prefer service providers based and processing data in Switzerland or the European Union. To the extent processing takes place in third countries (in particular the USA) - notably for individual services from Google Workspace and Cal.com as listed in section 6 - it is safeguarded by appropriate measures:
- Standard Contractual Clauses (SCCs) of the EU Commission pursuant to Art. 46(2)(c) GDPR
- EU-US and Swiss-US Data Privacy Framework, where the recipient is certified
- Supplementary technical and organizational measures (encryption, access controls)
8. Retention Period
We retain personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations:
- Server logs and technical data: up to 90 days
- Contact and demo inquiries: up to 24 months after last contact
- Accounting and invoicing data: 10 years in accordance with the Swiss Code of Obligations
9. Data Security
HeyEla takes appropriate technical and organizational measures to protect your personal data, in particular encryption of data transmission (TLS) and access controls following the need-to-know principle. The website is operated by the ISO 27001-certified Swiss hosting provider Nine Internet Solutions AG.
Additional in-depth measures pursuant to Annex 3 (Security and Backup Appendix) to the SA apply to data processed within the HeyEla platform.
10. Your Rights
You have the following data protection rights vis-à-vis HeyEla:
- Right of access (Art. 25 revFADP, Art. 15 GDPR)
- Right to rectification (Art. 32 revFADP, Art. 16 GDPR)
- Right to erasure (Art. 32 revFADP, Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 28 revFADP, Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Withdrawal of granted consent with effect for the future
- Right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or the competent EU supervisory authority
To exercise your rights, please contact trust@heyela.ai.
11. Data Processing within the HeyEla Platform
If you sign in to and use the HeyEla platform as a contracted customer, the provisions of the Service Agreement (SA) signed between your organization and HeyEla apply additionally and prevailingly to the data processed in the platform (in particular audio recordings, transcripts, protocols, decisions, tasks, uploaded documents, and user interactions).
In the platform context, HeyEla acts as a processor within the meaning of Art. 9 revFADP and Art. 28 GDPR. The operational data processing is governed in detail by the Data Protection Appendix / Data Processing Agreement (Annex 2 to the SA).
Current versions of all relevant documents are available in the HeyEla Trust Center.
12. Changes to This Privacy Policy
We may amend this Privacy Policy from time to time to reflect changes in legal requirements or in our services. The current version is published on this page with the date of the last update.
13. Contact
For questions about this Privacy Policy or the processing of your personal data, please reach us at: