Heybird Privacy Policy
Last updated 9 October 2026
Heybird is an AI receptionist that answers phone calls and texts for small businesses. This policy explains what we collect, why, who helps us process it, and your rights. Heybird is operated by UNIQ VENTURES, SLU (Andorra), the data controller for business owners' account data. For the calls and messages a business receives, the business is the controller and we process that data on its behalf.
What we collect
- Account data (business owners): name, email, phone number, country, business name, hours, services and the information you add to your receptionist.
- Call and message data: the caller's phone number, call audio while it is processed, call recordings (unless the owner turns recording off), transcripts, summaries, messages taken, bookings, and texts sent or received on the business number.
- Caller memory: when the owner leaves "remember callers" on, a short note about returning callers (for example their name and last topic).
- Email: emails sent to the business's Heybird address and the replies sent from it.
- Connected calendar (only if the owner connects one): the owner's email address for that Google or Microsoft account; the free/busy times of the calendar for the next two weeks; once, right after connecting, the titles and start and end times of the next two weeks' events; and the events Heybird creates for bookings. We do not read attendees, descriptions or locations, and we do not change or delete events Heybird did not create.
- Your details for errands (only if you add them): your full name, ID number, date of birth, address or account numbers, for Heybird to identify you when it calls a company for you and they ask to verify the account holder. We store them encrypted; the assistant sees them only masked; a call gives them only when you approved that call, and only to the company it calls. We never keep passwords, PINs, codes or card numbers.
- Subscription data: your App Store subscription status and transaction ids. Apple handles payment; we never see your card.
- Device and diagnostics: push-notification tokens, and crash and error reports.
Why we use it
- To answer calls and texts for the business, take messages, book appointments and send the owner notifications and summaries (performing our contract with the business).
- To bill the subscription and count answered calls against the plan.
- To keep the service secure, block spam and fix problems (legitimate interest).
We don't sell personal data, and we don't use call or message content to train AI models.
Recording and AI disclosure
Where the law requires it, Heybird tells callers that they are speaking with an AI assistant and that the call may be recorded. Business owners choose whether calls are recorded.
Who processes data for us
| Provider | What for |
|---|---|
| Telnyx | Phone numbers, calls and text messages |
| LiveKit | Real-time call audio (EU region) |
| Google (Gemini) | The live voice model and spoken replies; search over the account's own knowledge, files, calls and emails (embeddings), with card numbers removed and identity numbers and bank accounts replaced first |
| Anthropic (Claude) | Call summaries and text replies |
| Deepgram, Cartesia | Speech-to-text and text-to-speech (backup voice path) |
| Supabase | Database, sign-in and file storage |
| Hetzner | Servers (Germany) |
| Sentry | Error reports |
| PostHog | Usage statistics: which features are used (for example a code redeemed or a call shared), keyed by a random account id, never names, numbers or messages; website visits without cookies (data stored in the US) |
| Apple | App Store subscriptions and push notifications |
| Resend | Receiving and sending email for the business's Heybird address (data stored in the US) |
| Google Calendar, Microsoft (Outlook) | Reading busy times and writing bookings, only for a calendar the owner connected |
European businesses' data is stored in the EU. Some providers above may process data outside your country; where they do, we rely on their standard contractual clauses or equivalent safeguards.
Google user data
Heybird's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
What we access. If you connect a Google Calendar: your Google account's email address (to show which calendar is connected); when your calendar is busy over the next two weeks; once, right after you connect, the titles and times of your next two weeks' events; and the booking events Heybird itself creates. Nothing else in your Google account.
How we use it. Busy times decide which openings Heybird offers your callers. Booking events put the appointments Heybird takes into your calendar, and are changed or removed when the booking is. Event titles are used once to suggest errands Heybird could do for you in the app. Google user data is used only for these features you see in the app: never for advertising, never to build profiles, and never sold.
Who it is shared with. Only the service providers that run these features for you: the openings Heybird offers (never your event details) reach the voice model on a call (Google Gemini) and the caller; event titles are sent once to Anthropic (Claude) to write the suggestions. Both process the data under paid API terms that forbid using it to train their models. We do not use Google user data to develop, improve or train AI or machine-learning models, and we never transfer it to anyone who would. We don't share it with anyone else unless the law requires it.
How we protect it. Google's access and refresh tokens are encrypted before they are stored (AES via Fernet), with a key kept outside the database. All traffic to Google and to our providers uses HTTPS. Data is stored in the EU for European businesses. Only people at Heybird who need to fix a problem you reported can see it.
How long we keep it and how to delete it. We don't store your busy times or event titles: they are read when needed and discarded. The suggestions written from them stay in your Heybird thread like any other message until you delete them or your account. We keep the tokens and the ids of the booking events Heybird created while the calendar is connected. Disconnecting the calendar in the app deletes the tokens and those ids at once (the booking events stay in your calendar for you to keep or delete). Deleting your account deletes all of it. You can also revoke Heybird's access at any time from your Google account's security settings.
How long we keep it
Call recordings are deleted automatically once they are older than the owner's "Keep recordings for" setting: 30 days, 90 days (the default) or 1 year. The call's transcript and summary stay with the account. We keep account, call and message data while the account is active. When you delete your account in the app (Account → You → Delete my account), we delete your recordings and your business data and release its phone number. Records we must keep by law (for example billing records) are kept for as long as the law requires.
Your rights
You can access, correct, export or delete your data, object to or restrict processing, and complain to your data-protection authority (in Spain, the AEPD). Callers who reached a business through Heybird can contact that business, or us, and we will help. Write tohello@heybird.ai.
Children
Heybird is a service for businesses and isn't directed to children under 16.
Changes
If we change this policy we'll update the date above, and tell account holders in the app when a change matters.