1. Data controller
ON-Auto Trading Oy (Business ID 3593483-1), Kotka, Finland, is the controller of personal data processed through HEYHEY. Privacy requests may be sent to heyhey@heyhey.click.
This Policy explains what we collect, why we use it, who receives it, how long it is retained and the choices available to you.
2. Personal data we collect
- Account data: name, email address, username, password hash, account status, language and profile information.
- Social login data: provider identifier, name, email and profile information made available by Google, Facebook or X after you authorise sign-in.
- Service content: prompts, AI conversations, saved trips, selected stops, preferences, feedback, comments, uploaded photos and chosen public/private settings.
- Location and route data: origin, destination, route, selected places and precise or approximate device location only when you choose to share it.
- Purchase data: plan, credit balance, transaction identifiers, invoices, subscription status and limited payment metadata. Full card details are handled by the payment provider.
- Technical data: IP address, device and browser information, timestamps, security logs, cookies, session identifiers, crash information and usage events.
- Support data: messages, attachments and information you provide when contacting us.
Do not place sensitive personal data in prompts or public posts unless it is necessary and you have a lawful reason to do so.
3. Purposes and legal bases
| Purpose | Typical legal basis |
|---|---|
| Create and manage your account; provide chat, trip planning, saved journeys and purchased features. | Performance of a contract. |
| Process payments, subscriptions, credits, invoices and mandatory records. | Contract and legal obligation. |
| Secure the Service, prevent fraud and abuse, troubleshoot and enforce rules. | Legitimate interests and legal obligation. |
| Respond to support and privacy requests. | Contract, legal obligation and legitimate interests. |
| Measure performance and improve the Service using aggregated or appropriately protected usage data. | Legitimate interests; consent where required for non-essential cookies or analytics. |
| Send product or marketing messages. | Consent or another lawful basis permitted by applicable law. You can opt out. |
AI output is generated from your request, but HEYHEY does not use solely automated processing to make decisions that produce legal or similarly significant effects about you.
4. Service providers and data recipients
We share data only when needed to provide the Service, comply with law, protect rights or complete a transaction. Recipients may include:
- Hosting and infrastructure providers that operate the website, database, email and security systems.
- OpenAI to process AI prompts and generate responses through the API. API business data is not used to train OpenAI models by default unless the customer opts in.
- Google for Maps, Places, routes, analytics or Google sign-in, depending on the features you use and your consent choices.
- Meta/Facebook and X when you choose their social sign-in option.
- Stripe or another payment provider for card payments, subscriptions, fraud prevention and billing.
- Professional advisers and authorities where necessary for legal claims, compliance, accounting or security.
Some providers act as independent controllers for their own services. Their own privacy notices apply to data they collect directly.
5. International transfers
Some providers may process data outside Finland or the European Economic Area. Where required, transfers are protected through an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism, together with supplementary safeguards where appropriate.
6. Cookies and analytics
Essential cookies are used for login, security, sessions, preferences and payment flows. Analytics or advertising cookies are used only where enabled and, when required, after consent. You can manage optional cookies through the consent tool or browser settings. Blocking essential cookies may prevent login or other core functions.
7. Retention
Account and trip data is generally kept while your account is active and for a limited period afterwards to allow recovery, resolve disputes and protect the Service. You may delete conversations, content or your account where the feature is available or by contacting us.
Billing, tax and accounting records are retained for the period required by law. Security logs and backups are kept for proportionate periods. Public content may remain visible until you delete it or the account, subject to technical backup cycles and legal retention duties.
8. Security
We use reasonable organisational and technical safeguards, including access controls, encrypted connections, credential protection, backups and monitoring. No online system is completely secure, so you should use a unique password and protect access to your email and social accounts.
9. Your data-protection rights
Depending on applicable law, you may have the right to:
- access your personal data and obtain a copy;
- correct inaccurate or incomplete data;
- request deletion or restriction;
- receive portable data you provided where applicable;
- object to processing based on legitimate interests or direct marketing;
- withdraw consent at any time, without affecting earlier lawful processing;
- lodge a complaint with the Finnish Data Protection Ombudsman or your local supervisory authority.
We may need to verify your identity before completing a request. We will respond within the period required by applicable law.
10. Children
The Service is not designed for children to purchase independently. A minor should use HEYHEY only with parental or guardian permission and supervision. If you believe a child provided personal data without appropriate permission, contact us.
11. Changes and contact
We may update this Policy to reflect legal, technical or service changes. Material changes will be communicated through the Service or by email where appropriate. The effective date at the top identifies the current version.
For access, deletion, correction, objection or other privacy requests, email heyhey@heyhey.click.