Privacy Policy

Who We Are

HEYBRYAN LTD (“we”, “us”, or “our”) operates the HeyBryan service and is responsible for the personal information described in this Privacy Policy. HEYBRYAN LTD is registered in England and Wales under company number 17297711.

What We Collect

HeyBryan collects the information you provide while using the service, including your email address, profile name, tasks, notes, lists, calendar planning details, Control Centre settings, and feedback you send to us.

If you ask Bryan to keep something on your list, in WhatsApp or the Control Centre, HeyBryan stores that item in your own words, the date you gave, whether it is open, done or removed, and which of the two places changed it.

A spoken copy of Bryan’s reply is held on WhatsApp’s servers for about 30 days, like other voice notes. Bryan’s spoken copies use an AI-generated voice.

If you send a WhatsApp voice note, HeyBryan processes the audio and transcript so Bryan can respond in the same WhatsApp conversation.

If you connect an email account (Outlook or Gmail), Bryan reads it and never writes to it: he does not send, draft, reply to, archive or delete anything. When you ask about your email, or when your Morning Brief runs, Bryan reads the sender, subject and a short preview of recent messages at that moment. HeyBryan does not keep a copy of your mailbox, and what Bryan read can appear in the record of that conversation turn.

If you connect calendars, HeyBryan stores calendar connection metadata, imported calendar events, and encrypted OAuth tokens or subscribed ICS feed details needed to sync your schedule.

How We Use It

We use your information to provide the app, keep you signed in, sync your planning data, generate AI-assisted suggestions, troubleshoot bugs, improve the app, and respond to support requests.

We do not sell your personal information.

We do not use your personal information or Google user data for advertising, creditworthiness, lending eligibility, employment eligibility, insurance eligibility, or other sensitive eligibility decisions.

Service Providers

HeyBryan uses Supabase for authentication, database services, and Bryan memory records; Meta for WhatsApp delivery; Composio for the connected-app access you authorise (Todoist, Google, Microsoft, Notion and Granola); OpenRouter and configured model providers for conversation generation; OpenAI for fallback AI processing, structured extraction, memory extraction, and audio transcription; Resend for the emails we send you; RevenueCat for plans and billing; Upstash for rate limiting; Vercel for hosting and analytics; and Sentry if error monitoring is enabled.

Conversation requests sent through OpenRouter are restricted to routes marked for zero data retention, with provider data collection denied and required request parameters enforced.

These providers process data only as needed to operate the features you use.

Sharing, Transfer, And Disclosure

HeyBryan does not sell personal information or Google user data. We do not allow third parties to use Google user data for their own advertising, profiling, or unrelated purposes.

We may share, transfer, or disclose personal information and Google user data only to provide the HeyBryan service through trusted infrastructure and service providers; where you direct or consent to an action, such as creating, updating or summarising information in a connected service (Bryan reads email but never sends it); where required by law, regulation, legal process, or enforceable governmental request; or as part of a merger, acquisition, financing, reorganisation, or sale of assets subject to appropriate confidentiality and data protection obligations.

Service providers are permitted to process data only on our behalf and only for the purpose of operating, securing, supporting, or improving the HeyBryan features you use.

Security And Data Protection

We use administrative, technical, and organisational safeguards designed to protect personal information, Google user data, and sensitive data from unauthorised access, loss, misuse, disclosure, alteration, or destruction.

These safeguards include HTTPS/TLS encryption in transit, secure cloud infrastructure, access controls, least-privilege access practices, secure authentication, operational logging and monitoring, and retention controls designed to keep data only for as long as needed to provide the service, comply with legal obligations, resolve disputes, or enforce agreements.

Where sensitive data is processed, we limit access, reduce unnecessary retention, and use trusted service providers with appropriate security controls.

Calendar And WhatsApp Voice-Note Data

Calendar connections and imported calendar items are used to show your schedule inside HeyBryan. WhatsApp voice notes may be transcribed so Bryan can understand and respond to the message.

Raw voice-note audio is not retained by HeyBryan after transcription unless explicit retention is enabled in a future opt-in setting. Voice notes are not exported or used for training without explicit opt-in.

Avoid entering highly sensitive personal, financial, medical, or legal information. Bryan is designed for life admin support, not emergency, legal, financial, or medical advice.

Google User Data

If you connect your Google account, HeyBryan may request access to Google user data only where needed to provide the features you enable, such as helping you manage calendar events, reminders, tasks and notes, reading your email, or other life-admin workflows.

HeyBryan uses Google user data only to provide and improve user-facing features you request or enable. For example, we may use Google Calendar data to help you create, update, summarise, or manage calendar events, and Gmail data, read only, where you have explicitly granted access.

HeyBryan does not use Google user data for advertising, does not sell Google user data, and does not use Google Workspace API data to develop, improve, or train generalised AI or machine learning models.

You can revoke HeyBryan’s Google account access at any time from your Google Account permissions page.

Retention And Deletion

Tasks, notes, lists, calendar events, Bryan memory, connected-app grants, WhatsApp conversation records, and Control Centre records are kept while your account is active unless you delete them from Settings.

Bryan may also keep things you mention in your WhatsApp chats that stay true, such as routines, people and preferences, as Bryan memory, so you don’t have to repeat yourself. He tells you the first time he keeps one, lists them when you ask what he knows about you, and forgets any of them when you ask. The words of a message are held only while a memory is being drawn from it, which takes minutes, and are never used to train models.

You can delete Bryan memory, revoke the private task calendar ICS link, withdraw from the early tester group, or delete your account from Settings. Account deletion removes your planner data, notes, events, connected-app grants and tokens, WhatsApp conversation records, Bryan memory, the early tester copy of your chats, and matching launch-signup data where applicable.

Control Centre notification records are local operational records and are removed during account deletion. Usage and spend audit events may be retained without your user id for up to 90 days for abuse, reliability, and cost investigation.

Backups and provider logs may persist for a limited period after deletion. Local Settings controls create a deletion job for operator follow-up where processor-side deletion is available across OpenAI, OpenRouter, Meta, Composio, Resend, RevenueCat, Vercel, and other external processors. If you used features we have since retired (memory held by Mem0, or an earlier voice provider), records held by those providers may also need operator follow-up.

Early tester conversation review

While Bryan is in early testing with the first 100 testers, we may keep a rolling 30-day copy of WhatsApp messages you send to Bryan and Bryan’s replies so we can review quality, catch failures, and improve the assistant. That copy is encrypted at rest, available only to the founder through an audited private viewer, and is not used for advertising.

Passwords, one-time codes, and similar credentials are excluded from that copy. We delete it after 30 days, if you withdraw from the tester group, or if you delete your account. You can withdraw at any time from Settings, under Privacy & deletion. This is a quality-review process for early testers, not a public archive of chats.

Contact

For privacy questions, support, external processor deletion follow-up, or deletion requests you cannot complete in Settings, contact hello@heybryan.ai.

Google API Limited Use

HeyBryan’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. For Workspace APIs, HeyBryan also complies with the Google Workspace API User Data and Developer Policy.

You can revoke HeyBryan’s Google access from your Google Account permissions.