1. Who we are
HeyCMO is operated by MintMark, Inc., a United States corporation. Its postal address for notices is given in each Order Form. Contact for everything in this notice: alpha@heycmo.ai.
We act in two roles. For our public site, invitation requests, security reports and the people who use the Alpha, we decide why and how personal data is used (we are the controller). For what a partner company puts into HeyCMO about its own customers, the partner decides and we process it on its instructions (we are the processor), under our Data Processing Addendum.
2. What this covers
The pages at heycmo.ai (home, /compare, /security, /tools, /terms and /privacy), pricing.heycmo.ai, and the Alpha’s web app (agent.heycmo.ai) and API (agent-api.heycmo.ai). It does not cover other addresses under heycmo.ai that an older system may still answer, or the emails a partner sends, which are the partner’s own.
3. What we collect, and why
| Who | What we collect | Why, and on what basis | How long |
|---|---|---|---|
| Visitors to the public pages | Your IP address and ordinary request details, seen by Cloudflare (it delivers the pages) and by Google (it serves the fonts the pages use). We set no cookies, load no analytics or advertising scripts, and keep no visitor log of our own. | To deliver and secure the site (legitimate interests). | We hold nothing. Cloudflare and Google keep what they keep under their own terms. |
| People who use the free site check | The address of the website you type at heycmo.ai/tools, which your browser sends to our API (agent-api.heycmo.ai, hosted on AWS). We read that site’s robots.txt, homepage and /llms.txt and keep what we read: the site’s own published pages, nothing about you, so that anyone who checks the same site that day gets the same reading. To stop abuse we count your checks under a keyed hash of your IP address (for IPv6, its /64 network), never the address itself. We do not link the site you checked to you. | To give you the check you ask for and keep the service from being abused (legitimate interests). | The counter: about an hour. The site’s reading: its own day and the next, then deleted the next time anyone runs a check. |
| People who ask for an invitation | The form checks your address in your browser, then opens a new message in your own email app, addressed to alpha@heycmo.ai, with your address in the body. Nothing reaches us until you send it. We then hold your message and what you wrote. Mail to heycmo.ai addresses is forwarded by our domain registrar (Namecheap) to the mailbox of the person who runs HeyCMO. | To reply and decide on an invitation (steps you ask for before an agreement; legitimate interests). | While we talk and for up to 12 months after the last message. Sooner if you ask. |
| People who write to us | Support questions, security reports and rights requests: your name, address and what you tell us. | To reply, fix problems and keep a record (legitimate interests; legal obligation for rights requests). | As above. |
| A partner’s staff using the Alpha | Name, work email, the sign-in provider’s user and organisation ids, role and session data, and each decision they make (approve, edit, decline, pause) with the time. Short-lived counters can hold the IP address for about an hour. | To give their employer the Alpha (contract) and keep it secure and auditable (legitimate interests). | While the workspace exists. The audit log is append-only and stays after a workspace is deleted. |
| A partner’s customers | We are the processor. Email address, name, Stripe customer and invoice ids, amount, currency, attempt number, decline reason, the payment link, the email as approved, delivery, bounce and complaint events, and the SHA-256 hash of an address once it is suppressed (unsubscribe, bounce, complaint or erasure). | On the partner’s instructions: to draft, approve and send failed-payment emails and to keep a record. The partner is the controller and answers for the legal basis and for telling its customers. | See section 7. |
4. AI processing
Failed-payment emails are drafted with AI. While a workspace is in dry-run, the drafter uses a fixed template and sends no customer data to a model. Once a partner is live, the request to Anthropic’s Claude models carries the invoice id, amount and attempt number, the decline category, the customer’s name (passed as quoted data, only to greet them) and the customer’s email address. We do not remove names or addresses first.
Anthropic’s commercial terms say it may not train models on customer content. We are confirming that against the agreement in force for our account. No decision with legal effect is made about anyone by AI alone: a person at the partner approves every email, and the partner decides whether to email at all.
5. Who else receives it
| Provider | What for | What it receives | Where |
|---|---|---|---|
| Amazon Web Services | Hosting: compute, the database, secrets and key management, logs, and storage of audit-log anchors. | All Alpha data. | US East (N. Virginia) |
| Anthropic | AI drafting, for live workspaces only. | The drafting request described above. | Anthropic’s regions |
| WorkOS | Sign-in (AuthKit) for a partner’s approvers. Configured before the first live send. | Name, work email, user and organisation ids, session tokens. | WorkOS’s regions |
| Resend (our own account) | Approval and go-live notices to the people a workspace names, if configured. | Those people’s email addresses and a count of waiting items, never a draft. | Resend’s regions |
| Cloudflare | Delivers heycmo.ai and pricing.heycmo.ai. | Visitors’ IP addresses and request details. | Its global network |
| Google Fonts | Fonts used by the public pages. | Visitors’ IP addresses and request details. | Google’s network |
| Namecheap | Forwards mail sent to heycmo.ai addresses. | The messages you send us. | Provider |
| The partner’s own Stripe and Resend accounts | Not our subprocessors: we read from Stripe and send through Resend with the partner’s keys, which it can revoke at any time. | Invoices and payment events; the approved emails and their delivery events. | Their regions |
Not engaged in the Alpha: the sign-in provider Clerk, Nango, OpenAI, the job scheduler Inngest, context.dev, news and ad-library search, email verification and inbox-placement testing, Slack, image-generation models, and the analytics, search, advertising, CRM, social, listening and research providers on our full list. The Alpha has one workflow, so these are off. We give partners at least 14 days’ notice, where feasible, before adding a subprocessor. The full list is available on request.
6. Where data is kept
The Alpha runs only in AWS us-east-1, in the United States. There is no EU hosting. If you are in the EEA, the UK or Switzerland, your data, or your employer’s customers’ data, is therefore transferred to the United States.
For partners, our Data Processing Addendum names the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, but the clauses are not yet attached to it. We sign them with each partner that holds such data before going live for that partner. For visitors and people who write to us, the transfer is to the providers above, under their own terms.
7. How long we keep it
Automatic scheduled cleanup is not yet active in the current Alpha. The scheduled periods below are policy thresholds, not confirmation of deletion: data can remain beyond them until cleanup is enabled. You can request erasure using the contact details in section 8; the audit and backup exceptions below still apply.
- Our scheduled cleanup policy removes the recipient and message from decided email sends and drafts 90 days after the decision. Waiting, approved and in-flight actions are excluded from this scheduled cleanup. The content of every decided action is replaced after 24 months, and eligible usage records, webhook receipts and unreferenced loop-run records are deleted after 24 months. Referenced loop runs and other histories follow their own lifecycle rules; contact us for the full retention schedule.
- When a person edits or declines a draft, a short record is kept to improve later drafts: the reason or note, which fields changed, and up to 200 characters of the subject and body before and after. Addresses, phone numbers, links, account ids and the recipient’s name are removed first, and the recipient is recorded only as a one-way token. These records are deleted after 24 months, with the workspace, or when that person is erased.
- Failed-payment journey records (Stripe invoice, subscription and customer ids, the amount owed, the decline reason and the stage, with a one-way token in place of the address) are kept while the workspace exists and are deleted with it. Approval decisions (who decided, when and why) and records of recovered payments (Stripe ids and amounts) hold no message; they are append-only and stay after a workspace is deleted.
- The audit log is append-only. It is never deleted or redacted, not even when a workspace is deleted. It holds ids, hashes and outcomes, and text people typed into it, such as a reason for pausing. Draft-edit records written before 24 October 2026 may also contain the original message and recipient; later draft edits record only changed fields and hashes.
- Suppression entries hold only the SHA-256 hash of an address. They stay while the account is active and are deleted with it.
- Backups: automated database backups are kept 7 days. Manual pre-deploy and post-migration recovery snapshots are kept until the Alpha ends and are then deleted by the operator. These are production settings and retention policy recorded on 28 October 2026. Data that is deleted, removed by the cleanup above or erased remains in an automated backup until it expires, and in the manual snapshots until they are deleted.
- Application logs are kept in AWS CloudWatch. They can contain email addresses, because our logger removes secrets, not addresses. Both log groups delete entries after 30 days.
- Short-lived counters (rate limits) expire within about an hour. Emails to us are kept as described in section 3.
8. Your rights
Depending on where you live, you can ask us for a copy of your personal data, ask us to correct, delete or restrict it, ask for it in a portable form, and object to our use of it where we rely on legitimate interests. Email alpha@heycmo.ai. We aim to reply within 30 days. You can also complain to your data protection authority.
If you are a partner’s customer, ask the partner first: it is the controller, and we help it answer. A partner’s admin can export the workspace and erase one person by email address. Erasure removes matching addresses from the editable records covered by the erasure operation and adds a hash to the do-not-contact list to block later sends. Approved or in-flight actions remain unchanged: the result is marked incomplete and must be retried after those actions resolve. The audit log and other immutable histories are never rewritten; old draft-edit records and text entered in audit reasons can therefore retain an address. Immutable creative assets remain until account deletion. Names without the address and records identified only by provider ids are not matched by an email-address erasure. Backups retain data for the periods in section 7. Contact us for the full erasure coverage and exceptions. Failed-payment emails carry a one-click unsubscribe header, and an unsubscribe stops later reminders.
9. Security
Every database query is scoped to one workspace. Keys a partner stores are encrypted one by one (AES-256-GCM), with their data keys wrapped by AWS KMS. The database is private and traffic uses HTTPS. An append-only, hash-chained audit log records decisions and setting changes. A person approves every email, a kill switch stops a workspace, and limits cap sends and AI spend.
The security page says which protections are switched on today, including AWS KMS key wrapping and signed external audit checkpoints, and what we do not have: no SOC 2 report and no independent penetration test. We aim to tell partners of a personal data breach within 72 hours.
10. Cookies, changes and contact
The public pages set no cookies and use no local storage. The Alpha web app uses the sign-in provider’s session cookie to keep you signed in and your browser’s local storage to remember light or dark display; it has no analytics or advertising cookies. We will change this notice when what we do changes and show the date at the top, and tell partners by email about changes that affect them. Questions: alpha@heycmo.ai.