Privacy Policy

There are two distinct categories of data handled in connection with the Service:

• Customer Account & Identity Data: Information about you as our registered user (name, email, organization name, billing identifiers). For this data, Heyo Infra acts as the data controller.
• Provisioned Infrastructure & Technical Metadata: Configuration settings for your connected Azure subscriptions, custom domain names, DNS records, and generated mailbox credentials. For this data, you are the controller and Heyo Infra acts strictly as a technical processor and service provider on your instructions.

Information You Provide to Us Directly:

• Account details (name, email address, organization name) via our authentication provider (Clerk);
• Billing and subscription details (processed securely by Stripe; we do not store raw payment card data);
• Custom domain names you register or link to the Service for automated DNS configuration;
• First and last names or aliases used for mailbox generation rosters.

Information Collected via Third-Party Integrations:

• Microsoft Azure OAuth 2.0: When you connect your Microsoft Azure account via delegated OAuth consent, we receive an authorized access token and refresh token scoped strictly to Azure Resource Manager (https://management.azure.com/user_impersonation). All tokens are stored with AES-256-GCM symmetric encryption at rest and used solely to query subscription IDs and provision Azure Communication Services email domains.
• Cloudflare DNS: Cloudflare Zone IDs, DNS record IDs, and verification tokens generated during SPF, DKIM, and DMARC verification.

We use the information we collect solely to:

• Provision, configure, and automate sending domain infrastructure and DNS verification;
• Generate, organize, and export cold email mailbox credentials for external senders (Heyo Email, Smartlead, Instantly, Apollo);
• Process recurring subscription billing and mailbox quota enforcement;
• Monitor network safety, detect anomalous abuse, and enforce Microsoft Azure Acceptable Use Policy compliance;
• Provide customer support and technical troubleshooting;
• Comply with applicable legal requirements.

We do NOT sell, rent, or monetize your account details, domain rosters, or mailbox credentials to third parties for advertising or any other purpose.

We share information with trusted third-party service providers bound by strict confidentiality and security requirements:

• Clerk: User authentication, session management, and identity verification.
• Stripe: Payment processing, customer portal, and subscription management.
• Microsoft Azure: Cloud infrastructure, Azure Communication Services, and Entra ID authentication.
• Cloudflare: Automated DNS record synchronization, zone propagation, and web security.
• Vercel & TiDB Cloud: Application hosting and secure serverless database storage.

We implement industry-standard physical, administrative, and technical safeguards to protect your personal and infrastructure data against unauthorized access, loss, or alteration.

All API communications and dashboard interactions are encrypted in transit via TLS 1.3. Sensitive credentials, including Microsoft Azure OAuth tokens, are encrypted at rest using AES-256-GCM authenticated encryption with dedicated cryptographic keys.