I’m event organizer

Privacy Policy

Last Updated: November 8, 2026

If you’ve come here, it means you care about your privacy — and so do we. This document explains, in plain language, how we collect, use, and protect your personal data when you interact with Heyli.

We’ve designed this policy to be transparent and easy to understand. Each section tells you what we do, why we do it, and what law allows us to do it. If anything is unclear, you can always reach us at support@meetheyli.com.

1. Who is the data controller?

The controller of your personal data is:

Heyli
ul. Chmielna 73, 00-801 Warszawa, Poland
NIP: [NIP]
[KRS/CEIDG: TO BE ADDED]

This means we decide how and why your personal data is processed. We are responsible for ensuring your data is handled in accordance with Regulation (EU) 2016/679 (the “GDPR”).

This Privacy Policy applies to the Heyli service accessible via WhatsApp, the website meetheyli.com, and the emails Heyli sends.

1.1 Heyli and your community

Heyli also works with communities, such as coworking spaces, associations, and event series (for example, CIC Warsaw). Here, two roles are possible:

  • Your community is the controller of its own member list. If your community gives Heyli its member list, Heyli processes that list for the community as its processor (Article 28 GDPR), under a written data processing agreement. The community decides that Heyli may use the list to help its members meet.
  • Heyli is the controller of everything that happens in your chats and emails with Heyli — your messages, your Heyli profile, your requests, and your answers to introductions.

If you are not sure which role applies to your data, write to support@meetheyli.com and we will tell you.

2. How can you contact us about your data?

At our current scale, the appointment of a Data Protection Officer is not mandatory. We keep this under regular review as our user base grows. You can contact us about any privacy-related matter at:

Email: support@meetheyli.com Postal address: ul. Chmielna 73, 00-801 Warszawa, Poland

We aim to respond to all inquiries within 30 days, as required by law.

3. What personal data do we collect?

We collect different types of data depending on how you interact with Heyli. Here is a complete list:

3.1 Data you provide directly

Data When collected Why needed
WhatsApp phone number When you first message Heyli This is your primary identifier — we need it to communicate with you
Name (first name and surname) When you introduce yourself in conversation, or from your publicly available LinkedIn profile if you share it To address you personally and create your networking profile
Email address When you share it during conversation Required for sending introduction emails to potential matches
LinkedIn URL When you choose to share it during conversation So we can review your publicly available professional information instead of asking you to type it (see Section 4.4)
Website URLs (portfolio, GitHub, personal website) When you share them during conversation To enrich your professional profile
Professional information (job title, company, skills, what you’re seeking, what you offer) Extracted from your conversations by AI, or from your publicly available LinkedIn profile if you share it To understand your professional background and find relevant matches
Hobbies and interests When you mention them in conversation To find people with shared interests and make better introductions
Business stage (e.g., idea, pre-revenue, revenue) Extracted from conversation To match you with people at a compatible stage

3.2 Data generated from your conversations

Data Description Why generated
Conversation history Text of messages exchanged with Heyli To maintain context across conversations and provide a coherent experience
AI-extracted profile Structured summary of your professional background To power the matchmaking algorithm
Long-term memories Key facts, preferences, and patterns from conversations To remember your goals, preferences, and networking needs over time
Profile summaries AI-generated descriptions shared with potential matches To introduce you to relevant contacts

3.3 Voice message data

If you send voice messages to Heyli:

Data Description Why processed
Audio recording Your voice message, sent via WhatsApp Transcribed to text so Heyli can understand and respond
Transcription Text version of your voice message Treated the same as text messages (see 3.2 above)

Important: Voice messages are processed by our speech-to-text provider (EU endpoint). The audio is used solely for transcription — it is not used for biometric identification, voiceprint creation, or identity verification. The audio is not stored permanently by the provider. By sending voice messages, you consent to this transcription. If you prefer, you can always send text messages instead.

3.4 Introduction and matching data

Data Description Why processed
Introduction requests Record of who you’ve been matched with To track introductions and prevent duplicates
Accept/decline decisions Whether you accepted or declined an introduction To respect your preferences and improve future suggestions
Email addresses shared with matches Your email, shared only after both parties accept To enable direct communication between matched users

3.5 Community and networking activity

Data Description Why processed
Activity history Which events, associations, or coworking spaces you are part of (detected from conversation or QR scan) Part of your profile — used to enrich matchmaking by understanding your networking activity and community involvement
Event attendance That you signed up for or attended a specific event evening To help you meet other people at the same event
Requests What you asked Heyli to find (for example, “a designer for my app”), its status, and the community manager’s yes or no To find the right person, and to keep looking for up to 90 days when nobody fits yet

3.6 Technical and security data

Data Description Why processed
IP address (from webhooks) Your device’s IP when interacting via WhatsApp Security logging, fraud prevention (stored for 30 days, then deleted)
User agent (from webhooks) Your device/browser information Security logging (stored for 30 days, then deleted)
Consent records When you granted or revoked consent, your IP at that time, consent version. This includes smaller choices, such as whether Heyli may show your LinkedIn to people you are introduced to. Records are only added, never changed Legal requirement to prove we obtained valid consent (Art. 7 GDPR)
Opt-out record After you ask us to delete your data, a one-way hash (a scrambled code that cannot be turned back into your email) of your email address So we never import or contact you again, for example from a new community list
Email verification data Verification tokens and timestamps To confirm your email address is valid (tokens expire in 24 hours)

3.7 Data we receive from your community

You may be in Heyli without having messaged Heyli yet. This happens when your community (for example, your coworking space) gives Heyli its member list, or when a community manager adds you in the Heyli panel. This is the second way your data can reach us. The first way is you messaging Heyli yourself.

Data Source Why needed
Name, company, job title Your community’s member list To know who is in the community
Work email address (when the community has it) Your community’s member list To send you the community’s first email and, later, introduction emails
LinkedIn URL (when the community has it) Your community’s member list To read your public work profile (see below)
Public work profile (current role, company, experience, skills) Your public LinkedIn profile, read by our profile enrichment provider To understand what you do, so the community manager can suggest good introductions
Membership Your community To know which community and location you belong to

Before we read a profile, we check if we already know you (by LinkedIn URL, then by email; never by name only). If we do, we reuse what we have and do not read it again.

We never receive your phone number from your community list, and we never take email addresses from LinkedIn.

The first email you receive from your community about Heyli tells you where your data came from, what Heyli does with it, and how to opt out (Article 14 GDPR).

3.8 Data Heyli creates about roles and companies

Data Description Why created
Role card A short AI-written description of your current role: what you do, your area (such as design or sales), your seniority level, whether you lead a team or work hands-on, and whether you are likely to make buying decisions. It takes your company’s size into account, because the same title means different things at a 5-person startup and at a large corporation. It also has one standard role name and role families (groups of similar roles) So people can quickly see what you do, to find better matches, and so managers can invite the right people to circles
Company record Your current company’s name, a one-line description, industry, company type, and size range (from the company’s public LinkedIn page) To describe your company in introductions and to adjust role cards

Heyli shows only your current role. Past jobs are used only to understand your experience.

3.9 Data we do NOT collect

We want to be clear about what we do not collect:

  • We do not collect your exact geographic location (GPS)
  • We do not access your WhatsApp contacts
  • We do not read your private WhatsApp conversations with other people
  • We do not intentionally collect special category data (health, political opinions, religious beliefs, sexual orientation, etc.)

However: Because you communicate with Heyli via free-text messages, you might voluntarily share information that falls into these categories. We do not filter or screen for such data. If you voluntarily provide special category data (such as health information, political opinions, or religious beliefs), we process it on the basis of your explicit consent under Article 9(2)(a) GDPR — by choosing to share this information with Heyli, you explicitly consent to its processing. We treat any such information with the same protections as all other personal data.

Under the GDPR, every data processing activity must have a legal basis. Here is what we do, why, and which law permits it:

4.1 Providing the Heyli service (matchmaking, memory, conversation)

  • What: Processing your messages, maintaining conversation context, extracting your professional profile, storing memories, and finding relevant matches.
  • Why: This is the core of what Heyli does — it’s an AI networking companion that helps you meet the right people.
  • Legal basis: Your consent (Article 6(1)(a) GDPR). You explicitly grant consent when Heyli asks you during the onboarding conversation. You can withdraw consent at any time (see Section 9).
  • What if you don’t consent? Providing consent is voluntary, but it is necessary for us to deliver the service. Without your consent, Heyli cannot store your profile, remember your conversations, or find matches for you. You may still send messages to Heyli, but the core matchmaking and memory features will not be available. If you withdraw consent after previously granting it, we will stop processing your data and delete it within 30 days — but we will no longer be able to provide the service to you.

4.2 Sending introduction emails

  • What: We send emails that suggest an introduction. Each email asks one person at a time. Contact details are shared only after both people say yes (see Section 5.2).
  • Why: To connect you with people who match your networking goals.
  • Legal basis:
    • If you use Heyli yourself and ask for an introduction: your consent (Article 6(1)(a) GDPR).
    • If a community manager suggests the introduction, or if you are only on your community’s list: legitimate interest (Article 6(1)(f) GDPR), see Section 4.13. You can reply “opt out” at any time.

4.3 Email verification

  • What: Sending you a verification email with a secure link to confirm your email address.
  • Why: To ensure we have the correct email and to enable double opt-in for introductions.
  • Legal basis: Your consent (Article 6(1)(a) GDPR).

4.4 Using your LinkedIn profile information

  • What: If you choose to share your LinkedIn URL with us, we review the publicly available information on your profile (such as your job title, company, and skills) to help build your networking profile — saving you from having to type your professional details manually.
  • Why: To create a richer professional profile for better matchmaking, as a convenience to you.
  • Legal basis: Your consent (Article 6(1)(a) GDPR). We will ask for your explicit consent before using information from your LinkedIn profile.
  • Note: This feature is entirely optional. You can decline and still use Heyli fully — just share your professional details in conversation instead.

4.5 Voice message transcription

  • What: Converting your voice messages to text using our speech-to-text provider.
  • Why: So Heyli can understand what you said and respond appropriately.
  • Legal basis: Your consent (Article 6(1)(a) GDPR). You can avoid this processing by sending text messages instead.

4.6 Security and fraud prevention

  • What: Logging webhook events (IP address, user agent, message IDs), verifying webhook signatures, detecting prompt injection attacks, rate limiting.
  • Why: To protect the service and your data from unauthorized access, abuse, and attacks.
  • Legal basis: Legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is maintaining the security and integrity of the service. This outweighs any impact on your rights because the data is pseudonymized (phone numbers are hashed) and retained for only 30 days.

4.7 Service improvement and debugging

  • What: The Heyli team may review conversations between you and Heyli to understand how the AI performs — for example, whether Heyli asks the right questions, understands your needs, and provides helpful responses. We also log anonymized technical data about AI performance (LLM traces with hashed user identifiers).
  • Why: To make Heyli a better listener and conversational partner, fix bugs, improve AI response quality, and monitor system performance.
  • Legal basis: Legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is improving the quality and reliability of the service.
  • Safeguards: Access to conversations is limited to authorized team members bound by confidentiality obligations. We do not export or share individual conversation data outside the team. When possible, we use anonymized or aggregated data for analytics and improvement.

4.8 Website analytics and advertising measurement

  • What: Collecting usage data on our website and landing pages using analytics tools (Google Analytics, PostHog) and advertising measurement tools (Meta Pixel, LinkedIn Insight Tag). This includes page views, button clicks, traffic sources, and campaign performance.
  • Why: To understand how visitors interact with our website, improve the user experience, and measure the effectiveness of our social media campaigns.
  • Legal basis: Your consent (Article 6(1)(a) GDPR). We use a cookie consent mechanism to obtain your permission before activating any analytics or marketing cookies. See Section 11 for details.

4.9 Contact and correspondence

  • What: When you contact us via email (support@meetheyli.com), social media messages, or any other communication channel, we process the personal data contained in your correspondence — such as your name, email address, and the content of your message. Your IP address may also be recorded by the communication system.
  • Why: To respond to your inquiry and maintain a record of our communication. After the correspondence is completed, the data is stored in our archive for the purpose of possible determination, investigation, or defense of claims related to the communication.
  • Legal basis: Legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is communicating with users and potential users and maintaining records of these communications.

4.10 Creating advertising audiences

  • What: If you consent, your email address stored in our database may be sent in a hashed (encrypted) form to advertising platforms (such as Meta Ads or LinkedIn Ads) to create custom audiences for our marketing campaigns.
  • Why: To reach people similar to our existing users and to show relevant content to people who have already interacted with Heyli.
  • How it works: The email address is hashed before being sent to the advertising platform. The platform uses it only for matching purposes, does not share it with third parties, and deletes it after the matching process is completed.
  • Legal basis: Your consent (Article 6(1)(a) GDPR). You can withdraw your consent or opt out of being included in advertising audiences at any time by emailing support@meetheyli.com.
  • What: Retaining certain records as required by law, including:
    • Tax and accounting: Issuing invoices (where applicable), maintaining accounting documentation, and storing records required by tax law (Article 6(1)(c) GDPR in connection with applicable tax provisions).
    • Consent audit trails: Proving that valid consent was obtained (Article 7(1) GDPR).
    • Data protection obligations: Processing data necessary to fulfill our obligations as a data controller, including responding to data subject requests and demonstrating GDPR accountability (Article 6(1)(c) and 6(1)(f) GDPR).
  • Why: Because the law requires it.
  • Legal basis: Legal obligation (Article 6(1)(c) GDPR) and legitimate interest (Article 6(1)(f) GDPR).
  • What: Creating and maintaining archives (digital and traditional) of personal data we have processed in connection with you. The scope may vary depending on the nature of the data and the claim. We may process any personal data related to a given claim.
  • Why: To organize and secure personal data for business purposes, and to defend, establish, or pursue legal claims that may arise from your use of Heyli.
  • Legal basis: Legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is protecting our rights and ordering our business records.

4.13 Community member lists and manager introductions

  • What: Using your community’s member list and your public work profile (Section 3.7) so that your community manager can suggest introductions to you, and so that other members of your community can find you when they ask Heyli for help.
  • Why: Helping members meet each other is part of what a community offers. Your community chose Heyli to do this.
  • Legal basis: Legitimate interest (Article 6(1)(f) GDPR) — the community’s interest, and ours, in helping members of the same community meet for work. We do not ask for your consent first, because you may never have heard of Heyli. Instead, we protect you like this:
    • We use only work data (role, company, what you do). Never your phone number, and never private details.
    • The community’s first email tells you about Heyli, where your data came from, and how to opt out.
    • Other members can find you through Heyli only 14 days after that first email, and only if you did not opt out.
    • A human decides. A community manager approves every introduction, and you always say yes or no before anyone gets your contact details.
    • Opting out works at once. Reply “opt out” (or “wypisz”) to any Heyli email: you get no more introductions and nobody can find you through Heyli. To delete all your data, write to support@meetheyli.com: we delete it within 30 days and keep only an opt-out record (Section 3.6).
  • Your right to object: You can object at any time (Article 21 GDPR). We then stop at once — we do not weigh your objection against our interest.

5. How does AI processing work?

Heyli is an AI-powered networking companion. Here is how AI is involved in processing your data:

5.1 Conversation AI

Your messages are processed by a large language model to generate responses, extract your professional profile, and maintain conversation context. We access the model through an EU-only routing service: your data is processed only on servers in the European Economic Area, and requests are never routed outside it. We use zero-data-retention settings — the AI providers do not store your messages after generating a response and do not use them for training.

What data goes to the AI:

  • Your current message
  • Recent conversation history (up to 40 messages)
  • Your extracted profile (name, role, company, skills, goals)
  • Relevant memories from past conversations
  • Event/activity context (if applicable)

What the AI does NOT have access to:

  • Your phone number (it’s hashed before any logging)
  • Other users’ personal data (user isolation is enforced)
  • The ability to send emails, make API calls, or take autonomous actions

5.2 Matchmaking

Heyli uses semantic similarity search (via a vector database hosted in the EU) and an AI ranking step to find people whose professional backgrounds, goals, and interests align with yours.

How it works:

  1. Your profile is converted into a mathematical representation (vector embedding) that captures the semantic meaning of your professional background.
  2. When you search for connections, the system finds other profiles with similar embeddings and removes people you have declined before.
  3. An AI model then orders this short list by how well each person fits what you are looking for (complementary skills and needs, shared interests, same event). For this step the AI receives only role, skills, needs, and interests — not names, contact details, LinkedIn data, or user IDs.
  4. You always have the final say — matches are suggested, never forced. You explicitly choose whether to proceed with an introduction, and the other person must also accept before any contact details are shared.

Two ways an introduction can start:

  • (a) You ask Heyli on WhatsApp. For example, “I need a designer”. Heyli shows you people who may fit. When you pick someone in your community, your community manager says yes or no. If yes, Heyli asks that person. If nobody fits yet, Heyli keeps looking for up to 90 days and writes to you first when someone fits.
  • (b) A community manager suggests it. The manager picks two people in the Heyli panel and gives the reason. Heyli writes the email in its own style. Heyli emails the first person. Only after the first person says yes does Heyli email the second person. The first person may never have talked to Heyli before.

What people see before they say yes:

  • In an introduction email, the first person sees the other person’s first name, current role, company, a one-line company description, and what they offer or look for. This can happen before the other person has said yes. Heyli shows the other person’s LinkedIn only if that person said yes to it in a chat with Heyli.
  • In WhatsApp lists, people see first name, role, company, city, and a shared hobby (if any).
  • Heyli never shows a surname, email address, or phone number before both people say yes. Your phone number is never shared, not even after.
  • After both people say yes, Heyli sends one email to both of you, so you can write to each other directly.
  • If someone does not answer within 21 days, the introduction is marked “No reply” and Heyli stops.

Who the email says it is from: If you have never talked to Heyli, the introduction email says that your community manager thinks you should meet, so you know why you are getting it. If you already talk to Heyli, the email comes from Heyli alone.

5.3 AI limitations

  • AI-generated content (responses, match descriptions, profile summaries) may contain inaccuracies or make incorrect inferences.
  • Heyli is an AI system, not a human. It may make mistakes.
  • Match suggestions are based on algorithmic analysis and do not guarantee compatibility.
  • Heyli does not make legally binding commitments or provide professional advice.

5.4 EU AI Act transparency

In accordance with the EU AI Act (Regulation 2024/1689, Article 50), we inform you that:

  • Heyli is an AI system. When you interact with Heyli, you are interacting with artificial intelligence, not a human.
  • Heyli is classified as a limited-risk AI system (chatbot).
  • Content generated by Heyli is AI-generated. This includes the introduction emails Heyli sends. A community manager may choose who to introduce and why, but Heyli’s AI writes the text.

6. Who receives your data?

We work with third-party service providers (“processors”) who help us deliver the Heyli service. Each processor only receives the data necessary for their specific function, and we have Data Processing Agreements (DPAs) in place with all of them.

6.1 Categories of processors

Category Purpose Region
Cloud infrastructure Hosting the service and the community manager panel, network security, and panel access control EU and non-EU
AI processing Powering conversations, generating embeddings, matchmaking EU
Messaging Delivering WhatsApp messages EU
Email delivery Sending introduction and verification emails EU
Database Storing user data, profiles, conversations EU
Vector search Semantic matching and memory retrieval EU
Speech-to-text Transcribing voice messages EU
Analytics Website and landing page statistics EU and non-EU
Advertising measurement Measuring effectiveness of social media campaigns (when you consent) EU and non-EU
Observability Debugging, monitoring AI performance, and error reports (personal data is removed from error reports) EU
Rate limiting Protecting the service from abuse EU
Profile enrichment Reading public LinkedIn profiles (when you share your LinkedIn, or when your community’s list has it) EU and non-EU

Your profile, conversations, and matchmaking data are stored in the European Union. Two categories, cloud infrastructure and profile enrichment, include providers outside the EU. For them we use Standard Contractual Clauses (SCCs) approved by the European Commission (see Section 7).

Full processor list: You can request the complete list of our processors, including company names and locations, by emailing support@meetheyli.com. We will provide it within 14 days.

6.2 Other potential recipients

Your data may also be disclosed to:

  • Your community’s managers — People who run your community (for example, the CIC Warsaw team) see the work profiles of their own community’s members in the Heyli panel: name, role card, company, and what you offer or look for. They use it to suggest introductions, to approve requests, and to invite people to circles. They do not see your conversations with Heyli. Managers see only their own community.
  • Other Heyli users — Only what is listed in Section 5.2 (“What people see before they say yes”). Your email is shared only after both people say yes. Your phone number is never shared.
  • Legal authorities — If required by law (e.g., court orders, regulatory investigations).
  • Professional advisors — Lawyers or auditors bound by professional secrecy, if necessary for legal matters.

6.3 What we do NOT do

  • We do not sell your personal data to anyone.
  • We do not share your data with advertisers.
  • We do not use your data to train AI models. The AI models we use are vendor-managed and your data is not used to improve or fine-tune them. However, Heyli does store memories and extract profile information from your conversations (with your consent) to provide a personalized experience — this is information storage and retrieval, not model training.

7. Do we transfer data outside the EU?

Our infrastructure is designed with an EU-first approach. Your primary personal data (profile information, conversation history, matchmaking data) is stored and processed on servers located within the European Union.

Two categories of providers process some data outside the EU: cloud infrastructure (network security and access control for our web services and the community manager panel) and profile enrichment (reading public LinkedIn profiles). For these, we use Standard Contractual Clauses.

Some of our other service providers are incorporated outside the EU (primarily in the United States) but operate EU-based infrastructure. These providers may have limited access to your data from outside the EU for purposes such as technical support and service maintenance. Where data is transferred to or accessible from outside the EU, we rely on the following safeguards:

  • EU-US Data Privacy Framework (DPF): Where applicable, we use providers certified under the EU-US Data Privacy Framework, which the European Commission has recognized as providing adequate data protection (adequacy decision of July 2023, upheld by the General Court in September 2025).
  • Standard Contractual Clauses (SCCs): We have entered into EU Commission-approved Standard Contractual Clauses (Article 46(2)(c) GDPR) with providers where DPF certification is not available.
  • Data Processing Agreements (DPAs): We have Data Processing Agreements in place with all processors.
  • Data minimization: Only the minimum necessary data is transferred or made accessible.

Several of our key providers are incorporated within the EU and do not involve any third-country transfers.

8. How long do we keep your data?

We process your personal data only for as long as necessary for each specific purpose. Here is a summary of our retention periods:

Category Retention period
Your profile, memories, and matchmaking data (name, role, skills, professional information, community and networking activity, introduction records, vector embeddings) Duration of service relationship — until you request deletion or revoke consent
Conversation history Duration of service relationship — until you request deletion or your account is terminated
Data from your community’s list (Section 3.7) and your role card While you are on your community’s list and the community works with Heyli. When the community removes you or stops working with Heyli, we delete it within 30 days, unless you use Heyli yourself
Requests While Heyli looks for a match: up to 90 days when nobody fits yet. You can ask Heyli to keep looking for another 90 days. Closed requests stay with your profile
Introductions with no answer Marked “No reply” after 21 days. The record stays with your profile, so Heyli does not ask you again
Opt-out record (email hash, Section 3.6) As long as Heyli runs, so we never contact you again
Security logs (IP address, user agent) 30 days
Email verification tokens 24 hours (automatic expiry)
Consent records Duration of service relationship + 6 years (legal requirement — Art. 7(1) GDPR, aligned with Polish limitation period)
Tax and accounting records 5 years from the end of the tax year (Polish tax law)
Legal claims data and archives Until claims expire (typically 3–6 years under Polish law)
Analytics and advertising data Until the data is no longer useful or you successfully object
Social media interactions Platform-dependent — we have no control over retention on social media platforms

After you request deletion or revoke consent: We delete your data from all systems within 30 days. Some data may be retained in encrypted backups for up to 90 days after deletion, after which it is permanently removed.

Inactive accounts: If you have not interacted with Heyli for 12 months, we will notify you that your data will be deleted and give you 30 days to respond before proceeding with deletion.

9. What are your rights?

Under the GDPR, you have the following rights regarding your personal data:

9.1 Right of access (Article 15)

You can request a copy of all personal data we hold about you. We will provide it in a structured, commonly used format (JSON). To exercise this right, email support@meetheyli.com.

9.2 Right to rectification (Article 16)

If any of your data is inaccurate or incomplete, you can ask us to correct it by emailing support@meetheyli.com.

9.3 Right to erasure — “right to be forgotten” (Article 17)

You can request that we delete all your personal data. We will delete it from all systems within 30 days. To exercise this right, email support@meetheyli.com.

What gets deleted: Your profile, conversation history, memories, vector embeddings, introduction records, and any data held by our processors.

What we may retain: Consent audit records (to prove we complied with the law), the opt-out record (a hash of your email, so a new community list never brings you back), and anonymized, aggregated statistical data that cannot identify you.

Data from your community’s list: If your community gave us your data, we delete it from Heyli and tell your community that you asked us to.

9.4 Right to restrict processing (Article 18)

You can ask us to temporarily stop processing your data (while keeping it stored) in certain situations — for example, if you dispute the accuracy of your data or if you believe our processing is unlawful. Contact support@meetheyli.com.

9.5 Right to data portability (Article 20)

You can request your personal data in a structured, machine-readable format (JSON) and have it transmitted to another service. Email support@meetheyli.com.

9.6 Right to object (Article 21)

You can object to processing based on legitimate interest (sections 4.6, 4.7, and 4.13 above). If you object, we will stop processing unless we can demonstrate compelling legitimate grounds. For direct marketing, you can always object and we will stop immediately.

Community lists and introductions (Section 4.13): Reply “opt out” (or “wypisz”) to any Heyli email. We stop all introductions at once, without weighing your objection. To also delete your data, write to support@meetheyli.com.

9.7 Right to withdraw consent (Article 7(3))

Since most of our processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing that happened before you withdrew.

How to withdraw: Email support@meetheyli.com. We will process your withdrawal and delete your data within 30 days.

9.8 Rights related to automated decision-making (Article 22)

Heyli uses AI to suggest matches. While these suggestions involve automated processing, a human is always in the loop: a community manager approves requests and chooses manager introductions, and you always make the final decision about whether to proceed. Your contact details are never shared without your explicit yes.

If you believe an AI-generated match suggestion was unfair or inaccurate, you can:

  • Decline the suggestion (no further action taken)
  • Contact support@meetheyli.com to request human review of the matching process

9.9 How to exercise your rights

  • Via email: support@meetheyli.com
  • Response time: Within 30 days (extendable by 60 days for complex requests, with notice)
  • Identity verification: We may ask you to verify your identity before processing your request, to protect your data from unauthorized access
  • Cost: Free of charge. We may charge a reasonable fee for manifestly unfounded or excessive requests.

10. Do we use automated decision-making or profiling?

10.1 Profiling

Yes, Heyli creates a professional profile based on your conversations. This profile includes your name, role, company, skills, goals, interests, and other professional details you share. This profile is used to find relevant matches.

This is profiling under Article 4(4) GDPR — automated processing of personal data to evaluate certain personal aspects, particularly professional situation, interests, and behavior.

10.2 Automated decision-making

Heyli’s matchmaking uses automated processing (semantic similarity search and AI ranking, see Section 5.2) to suggest potential connections. However:

  • No contact details are shared without your explicit approval. You always see the suggestion first and decide whether to proceed.
  • The AI does not make binding decisions. It only suggests. In a community, a community manager (a human) approves requests and picks manager introductions, and then you decide.
  • You can request human review of any match decision by emailing support@meetheyli.com.

Because you retain full control over whether an introduction proceeds, we believe this does not constitute “solely automated decision-making” under Article 22 GDPR. Nevertheless, we provide the Article 22 safeguards (human review, right to contest) as a precautionary measure.

11. Cookies, tracking technologies, and website behavior analysis

11.1 WhatsApp conversations

When you interact with Heyli via WhatsApp, no cookies are used. WhatsApp is a separate application with its own privacy policy (managed by Meta). We do not set any cookies on your device through WhatsApp.

11.2 What are cookies?

Cookies are small text files stored on your device by your web browser when you visit a website. They allow the website to remember your actions and preferences. Other tracking technologies (pixels, tags, local storage) work similarly — they collect information about how you interact with a website.

Under the ePrivacy Directive (2002/58/EC) and GDPR, we are required to obtain your consent before placing any cookies on your device that are not strictly necessary for the functioning of the website.

11.3 What information do we collect on the website?

When you visit meetheyli.com, our tracking tools may collect the following information (only after you give consent):

  • Your operating system and web browser type and version
  • Pages you viewed and time spent on each page
  • Transitions between individual pages
  • The website or source from which you arrived (referrer)
  • Clicks on individual links and buttons
  • Scroll depth on each page
  • Mouse movements and hover behavior
  • Your approximate location (limited to city level, based on IP)
  • Your device type (desktop, mobile, tablet)
  • Screen resolution
  • Your approximate age range and gender (via Google Analytics demographics, if enabled)
  • Your interests and preferences (inferred by Google based on your online activity)

Session recordings and heatmaps: We may use PostHog’s session recording and heatmap features to record visual replays of how visitors interact with our website. This may include recordings of mouse movements, clicks, scrolls, and page navigation. Session recordings help us understand how users experience our website and identify areas for improvement.

  • Session recordings do not capture any text you type into forms (input fields are masked)
  • Session recordings are only accessible to authorized Heyli team members
  • Recordings are stored on PostHog’s EU servers and deleted according to our retention policy

We consider all of the above to be potentially personal data (in line with strict CJEU jurisprudence) and treat it accordingly — it is only collected after you give your consent.

Essential cookies: We use one strictly necessary cookie, cc_cookie (first-party, set by Heyli). It remembers your cookie choice, so we do not ask again on every visit. It lasts 6 months. It holds only the categories you chose, the date, and a random consent ID. Our website does not require session management or login.

Analytics cookies (require your consent):

Cookie Provider Type Purpose Duration
_ga Google Analytics Third-party Distinguishes unique visitors 2 years
_ga_* Google Analytics Third-party Maintains session state 2 years
_gid Google Analytics Third-party Distinguishes visitors (24h) 24 hours
ph_* PostHog First-party Identifies returning visitors, tracks page interactions 1 year
  • Google Analytics — Collects anonymous website usage data (page views, traffic sources, user journeys, demographics). Google acts as a processor. Data is processed on Google servers. IP anonymization is enabled. For details: Google’s Privacy Policy.
  • PostHog — Product analytics hosted in the EU (eu.i.posthog.com). Tracks page views, button clicks, redirect events, and may record user sessions. For details: PostHog’s Privacy Policy.

Marketing cookies and pixels (require your consent):

Cookie / pixel Provider Type Purpose Duration
_fbp Meta Pixel Third-party Identifies browsers for ad targeting 90 days
_fbc Meta Pixel Third-party Stores click identifier from Facebook ads 90 days
li_sugr LinkedIn Insight Third-party Browser identifier for LinkedIn ad matching 90 days
bcookie LinkedIn Insight Third-party Browser ID for LinkedIn functionality 2 years
UserMatchHistory LinkedIn Insight Third-party LinkedIn ad conversion tracking 30 days
  • Meta Pixel (Facebook/Instagram) — Measures the effectiveness of our social media campaigns on Meta platforms. Sends data to Meta for ad targeting and conversion tracking. For details: Meta’s Data Policy.
  • LinkedIn Insight Tag — Measures the effectiveness of our LinkedIn campaigns. Sends data to LinkedIn for ad targeting and conversion tracking. For details: LinkedIn’s Privacy Policy.

Legal basis per category:

Category Legal basis GDPR Article
Essential (cc_cookie) Necessary to store your consent choice Art. 6(1)(c) with Art. 7(1)
Analytics Your consent Art. 6(1)(a)
Marketing Your consent Art. 6(1)(a)
Session recordings Your consent Art. 6(1)(a)

When you first visit meetheyli.com, you will see a cookie consent banner that allows you to:

  • Accept all — enable all analytics and marketing cookies
  • Reject all — only the essential cookie that remembers your choice (cc_cookie)
  • Customize — choose which categories to enable (analytics, marketing, or both)

Your consent choice is stored in a cookie on your device so we can remember your preference on subsequent visits. You can change your consent at any time by clicking the cookie settings link in the website footer.

11.6 What happens if you decline cookies?

If you decline all optional cookies:

  • No analytics or marketing cookies will be placed on your device
  • No session recordings will be made
  • No data will be sent to Google Analytics, PostHog, Meta, or LinkedIn
  • The website will function normally — you can view all pages and content without any limitation
  • QR code redirects will still work (server-side, no cookies involved)

11.7 QR code tracking

When you scan a QR code at an event, association, or coworking space, you are redirected through our server, which records the redirect event (tracking code, timestamp, device type). This data is anonymized — it is not linked to your identity unless you subsequently message Heyli on WhatsApp. QR code tracking is server-side and does not use cookies.

11.8 Managing your preferences

You can manage cookies through:

11.9 Behavioral advertising

Marketing cookies (Meta Pixel, LinkedIn Insight Tag) may enable behavioral advertising — this means that based on your interactions with our website, you may see personalized Heyli advertisements when browsing other websites and social media platforms (such as Facebook, Instagram, or LinkedIn). These ads are targeted based on your prior activity on meetheyli.com (e.g., pages viewed, buttons clicked), not on the content of your Heyli conversations.

You can manage behavioral advertising preferences through:

11.10 “Do Not Track” signals

Some browsers offer a “Do Not Track” (DNT) signal. There is currently no universal standard for how websites should respond to DNT signals. We treat DNT signals as equivalent to declining optional cookies — if your browser sends a DNT signal, we will not activate analytics or marketing cookies without your explicit consent through our cookie banner.

The cookies set by third-party providers are governed by their own privacy policies. These providers are independent controllers for the data they collect through their cookies, and they may use this data to provide and improve their services, manage advertising, and personalize content across their platforms. We have no control over how third-party providers use the data collected through their cookies beyond our website.

For full details, refer to their privacy policies:

12. Social media profiles

We maintain profiles on social media platforms to promote Heyli and communicate with our community. In accordance with the case law of the Court of Justice of the European Union (cases C-210/16 Wirtschaftsakademie and C-40/17 Fashion ID), the social media platform provider is a joint controller of personal data together with the administrator of a given profile.

This means that when you visit or interact with our social media profiles, both we and the platform provider are responsible for the processing of your personal data. The platform provider typically handles the technical processing (cookies, analytics, ad targeting), while we are responsible for the content we publish and messages we receive.

Our social media profiles:

Platform Our profile Platform privacy policy
LinkedIn [Heyli on LinkedIn] LinkedIn Privacy Policy
Instagram [Heyli on Instagram] Instagram/Meta Data Policy
Facebook [Heyli on Facebook] Meta Data Policy
TikTok [Heyli on TikTok] TikTok Privacy Policy

What we process from social media:

  • Messages (DMs): If you contact us via private message on any social media platform, we process the personal data contained in your correspondence (your name, profile image, and message content). Messages are archived using the tools available on each platform and remain accessible to us until you delete them.
  • Public interactions: If you follow our profiles, like, comment on, or share our content, we see the publicly available data on your social profile. We process this data only within the given social network for the purpose of operating our profile.
  • Aggregated statistics: We access anonymous, aggregated audience statistics provided by the platform (demographics, reach, engagement).
  • Initiating contact: We may occasionally reach out to you via social media to offer collaboration or networking opportunities. In this case, your publicly available profile data is processed for the purpose of searching for potential contacts.

What the platform processes: Each platform sets its own cookies and tracking technologies when you visit our profile. We have no control over this processing. Your use of social media platforms is subject to the regulations and privacy policies of those platforms, and they provide their services to you independently of us. For details, please refer to their privacy policies linked above.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) — maintaining an online presence to communicate with users and potential users. For processing performed by the platform, the platform’s own legal basis applies.

13. How do we protect your data?

We take the security of your data seriously. Here are the measures we implement:

13.1 Technical safeguards

  • Encryption in transit: All data is transmitted over HTTPS with TLS encryption. We enforce HSTS (HTTP Strict Transport Security) with a 1-year policy.
  • Encryption at rest: All databases use encryption at rest (AES-256 or equivalent).
  • Access control: All database tables use Row Level Security (RLS). No anonymous access is possible. Production credentials are stored in Google Cloud Secret Manager.
  • PII pseudonymization: Phone numbers and personal identifiers are hashed using HMAC-SHA256 before appearing in any logs.
  • Webhook security: 6-layer validation (signature verification, payload validation, timestamp check, deduplication, audit logging, processing).
  • Prompt injection protection: Multi-layer defense against AI manipulation attempts, including input detection, output validation, and boundary markers.
  • Rate limiting: Distributed rate limiting on all public endpoints to prevent abuse.
  • Security headers: Content Security Policy (CSP) with nonce-based script loading, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

13.2 Organizational safeguards

  • EU-first architecture: All primary services hosted in the EU.
  • Data minimization: We collect only what is necessary for each processing purpose.
  • Fail-closed consent: If the consent system encounters an error, it defaults to “no consent” — never to “yes.”
  • Regular security audits: We conduct security assessments including OWASP Top 10 and OWASP LLM Top 10 compliance reviews.
  • Incident response: We maintain a breach response procedure (see Section 13.3).

13.3 Data breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms:

  • We will notify the supervisory authority (UODO) within 72 hours of becoming aware of the breach (Article 33 GDPR).
  • If the breach poses a high risk to you, we will notify you without undue delay (Article 34 GDPR), informing you of:
    • The nature of the breach
    • Likely consequences
    • Measures taken to address the breach
    • How you can protect yourself

14. Children’s data

Heyli is a professional networking service intended for adults. You must be at least 18 years old to use Heyli.

We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a person under 18, we will delete it immediately.

If you believe a minor has provided data to Heyli, please contact us at support@meetheyli.com.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time — for example, due to changes in law, new features, or updated data processing practices.

How we notify you:

  • If you are an active Heyli user, we will inform you of material changes via email.
  • The updated policy will be published at meetheyli.com/privacy.
  • Changes take effect 14 days after notification, unless a longer period is required by law.

What if you disagree: If you do not agree with the changes, you can withdraw your consent and request data deletion at any time (see Section 9).

16. How to file a complaint

If you believe we are processing your personal data in violation of the GDPR, you have the right to lodge a complaint with a supervisory authority.

Your supervisory authority:

Prezes Urzędu Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa, Poland Website: https://uodo.gov.pl Email: kancelaria@uodo.gov.pl Phone: +48 22 531 03 00

You can also file a complaint with the data protection authority in the EU Member State where you live, work, or where the alleged violation occurred.

We prefer to resolve issues directly. Before filing a formal complaint, please contact us at support@meetheyli.com — we take every concern seriously and will work to resolve it promptly.

17. How can you manage your privacy?

We know this is a long document. For your convenience, here is a consolidated list of all the ways you can manage your privacy when using Heyli:

Your data rights (see Section 9 for details):

Cookie and tracking management (see Section 11 for details):

  • Cookie consent banner on meetheyli.com — accept, reject, or customize
  • Change your cookie preferences anytime via the cookie settings link in the website footer
  • Browser cookie settings: Chrome | Firefox | Safari | Edge
  • Browser extensions: Ghostery, uBlock Origin, Privacy Badger
  • Incognito / private browsing mode in your browser

Platform-specific opt-outs:

Advertising audiences:

Consent withdrawal:

  • You can withdraw your consent at any time — this will not affect the lawfulness of processing that happened before withdrawal

18. United States residents

If you are a resident of the United States, you may have additional privacy rights under state laws such as the California Consumer Privacy Act (CCPA/CPRA) or similar legislation in other states. We are committed to honoring those rights. In particular, we do not sell your personal information for monetary consideration. To exercise any privacy right — including access, deletion, correction, or opting out of targeted advertising — please email support@meetheyli.com. We will respond within 45 days.

19. Is there anything else you should know?

As you can see, the subject of personal data processing, cookies, and privacy in general is quite complex. We have made every effort to ensure that this document gives you clear and comprehensive information about how we handle your data.

If anything is unclear, if you want to learn more, or if you simply want to talk about your privacy — please write to us at support@meetheyli.com. We take your privacy seriously and are happy to answer any questions.

This Privacy Policy is effective as of November 8, 2026. Previous versions: October 20, 2026 (first publication).