Your data, explained clearly.

What HAYO processes

HAYO processes information you provide and the accounts you connect to identify tasks, appointments and deadlines and to fulfil your instructions. This can include account information, message content, calendar entries, contacts, tasks and technical logs. HAYO receives content from connected mailboxes through IMAP; for Gmail and most providers you provide the app password used for this purpose; for Microsoft mailboxes you sign in at Microsoft instead and HAYO never sees your Microsoft password.

Google permissions currently requested by the code

• openid and email identify the connected Google account.
• https://www.googleapis.com/auth/calendar reads, creates and changes calendar events you ask HAYO to handle.
• https://www.googleapis.com/auth/contacts.readonly reads Google Contacts when you turn on the address book.
• https://www.googleapis.com/auth/contacts reads contacts and writes them back to Google only after your explicit confirmation.

HAYO does not currently request drive.file.

Microsoft permissions currently requested by the code

HAYO asks for these only when you choose “Connect with Microsoft”; Microsoft then shows you the list on its own sign-in page. The calendar and the mailbox are two separate Microsoft resources, so HAYO obtains two separate short-lived access tokens from your one stored sign-in.

• openid, email and profile identify the connected Microsoft account.
• offline_access keeps the connection until you remove it, so you do not have to sign in again for every use.
• https://graph.microsoft.com/User.Read reads your basic profile to confirm which account you connected.
• https://graph.microsoft.com/Calendars.ReadWrite reads, creates and changes calendar events you ask HAYO to handle.
• https://outlook.office.com/IMAP.AccessAsUser.All lets HAYO read your mailbox over IMAP at outlook.office365.com using the sign-in token (SASL XOAUTH2) instead of a password.
• https://outlook.office.com/SMTP.Send lets HAYO send over SMTP at smtp.office365.com using the same token (XOAUTH2), only a message you confirmed.

HAYO requests no other Microsoft mail permission. For a work or school account your organisation’s administrator may have to approve the connection first; until then Microsoft refuses at sign-in and nothing is connected.

Recipients and processors

• Hetzner Online GmbH for hosting in Falkenstein, Germany.
• Meta Platforms Ireland Ltd. for message transport through the WhatsApp Business Cloud API.
• Anthropic PBC for AI processing through ILlmService; data may leave the EU for the USA.
• Google for the Calendar API and People API, only if you connect Google; the permissions above define the scope.
• Microsoft (Graph for the calendar; Outlook IMAP and SMTP for the mailbox), only if you connect Microsoft; the permissions above define the scope.
• OpenRouteService / HeiGIT gGmbH for travel times, only when the feature is enabled; only the start and destination address are sent.
• Apple (Apple Push Notification service (APNs)), only if you installed the iOS app and allowed notifications; your device token and the notification text (title and body, for example of a reminder) plus an internal link to the target page in the app are sent.
• Apple iCloud (IMAP, CalDAV, CardDAV), only if you connect an iCloud mailbox, calendar or address book with an app-specific password; HAYO retrieves the data you release there and writes contacts back only after your explicit confirmation.
• The web push service of your browser vendor (Web Push), only if you turned on browser notifications; the vendor receives your browser address (endpoint) and an encrypted message that contains only an event code, a link to the target page and, where relevant, a name.
• OpenRouter, only for model comparisons started manually by the operator in which past conversations of the Kanzlei module are re-evaluated with another AI model; in normal operation HAYO sends nothing to OpenRouter.

Storage and deletion

Backups are retained for 14 days. When an account is deleted, the deletion service deletes all per-user data. Completed inbound-queue entries are deleted after seven days. Kanzlei audio recordings are deleted after 90 days; the period begins only when that module becomes effective for the account. Organisation messages are deleted after the retention period chosen by the relevant organisation (between 1 and 3,650 days). Where the code does not enforce a fixed period, we retain data until you delete it or your account.

Your rights and Google access

Under the GDPR, you have rights of access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority.

You can revoke Google access in your Google account and disconnect it in HAYO. HAYO will then stop using that connection.

You can revoke Microsoft access for a personal account in your Microsoft account (work or school accounts: My Apps) and disconnect it in HAYO. After a revocation HAYO does not guess: it tells you that the connection must be renewed.