Last updated October 2026

Privacy policy

Hey Tomo ("we") provides AI employees, campaigns and customer engagement tools to businesses. This page explains what we collect on this website, what we hold for a business that uses the product, and how we handle the data of that business's customers. To delete your data, see Delete your data.

On this website

When you fill in the early-access form, we keep your name, business, WhatsApp number, email and message, and use them only to contact you about Hey Tomo.
Questions you type into the "Ask Tomo" chat are sent to an AI service to answer them. Please don't share personal or payment details there.
We save your light or dark theme choice in your browser. We use no advertising trackers.

Your business account

To run a workspace we keep your name, email, phone number, business name and address, the team members you invite and their roles, your sign-in records, and the time you accepted the Terms.
Billing records (wallet top-ups, invoices and credit notes) are kept for as long as Indian tax law requires. Card and bank details are entered on the payment gateway's own page and never reach our servers.
We send account emails such as sign-in codes, receipts and security notices. Product news is sent only if you opt in, and every such email has an unsubscribe link.

Your customers' data

Your business is the data fiduciary for its customers' data. We act as your data processor under a data processing agreement, and only on your instructions.
You bring customer profiles (name, phone, email, city, tags), events from your app or website, purchase and visit history, and the knowledge you upload. We use this data only to run your journeys, campaigns, AI employees, inbox and reports.
We never sell customer data, never use it for our own advertising, and never combine one business's customers with another's.
Consent is checked before every message and again at the moment of sending. People under 18 never receive marketing. A person can stop messages by replying "stop" in any language, and that choice is kept so they are not contacted again.

WhatsApp, Instagram and Facebook

Hey Tomo connects to WhatsApp, Instagram and Facebook only through their official business platform interfaces, with the permissions you grant when you connect a channel. We use no unofficial tools, scraping or bots.
From those platforms we receive and store what is needed to run your channel: messages and comments sent to your business and their sender's name and platform identifier, the replies your business sends, delivery and read status, your page or account name and identifier, and your approved message templates.
This platform data is used only to show the conversation in your inbox, let your AI employees and team reply, run your journeys and campaigns, and report results to you. It is not used to build profiles across businesses, not shared with third parties except as needed to deliver the service, and not used for our own marketing.
Platform data is deleted when you disconnect the channel, when you delete your workspace, or when the platform tells us that a person or page removed Hey Tomo's access. Deletion completes within 30 days. See Delete your data.
We follow the platforms' policies for business messaging, including opt-in before business-initiated messages and marking every AI employee as an AI assistant.

In the product, and the DPDP Act

We process personal data under India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Data is stored in India.
Files are encrypted, stored under your workspace only, and opened through short-lived links.
Raw files are deleted after 90 days by default. You can change this, and a "Delete everything" button removes all your data.
Aadhaar numbers are masked to the last 4 digits as soon as they are read. PAN is shown only in part.
We never ask for passwords to other services, card or bank details, or biometric data. Health or other sensitive fields that a business marks "Personal" are collected only with the person's permission, are partly hidden from staff, and are never sent to an AI model. You may decline to give such data, and withdraw your permission at any time.
We notify you of a personal data breach without delay, and help you notify the Data Protection Board and the people affected.

How long we keep data

Customer events and messages are kept for the retention period you set in Settings. Raw files go after 90 days by default.
Consent records, opt-outs, suppression lists and audit records are kept for as long as the law requires, so that a person who asked not to be contacted stays uncontacted.
When you delete your workspace, its data is removed from live systems at once and from backups within 30 days. Billing records stay for the statutory period.

Cloud hosting in India, where the product and its database run.
Messaging and email delivery providers, who receive only what is needed to deliver a message you send.
AI model providers, who receive the text needed to answer or draft a message and do not train on your data.
Payment gateways, who handle your top-ups and plan payments.
Authorities, when the law requires it. We never sell data.

Security

Data is encrypted in transit and at rest. Channel keys are stored encrypted and are never returned to a browser. Access inside Hey Tomo is limited by role, and every sensitive action is logged. The dashboard offers optional two-step sign-in, and the owner can require it for the whole team.

Children

Hey Tomo accounts are for businesses and their adult staff. A business's customers under 18 never receive marketing from Hey Tomo, and reminders for them can be routed to a parent or guardian.

Your rights

You can ask to see, correct or delete your personal data, withdraw consent, and nominate someone to act for you. Write to [email protected], or see Delete your data.
If you are a customer of a business that uses Hey Tomo, we will pass your request to that business and act on its instructions within 30 days. You can stop messages at any time by replying "stop" in any language or using the link in the message.
We acknowledge every request within 48 hours and resolve it within 30 days.
If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Why we are allowed to use data

To run your account and the service: because we have a contract with your business.
Product news, and analytics or marketing cookies: only with your consent, which you can withdraw at any time.
Invoices, tax records and security logs: because the law requires us to keep them.
Keeping sign-in and the service secure: our legitimate interest in protecting you and other businesses.
A business's customers: the business decides the basis (usually consent for marketing, and the order or booking for updates); we act only on its instructions.

Security logs

As India's cyber security directions require, we keep security logs (sign-ins, refusals, exports, erasures and other sensitive actions, with times and network addresses but never message content) in India for at least 180 days, and for at least a year under the DPDP Rules. We report cyber security incidents to CERT-In within 6 hours of noticing them.

Data outside India

The product and its database run in India. Some messaging, email, push and AI services we use process data in other countries, only to deliver the message or answer you asked for. For people in the European Union and the United Kingdom, those transfers are covered by the European Commission's Standard Contractual Clauses (and the UK addendum) in our data processing agreement, with encryption, access controls and other safeguards.

If you are in the European Union or the United Kingdom

You have the right to access, correct, export, restrict and delete your data, and to object to its use. You can object to marketing at any time, and it stops at once. We answer within 30 days.
You can complain to the data protection authority where you live or work.
If we have a personal data breach that affects you, the business you deal with is told without undue delay, so it can tell its authority within 72 hours and tell you when the risk to you is high.

If you are in the United States (California)

We do not sell or share personal information, and we do not use it for cross-context behavioural advertising. Because of this, there is nothing to opt out of; if you send a Global Privacy Control signal, the website honours it anyway and keeps marketing cookies off.
For a business's customers we are a service provider: we use their personal information only to provide the service to that business, and never combine it with other data.
You can ask to know what we hold about you (including in the last 12 months), and to correct or delete it. We verify the request from the email or phone number on record and answer within 30 days. We never treat you differently for asking.

If you are in Canada

Messages that promote something are sent only with your express consent, or implied consent that the law limits in time (24 months after a purchase, 6 months after an enquiry), after which they stop unless you say yes again. Every such message names the sender, gives a way to reach them and has a free unsubscribe that works for at least 60 days and takes effect at once. If a breach puts you at real risk of significant harm, you and the Privacy Commissioner of Canada are told, and every breach is recorded and kept for at least 24 months.

Cookies

The website uses essential cookies and similar browser storage to run: to keep you signed in, keep sign-in secure and remember your theme. These are always on.

Analytics cookies, which count visits so we can improve the site, and marketing cookies, which measure our ads on other sites, are used only if you allow them. Today the website loads no analytics or marketing scripts at all.

You can change your choice at any time with "Cookie settings" at the bottom of the home page. Your choice is stored in your browser with the date you made it. "Essential only" is as easy to choose as "Accept all", and if your browser sends a Global Privacy Control signal, marketing cookies stay off whatever you choose.

When you sign in to your business account, we use a salted hash of a small set of browser signals to recognise new devices, protect the two-step sign-in check and limit repeated sign-ups. We store the hash, not the original browser signals. A random security seed stays in your browser; a remembered two-step device expires after 30 days. We do not use this device check to fingerprint your business’s customers or for advertising. Sign-in records and your required Terms acceptance time are kept with your account; product-news consent is optional.

Changes to this policy

When this policy changes, the date at the top changes and business owners are told by email before the change takes effect.

Contact and grievance officer

Write to [email protected] to see, correct or delete your data, or to reach our grievance officer; Delete your data explains deletion step by step, including data linked to Facebook and Instagram. We acknowledge every request within 48 hours and resolve it within 30 days.

Grievance officer: [email protected]
Business: Hey Tomo, Davanagere, Karnataka, India

Under the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023, this officer handles complaints about how we process personal data. How we meet each privacy and messaging law we follow is set out on our Compliance page.