Who we are.
HeyOn is a software service provided by Patrion İleri Teknoloji Sistemleri A.Ş. ("Patrion"), Kemalpaşa Organised Industrial Zone, Kemalpaşa, İzmir, Türkiye, that lets organisations communicate with their customers over the WhatsApp Business Platform and with their own teams. Contact: privacy@heyon.app.
Controller and processor.
For content an organisation handles in HeyOn (messages, files, contacts, internal chats), the organisation is the data controller and Patrion acts as its data processor, processing that data only on the organisation's instructions to provide the service. Patrion is the controller for account, security and billing data of HeyOn users.
Data we process.
Account data (name, e-mail or mobile number, role, team, organisation code); security data (password hash, encrypted two-factor data, session and sign-in records, hashed IP address, audit records); service content on behalf of the organisation (WhatsApp messages, files, delivery statuses, contacts, internal messages, templates); device data (push token, app version); Meta connection data (WhatsApp Business account and phone number IDs, the access token issued by Meta, encrypted).
Purposes.
Providing and securing the service, delivering and storing messages, preventing abuse, support, billing and legal obligations. We do not sell personal data or use it for advertising.
Where data is stored and shared.
HeyOn data is stored on Patrion's own servers in Türkiye, with a separate database per organisation. To operate the service, data is processed by: Meta Platforms (WhatsApp Business Platform, message delivery), Cloudflare (domain and encrypted tunnel), Google Firebase Cloud Messaging and Apple Push Notification service (mobile notifications).
Retention.
Service content is kept for the period set by the organisation; on termination the organisation can export its data within 30 days, after which it is deleted. Backups are kept for at most 14 days. Security and audit records are kept for 2 years; billing records for the legally required period.
Security.
Per-organisation databases, encrypted connections, mandatory two-factor authentication, role-based access, audit logging, encrypted secret storage, tested backups. Patrion staff can access an organisation's content only through time-limited support access approved by that organisation, or through logged emergency access that is reported to it.
Your rights.
You may request access, correction, deletion, objection and information about processing and transfers. Requests about an organisation's content are forwarded to that organisation. Contact privacy@heyon.app; we respond within 30 days.
Data deletion.
See https://heyon.app/data-deletion
This website.
heyon.app uses no cookies and no analytics or advertising trackers. It is served through Cloudflare, which processes technical connection data such as IP addresses for security and delivery. If you e-mail us, we use your address and message only to reply.
Changes.
We may update this policy and will announce material changes in the app.