Privacy Policy

HeyQuad LLC ("we," "us," "the company") operates the Hey Quad platform ("the Service") — a multi-tenant business phone system. This policy describes the data we handle on behalf of organizations that subscribe to the Service and the individuals whose calls or messages flow through it.

We process the categories of data necessary to deliver telephony, messaging, and account services:

• Account data — name, email, role, organization membership.
• Communications metadata — phone numbers, call start/end times, durations, message timestamps, routing decisions.
• Communications content — call recordings (when enabled by the customer), SMS/MMS message bodies, voicemail audio.
• Billing data — usage counts, invoice line items. Payment instruments are held by Stripe; we do not store card numbers.
• Operational logs — request logs, error traces, security events, retained for incident response.

• To route calls and messages to their intended destinations.
• To bill our customers and reconcile usage with our carriers.
• To detect abuse, fraud, and policy violations (e.g., spam SMS campaigns).
• To comply with lawful regulatory and law-enforcement requests.

We do not sell personal information. We do not use customer communications content to train models.

We rely on a small set of subprocessors to operate the platform. The current list is published on our security page. Notable entries:

• Telnyx — carrier and number management
• Stripe — payment processing
• AWS — primary cloud hosting

Account and billing data is retained for the life of your service plus seven years for accounting purposes. Communications content (recordings, messages) is retained for the length of your active service unless you request earlier deletion. Operational logs are retained for 90 days.

To request access to, deletion of, or correction to your personal information, email [email protected].

If you are an end user whose data is processed by HeyQuad LLC (via the Hey Quad Service) on behalf of one of our customers, that customer is the data controller for their account and the fastest path is to contact them directly. If you would rather reach Hey Quad instead — you do not have a working relationship with the customer, or you want us to know regardless — email [email protected] and we will route the request to the customer or handle it ourselves where we control the data.

For DPA execution and EU/UK representative contact, email [email protected].

We will post material changes to this policy on this page and email notice to administrators of every active organization at least 30 days before they take effect.