1. Who is responsible for your information
Hiyori is operated by Heron Technology LLC, a Wyoming limited liability company, at 1021 E Lincolnway Suite #10592, Cheyenne, Wyoming 82001, United States. For support or privacy requests, contact [email protected].
This policy covers both free and paid users when you message Hiyori, use your account, or start a subscription checkout. Messaging Hiyori creates an account linked to your WhatsApp number automatically. Free access has no expiry and does not require a payment method; it still involves processing the information needed to provide the assistant and enforce its limits.
2. Information we process
- Account information: your WhatsApp phone number, account identifier, timezone, notification preferences, and authentication records.
- Conversations and personalisation: messages you send, uploaded filenames and extracted file contents, AI replies, preferences you ask Hiyori to remember, and reminder content and schedules.
- Research activity: search queries, URLs, retrieved page content, screenshots, and records of web actions used to fulfil your requests.
- Billing and usage: daily request counts, search and other web-action counts, token usage, request timestamps and outcomes, plan allowances, payment and invoice identifiers, subscription status and billing interval, paid-through dates, cancellation status, and transaction history. Historical token-credit records from earlier versions may remain for reconciliation; they do not determine current free or paid access. Stripe collects the billing name, address and payment details you provide at checkout; our application does not store full card numbers.
- Technical and support information: information you provide in support requests and operational data such as request times, IP addresses processed by our infrastructure, errors, and security logs.
3. Why we use it
We use information to answer your requests, personalise responses, deliver agreed reminders, authenticate you, process subscription payments, apply the correct free or paid allowances, prevent duplicate billing, provide support, and keep the service secure. Usage records help enforce daily and per-request limits, avoid counting automatic retries twice, and detect attempts to bypass limits. We record processing usage for both plans; it is not a token top-up balance or permission to charge free users.
Where GDPR or similar law applies, we rely on performance of our agreement for core service processing; legitimate interests in operating, securing, and troubleshooting the service; legal obligations for required financial and compliance records; and consent where it is required. You can withdraw consent for optional processing without affecting processing that was lawful before withdrawal.
4. Service providers and sharing
WhatsApp/Meta delivers messages between you and Hiyori. Relevant messages, selected text from uploaded files, conversation context, and saved preferences are sent to our configured AI providers, including DeepSeek or Fireworks, to generate responses. Messages are processed by Hiyori after delivery; WhatsApp transport encryption does not mean they remain unreadable to Hiyori or its AI providers.
When you request web research, search queries and requested URLs are processed through Tavily and our browsing infrastructure. Visited websites receive ordinary browsing requests and may receive search-form queries. Our hosting and delivery infrastructure uses Railway and Cloudflare. Stripe processes payments and billing details. If you start a subscription checkout, we create a Stripe customer record linked to your internal account identifier, even if you do not complete payment. We use payment and subscription updates to maintain your access and provide billing management. A subscription checkout is not required for free use.
These providers process information under their applicable agreements and policies. Information may also be disclosed when legally required or reasonably necessary to address fraud, security incidents, or legal claims. AI providers’ retention and use of data, including any model-improvement processing, depend on the provider’s applicable terms and service configuration.
5. International processing
Heron Technology LLC is based in the United States. Our providers may process information in the United States, China, and other countries where they operate, including outside the European Economic Area. Data-protection laws in those countries may differ from those in your country.
Contact [email protected] for information about the processing locations and transfer arrangements applicable to your data, and how to obtain information about any applicable safeguards.
6. Retention and deletion
Account data, messages, saved memories, reminders, and usage records are stored to maintain the service and your history. Conversation history currently has no automatic age-based deletion. A daily allowance reset changes what you can use that day; it does not delete the underlying usage records. Cancelling a subscription or returning to the free plan does not automatically delete account data, conversations, memories, reminders, or billing records. Deleting a memory removes that saved preference, but not the original message; cancelling a reminder stops delivery but may leave an operational record.
Uploaded files are downloaded temporarily for text extraction and removed from temporary storage after processing. Extracted text and any remaining download references expire after seven days and are removed by routine cleanup. Filenames and captions in conversation history, replies based on files, and memories you explicitly ask us to save follow the conversation and memory retention described above. Copies in WhatsApp remain subject to WhatsApp and your device settings.
Browser sessions are temporary and close after a request or a short timeout. Generated screenshots expire after 24 hours and are removed by routine cleanup; copies already delivered to WhatsApp remain subject to WhatsApp and your device settings. Website sign-in sessions expire after seven days. AI usage logs are configured for 30-day retention.
You can contact us to request account or conversation deletion. Requests are handled manually and may require verification. Information needed for accounting, legal obligations, fraud prevention, or disputes may be retained for the applicable purpose. Provider-held records and backups may follow different retention schedules.
7. Cookies and security
The account website uses a necessary session cookie to keep you signed in. We do not add advertising trackers or analytics cookies. On public guide and landing pages, we count page views and WhatsApp-button clicks in daily totals by page and a limited source label (direct, X, or community). These counters do not store visitor identifiers, IP addresses, full URLs, or browsing histories, and are not linked to your WhatsApp account. We retain these aggregate counters for up to 90 days, with cleanup during routine collection. Collection is disabled when your browser sends Do Not Track or Global Privacy Control. New-conversation totals are reported separately from website clicks. Third-party services such as Stripe and WhatsApp have their own cookie and privacy practices.
We use measures including HTTPS, access controls, and protected authentication records. No service can guarantee absolute security. Avoid sending sensitive information that is unnecessary for your request.
8. Your choices and rights
In Your space, you can delete saved memories, cancel reminders, and change notification preferences. You can also send STOP to pause proactive messages, START to resume them, or CANCEL to stop unfinished research requests where possible.
Depending on applicable law, you may request access, correction, deletion, portability, restriction of processing, or object to certain processing. Contact us using the details above. You may also complain to your local data-protection authority. Hiyori is intended for adults, not children under 18.
We will update this policy when practices change and provide notice of material changes where required.