Privacy policy
Who we are
Heylane is an inbox for businesses: it brings Gmail, Instagram and Facebook Messenger together, drafts replies with AI and shows the customer's data from connected services such as Shopify. It is available as a website (app.heylane.ai) and as a Chrome extension.
The controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) is:
Elie Roth (Rothwork)
Körnerstr. 15
10785 Berlin
Germany
info@heylane.ai
Your data and your customers' data
For your Heylane account (your login, settings and use of the service) we decide how data is processed and are responsible for it.
The emails and messages in your inboxes, and the data of your customers in connected services, are yours: you decide what Heylane processes, and we process it on your behalf, only to provide Heylane to you. If you wrote to a business that uses Heylane, that business is responsible for your messages. You can also contact us, see Data deletion.
What we process and why
Your login
Your email address, your sign-in sessions and the security information that comes with them (such as IP address and browser). We need them to let you sign in and to keep your account secure (Art. 6(1)(b) and (f) GDPR).
Gmail
When you connect a Gmail address, you allow Heylane, on Google's consent screen, to read, organize and send its mail. Emails load straight from Google into your browser; our servers don't store your inbox. We store the address, your Google access tokens (encrypted), a signal from Gmail that a mailbox changed (it holds no content), and for snoozed and scheduled emails the conversation's reference and the time, so we can bring it back or send it then (Art. 6(1)(b) GDPR).
AI replies
When you ask for a draft, the conversation you have open, your instructions, your style notes, your knowledge base and the customer's data from connected services are sent through our servers to Anthropic, whose AI model (Claude) writes the draft. Typo checks and knowledge base suggestions work the same way.
Draft history: we keep each draft request with its draft and, if you send the email within 10 minutes, the email you sent, so you can look back at what the AI wrote and improve it. It is encrypted with a key for your account and kept for 365 days unless you choose a shorter time or turn it off (Settings, AI replies). Typo checks and knowledge answers aren't kept.
Instagram and Facebook Messenger
When you connect a Facebook Page or an Instagram account, Meta sends us the messages people write to it and the replies sent from it. When you ask for an import, we also fetch the latest 20 messages of each conversation. We store these messages and the sender's name and username, encrypted with a key for your account, together with your Meta access tokens (encrypted). We keep them until you disconnect the account or delete your Heylane account, or until the person who wrote asks us to delete them (Art. 6(1)(b) GDPR).
Shopify and other connected services
When you connect your store, Heylane looks up the customer and orders that match the open conversation (their email address or an order number they wrote). This data is shown to you and, when needed, included in a draft request; we don't store it apart from the draft history. Your store's access credentials are stored encrypted.
Your settings
Your profiles, style notes, knowledge bases (with their earlier versions, so you can restore them), sign-off names and connected accounts.
Usage statistics
Counts per day, inbox and feature (such as drafts written, their cost and how much of a draft was kept), without any content. We use them to run the service, set fair limits and improve Heylane (Art. 6(1)(f) GDPR).
Chrome extension
The extension reads the conversation open in Gmail or Meta Business Suite in your browser and sends it to our servers only when you ask for a draft. The Google sign-in it uses to read Gmail stays in your browser.
Server logs
Our hosting providers process IP addresses and request details to deliver the service and keep it secure (Art. 6(1)(f) GDPR). The content of emails and messages is never written to our logs.
Google user data
Heylane's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide the features you use in Heylane. We don't sell it, don't use it for advertising, and don't use it to develop, improve or train AI models. Nobody reads it unless you ask us to for support, it is needed for security, or the law requires it.
Service providers
We use these providers to run Heylane. They process data only on our instructions:
- Convex (database and server functions, in the EU, Ireland)
- Vercel (website hosting)
- Clerk (sign-in)
- Anthropic (AI drafts; it doesn't use your data to train its models)
- Google (Gmail API, and Google Cloud for Gmail's change signal)
- Meta (Facebook and Instagram messaging)
- Shopify (your store's data, when you connect it)
Some of them are in the United States. Transfers there rely on the EU-U.S. Data Privacy Framework where the provider is certified, otherwise on the European Commission's standard contractual clauses.
How long we keep data
- Your account, settings and usage statistics: until you delete your account.
- Gmail access: until you disconnect the address (we also revoke Heylane's access at Google).
- Draft history: 365 days, or the shorter time you choose; nothing if you turn it off.
- Instagram and Messenger messages: until you disconnect the account, delete your Heylane account, or the person asks us to delete them.
- Server logs: the providers' standard periods, usually a few days to a few weeks.
Cookies and storage in your browser
The app uses cookies and storage in your browser that it needs to work: to keep you signed in (through Clerk) and to remember choices such as light or dark mode and senders whose images you chose to show. There are no analytics, advertising or tracking cookies. This website (heylane.ai) sets no cookies.
Security
All connections use HTTPS. Access tokens, draft history and Instagram and Messenger messages are encrypted with a key for each account, and every request only reaches the data of the signed-in account.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format (Art. 15 to 21 GDPR). Where processing is based on your consent, you can withdraw it at any time. Write to info@heylane.ai. You can also complain to a data protection supervisory authority, for example the one where you live or where we are based.
Children
Heylane is a tool for businesses and isn't meant for anyone under 16.
Changes
When we change this policy, we update this page and the date at the top.