Privacy Policy

HeyYa is an AI video and image generation workspace operated at heyalam.com.

For privacy, account, billing, abuse, or customer support requests, contact support@heyalam.com. Copyright notices should be sent to dmca@heyalam.com.

We collect account email, authentication identifiers, billing status, subscription and credit balance records, payment status, invoices or checkout identifiers, IP address, device and browser signals, fraud and abuse signals, support requests, and account preferences.

When you use generation features, we process prompts, uploaded files, reference media, generated outputs, generation metadata, model selections, moderation results, job status, download activity, and feedback you submit.

We do not store passwords. Authentication is handled through OAuth and magic-link flows provided by our authentication provider.

We use personal data to create and secure accounts, provide AI generation and media storage, process payments, deliver credits and subscriptions, prevent fraud and policy abuse, respond to customer support requests, send service notices, comply with legal obligations, and improve reliability.

Our legal basis includes performance of a contract with you, legitimate interests in operating and securing the service, compliance with legal duties, and consent where a specific feature or law requires it.

Payments are processed by our payment processor. HeyYa receives checkout, subscription, invoice, customer, payment status, refund, chargeback, and credit entitlement records needed to operate paid plans and credit packs.

We do not intentionally store full card numbers or payment card security codes on HeyYa servers.

We share data with service providers only as needed to operate HeyYa, including Supabase for authentication and database services, Cloudflare R2 for media storage, payment processors for checkout and billing, generation providers for AI media processing, moderation providers, analytics, hosting, logging, and monitoring tools.

Generation providers may receive prompts, uploaded media, reference media, and generation settings so they can create requested outputs. Payment processors may receive account and transaction information so they can complete checkout and manage subscriptions.

We may disclose information when required by law, to protect users and the service, to investigate abuse or fraud, or in connection with a business transfer.

We retain account, billing, support, and transaction records for as long as needed to provide the service, resolve disputes, prevent fraud, comply with legal and tax obligations, and maintain accurate credit ledgers.

Uploaded and generated media is retained for account history, downloads, security, abuse prevention, and legal requests. We may delete or expire files when they are no longer needed, when you delete them, or when your account is deleted subject to legal retention requirements.

You may request access, correction, export, restriction, objection, or deletion of personal data by contacting support@heyalam.com.

You can request account deletion from the footer or account settings. Manual account deletion requests are reviewed within 30 days, and some records may be retained when required for billing, security, fraud prevention, dispute handling, or legal compliance.

We use access controls, encrypted transport, provider-level security controls, logging, and abuse monitoring to protect account and generation data.

No online service can guarantee absolute security, so you should use a secure email account and contact us promptly if you believe your account or data has been compromised.

HeyYa is not directed to children under 13, and we do not knowingly collect personal data from children under 13.

If you believe a child has provided personal data to HeyYa, contact support@heyalam.com so we can review and delete the information when appropriate.

HeyYa and its providers may process information in countries other than where you live. We use service providers that help us operate a global web service and protect data during transfer and processing.

We may update this Privacy Policy as the product, providers, laws, or security practices change. Material updates will be reflected by a new effective date on this page.