HeyAssi

Privacy Policy

Last updated: July 12, 2026

1. Who we are

HeyAssi ("we", "us", "the Service") is operated by ko group L.L.C-FZ, who acts as the data controller for personal data processed through the Service. HeyAssi is a personal assistant for tasks, reminders, lists, and calendar events that you control through WhatsApp, Telegram, and a calm web app. The Service is accessible through the web app and through the WhatsApp and Telegram messaging channels.

2. Information we collect

  • Account information: your email address and display name, provided either through Google Sign-In or email/password registration.
  • Content you create: lists, list items, reminders, notes, and calendar events you add or sync.
  • Messages: the text of messages you send to our Telegram or WhatsApp bots, used solely to fulfill your request.
  • Google Calendar and Google Tasks data: if you connect Google, we read and write calendar events on your behalf and, when you grant Tasks access, we may read, create, update, complete, reopen, and delete tasks and synchronize task lists you ask HeyAssi to manage.
  • Technical data: minimal session cookies, authentication tokens, and standard server logs needed to operate and secure the Service.

3. Google API Services and Limited Use

HeyAssi uses Google APIs to provide sign-in, calendar functionality, and Google Tasks synchronization features. When you choose to connect your Google account, we request the following OAuth scopes:

  • https://www.googleapis.com/auth/userinfo.email — to identify your account.
  • https://www.googleapis.com/auth/userinfo.profile — to display your name and avatar.
  • openid — standard OpenID Connect sign-in.
  • https://www.googleapis.com/auth/calendar.calendarlist.readonly — to list your calendars so you can pick which one HeyAssi manages.
  • https://www.googleapis.com/auth/calendar.events — to create, update, or delete events that you ask HeyAssi to manage. HeyAssi does not read or modify calendar metadata outside the events it manages on your behalf.
  • https://www.googleapis.com/auth/tasks — only when you connect Google Tasks, to read, create, update, complete, reopen, and delete your tasks and synchronize task lists that you ask HeyAssi to manage.

Google integrations (Google Calendar and Google Tasks) are optional. We only request the scopes needed for functionality you have asked us to provide, and our access is limited to that functionality. You may revoke HeyAssi's access at any time through your Google account permissions (see Section 7), and we will stop accessing the corresponding Google data.

HeyAssi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained from Google APIs is never used to develop, improve, or train generalized AI or machine learning models, is never sold, is never used or transferred for advertising purposes, and is never read by humans except (a) with your explicit consent, (b) for security purposes such as investigating abuse, or (c) to comply with applicable law.

4. How we use your information

  • To provide, maintain, and improve the Service for you.
  • To process your natural-language requests through our AI provider in order to create lists, reminders, and calendar events on your behalf.
  • To send you reminders you have scheduled.
  • To secure your account and prevent abuse.

We do not sell your personal data. We do not share it with third parties for advertising. We do not use your private content to train AI models.

4a. Legal basis for processing (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, we rely on the following legal bases to process your personal data:

  • Performance of a contract — to create and operate your account, deliver the Service you signed up for, process your natural-language requests, send reminders you have scheduled, and fulfil paid subscriptions.
  • Legitimate interests — to keep the Service secure, prevent fraud and abuse, debug errors, and improve reliability. We balance these interests against your rights.
  • Consent — for optional integrations such as Google Calendar and Google Tasks, granted through Google's OAuth consent flow. You may withdraw consent at any time.
  • Legal obligation — for tax, accounting, and regulatory record-keeping where applicable.

5. Sub-processors

We rely on a small set of trusted infrastructure providers to operate the Service:

  • Lovable Cloud (Supabase) — database, auth, and file storage.
  • Lovable AI Gateway — large language model inference for parsing your messages.
  • Google APIs — Google Sign-In, Google Calendar, and Google Tasks (only when you connect them).
  • WhatsApp Business Platform (Meta) — to receive and send messages through our WhatsApp bot, when you choose to use WhatsApp. Message metadata and content pass through Meta's infrastructure subject to WhatsApp's own terms and privacy policy.
  • Telegram Bot API — to receive and send messages on your bot, when you choose to use Telegram.
  • Stripe — payment processing for subscriptions. We do not store your full card details on our servers; Stripe processes and stores payment credentials as an independent controller subject to its own privacy policy.

5a. International data transfers

Our sub-processors operate globally, which means your personal data may be stored or processed outside your country of residence, including in the United States and European Economic Area. Where such transfers are subject to GDPR or UK GDPR, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and equivalent mechanisms adopted by our sub-processors.

6. Storage, security, and retention

Your data is stored in Lovable Cloud (Supabase) with row-level security policies that restrict access to your own account. Connections to the Service use HTTPS.

We retain data as follows:

  • Account and content (lists, reminders, tasks, calendar events, messages) — for as long as your account is active. When you delete an item, or your account, the data is removed from active systems within a reasonable period, and from backups within a further limited period as backups roll over.
  • Server and security logs — retained for a limited period (typically up to 90 days) for debugging, abuse prevention, and security investigation, then deleted or aggregated.
  • Billing and tax records — retained by us and by Stripe for as long as required by applicable tax and accounting laws, even after account deletion.
  • Google API data — cached only as needed to fulfil your requests; deleted or invalidated when you disconnect Google or delete your account.

6a. Automated decisions

We use AI to interpret your natural-language requests and to draft assistant replies. These are not decisions that produce legal or similarly significant effects on you; you remain in control and can review, edit, undo, or ignore anything the assistant proposes. We do not perform automated profiling for advertising or eligibility decisions.

7. Your rights and choices

  • Access and export: you can view and export your data from within the app.
  • Delete: you can delete individual items in the app or request full account deletion. See our User Data Deletion page for step-by-step instructions, or email us directly.
  • Revoke Google access: at any time, visit https://myaccount.google.com/permissions to disconnect HeyAssi from your Google account.

Where GDPR, UK GDPR, or similar laws apply, you also have the right to:

  • Rectify inaccurate personal data.
  • Object to processing based on our legitimate interests.
  • Restrict processing in specific circumstances.
  • Data portability — receive your data in a common machine-readable format.
  • Withdraw consent at any time for optional integrations, without affecting the lawfulness of prior processing.
  • Lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@heyassi.biz. We will respond within the timeframes required by applicable law.

8. Cookies

We use only the cookies necessary to keep you signed in. We do not use third-party advertising or tracking cookies.

9. Children

The Service is not directed to children under 13. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the latest revision.

11. Contact

For privacy questions, account deletion requests, or data inquiries, please email support@heyassi.biz.