Privacy Policy

Last updated: March 22, 2026

HeyCMO ("we", "us", "our") operates the heycmo.ai website and the HeyCMO autonomous marketing agent service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

1. Information We Collect

Account information: Email address provided during signup.

Payment information: Processed by Stripe. We do not store credit card numbers. We store your Stripe customer ID and subscription ID.

Brand interview data: Answers to the 8-question brand interview (product, audience, voice, competitors). Stored in your agent's working memory.

Platform credentials: OAuth tokens for connected platforms (Instagram, Google Analytics, etc.) are managed by Composio and stored in their infrastructure. Telegram bot tokens are encrypted with AES-256-GCM before storage.

Marketing content: Content created by your AI agent (blog posts, social posts, emails) and associated performance metrics.

Usage data: API request logs (method, path, status, duration), workflow execution events, and error logs.

2. How We Use Your Information

To provide the HeyCMO marketing agent service
To process payments and manage your subscription
To personalize your agent's marketing strategy (brand voice, content, optimization)
To publish content to your connected platforms on your behalf
To generate analytics reports from your connected platforms
To improve service quality and fix bugs

3. Third-Party Services

We share data with the following services as necessary to operate:

Stripe — Payment processing
OpenAI — AI language models for content creation and analysis
Composio — OAuth and API integrations with your marketing platforms
ElevenLabs — Text-to-speech (optional, when voice features are used)
Neon — PostgreSQL database hosting
Fly.io — Application hosting

Each third-party service has its own privacy policy governing their use of your data.

4. Data Storage and Security

Your data is stored in Neon PostgreSQL (encrypted at rest). Sensitive credentials (Telegram bot tokens) are encrypted with AES-256-GCM. API keys are hashed with SHA-256 and compared using constant-time comparison to prevent timing attacks. All data is transmitted over HTTPS.

5. Data Retention

Account data: Retained while your account is active, plus 30 days after cancellation
Audit events: Automatically deleted after 90 days
Agent memory: Retained while your account is active
Request logs: Retained for 30 days

6. Your Rights

You have the right to:

Access your personal data by contacting us
Correct inaccurate data by re-running the brand interview or contacting us
Delete your account and all associated data by contacting us
Export your data by requesting a copy from us
Withdraw consent at any time by cancelling your subscription

To exercise any of these rights, email privacy@heycmo.ai.

7. Cookies

The HeyCMO website does not use cookies. The dashboard uses no tracking scripts or analytics.

8. AI-Generated Content

Content created by HeyCMO is generated by AI language models. You own all content generated for your brand. We do not use your content to train AI models. Content is processed by OpenAI's API under their data processing terms.

9. Children's Privacy

HeyCMO is not intended for users under 18. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or through the service.

11. Contact

For privacy-related questions: privacy@heycmo.ai