Privacy Policy

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have. It applies to account holders, Authorised Users, and visitors to engage@heddl.app and heddl.app.

1. Who We Are

Heddl Technology Private Limited is the data controller responsible for personal data collected through the Platform. Registered address: Bengaluru, Karnataka, India.

Privacy contact: engage@heddl.app

Where you submit personal data of your own contacts or prospects to the Platform, you act as the data controller for that data and Heddl acts as a data processor on your behalf. A Data Processing Agreement (DPA) is available on request at engage@heddl.app.

2. Personal Data We Collect

2.1 Data You Provide Directly

• Account information: name, email address, company name, job title, and password.
• Billing information: payment card details and billing address, processed securely through our third-party payment provider. Heddl does not store full card numbers.
• Profile information: any additional details you choose to add to your account profile.
• Communications: messages or enquiries you send to our support or sales team.
• Content: outreach sequences, message templates, and other content you create or upload on the Platform.
• Contact data: names, email addresses, LinkedIn profile URLs, phone numbers, or other details of prospects or contacts you upload or sync to the Platform.

2.2 Data We Collect Automatically

• Usage data: features accessed, actions taken, credits used, sequence performance, and activity logs.
• Device and technical data: IP address, browser type and version, operating system, device identifiers, and time zone.
• Log data: access times, pages visited, errors encountered, and referring URLs.
• Cookies and similar technologies: as described in Section 9 below.

2.3 Data from Third-Party Integrations

• LinkedIn: profile information, connection data, and message history relevant to your outreach activities.
• Email providers: sent and received message metadata, delivery and open/click events where tracked.
• WhatsApp: message status and delivery data associated with outreach activities.
• CRM and other tools: contact records and pipeline data from any CRM or tool you choose to integrate.

Data received from Third-Party Channels is governed by the terms and privacy policies of those services. You are responsible for ensuring you have the right to share that data with Heddl.

2.4 Data About Your Contacts and Prospects

You may upload or sync personal data of third parties (your prospects, leads, or customers) to the Platform. This data is used solely to enable the outreach features you configure. You are the data controller for this data and must ensure you have a lawful basis for processing it.

3. How We Use Your Personal Data

3.1 To Provide and Operate the Platform

• Creating and managing your account.
• Processing credit purchases and maintaining credit balances.
• Enabling outreach workflows, AI features, and integrations you configure.
• Delivering platform notifications and activity summaries.

3.2 To Improve and Develop the Platform

• Analysing usage patterns to improve existing features and develop new ones.
• Training and improving our AI models using anonymised and aggregated data. We do not use your personally identifiable Content or your contacts' personal data to train AI models without your explicit consent.
• Conducting internal research and analytics on Platform performance.

3.3 To Communicate with You

• Responding to support requests and enquiries.
• Sending transactional messages such as credit purchase confirmations, account alerts, and security notifications.
• Sending product updates, feature announcements, and occasional marketing communications where you have opted in. You may opt out at any time.

3.4 To Ensure Security and Compliance

• Detecting, investigating, and preventing fraud, abuse, and security incidents.
• Enforcing our Terms and Conditions and Acceptable Use Policy.
• Complying with applicable legal obligations, court orders, and regulatory requirements.

3.5 Lawful Bases for Processing (GDPR and Equivalent Frameworks)

• Contract: processing necessary to provide the Platform and fulfil our agreement with you.
• Legitimate interests: improving the Platform, ensuring security, and sending relevant product communications.
• Legal obligation: complying with applicable laws and regulations.
• Consent: where we ask for your consent. You may withdraw consent at any time.

4. AI Features and Your Data

• We process Content you provide to generate AI Outputs.
• We use anonymised, aggregated interaction data to improve AI model performance.
• We do not use your personally identifiable Content or your contacts' personal data to train AI models without your explicit consent.
• AI Outputs are generated by automated means. You remain responsible for reviewing all AI-generated content before it is sent.

To opt out of your anonymised usage data being used for AI model improvement, contact engage@heddl.app.

5. How We Share Personal Data

We do not sell your personal data. We share it only in the following circumstances:

5.1 Service Providers

Trusted third-party service providers (cloud hosting, payment processors, email delivery, analytics, customer support) process data only on our instructions and are contractually bound to protect it.

5.2 Third-Party Integrations You Authorise

When you connect the Platform to Third-Party Channels, relevant data is shared with those services to enable the features you have configured.

5.3 Business Transfers

If Heddl undergoes a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify you of any such change.

5.4 Legal Requirements

We may disclose personal data where required by law, regulation, or court order.

5.5 With Your Consent

We may share personal data where you have given explicit consent.

6. International Data Transfers

Heddl is based in India. Where data is transferred from the EEA, UK, or other jurisdictions with transfer restrictions, we ensure appropriate safeguards (Standard Contractual Clauses or equivalent) are in place. Contact engage@heddl.app for details.

7. Data Retention

• Account data: retained for the duration of your account and up to 3 years after closure.
• Contact and outreach data: available to export for 30 days after closure, then deleted.
• Usage and log data: retained for up to 12 months.
• Payment records: retained for up to 7 years for financial and tax obligations.
• Support communications: retained for up to 2 years after resolution.

8. Your Privacy Rights

• Access: request a copy of the personal data we hold about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: request deletion of your personal data, subject to legal retention requirements.
• Restriction: ask us to pause processing your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests or direct marketing.
• Withdrawal of consent: withdraw consent at any time without affecting prior processing.
• Complaint: lodge a complaint with your local data protection authority.

Contact engage@heddl.app to exercise any of these rights. We will respond within 30 days.

9. Cookies and Tracking Technologies

• Essential cookies: necessary for the Platform to function. Cannot be disabled.
• Analytics cookies: help us understand usage using anonymised data only.
• Preference cookies: remember your settings and customisations.

Manage preferences through our cookie banner, your browser settings, or by contacting engage@heddl.app.

10. Security

We implement industry-standard measures including encryption in transit and at rest, access controls, regular security assessments, and staff training. You are responsible for keeping your account credentials secure. In the event of a personal data breach likely to result in high risk, we will notify you and the relevant supervisory authority as required by law.

11. Children's Privacy

The Platform is for business use by individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. Contact engage@heddl.app if you believe we have inadvertently done so.

12. Third-Party Links and Services

This policy does not apply to third-party websites or services linked from the Platform. Heddl is not responsible for the privacy practices of third parties.

13. Compliance with Indian Data Protection Law

Heddl complies with the Digital Personal Data Protection Act, 2023 (DPDPA). Under the DPDPA:

• We process personal data only for lawful purposes with consent or other valid grounds.
• We take reasonable steps to ensure accuracy and completeness of personal data.
• You have the right to access, correct, and withdraw consent for your data.
• You may nominate a person to exercise privacy rights on your behalf.
• We will not process personal data of children without verifiable parental consent.

14. Changes to This Policy

Where changes are material, we will notify you by email or via a prominent notice at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.

15. Contact and Complaints