Privacy Policy of heyteo AG
Steigstrasse 18, 8463 Benken (ZH), Switzerland
Version 2.0 · Valid from 21 May 2026
1 What does this privacy policy contain?
The protection of your personal data is of great importance to us. With this privacy policy, we inform you which personal data we process, for what purpose we process it, how long we store personal data, what rights you have in relation to your personal data and who you can contact with any concerns. This privacy policy is aligned with both the Swiss Data Protection Act (revFADP) and the European General Data Protection Regulation (GDPR).
2 Who is responsible and how can you contact us?
The following company ("we" or "us") is responsible for processing your personal data in accordance with this privacy policy:
heyteo AG
Steigstrasse 18, 8463 Benken (ZH), Switzerland
If you have any questions about the processing of your personal data, you can reach us at:
Chris Einsele · chris.einsele@heyteo.com · +41 52 533 63 63
3 Who is this privacy policy intended for?
"Personal data" means any information relating to an identified or identifiable natural person. This privacy policy applies to all persons ("you" or "your") whose personal data we process. In addition to this privacy policy, other documents and guidelines from us (e.g. Terms of Use, General Project Conditions, DPA, Cookie Policy) may contain information on the processing of personal data.
4 What personal data do we process?
4.1 In connection with the provision of services
In connection with the offering and provision of our services (software agents / AI chat services, including product-specific manifestations such as Teo HR Coach), we collect and process the following data in our systems in particular:
Names of our customers and partners
Contact information of our customers/partners: address, email address, mobile number, website, correspondence
Contact information of our customers'/partners' contact persons: name, address, email address, mobile number, correspondence
Contact information of third parties with whom we initiate or have concluded contracts: name, address, email address, landline/mobile number, website, correspondence
Invoicing and payment information
4.2 When you use our services
In connection with the use of our services (software agents / chats), we collect and process the following data in our systems:
Information entered by the user and responses provided by the system
Information about user behaviour in the chat (e.g. activating links, chat latency)
Technical data about our own systems (e.g. computing power used and latency times)
Technical data about the systems used by the user (e.g. IP address, device and connection data)
4.3 Data from the WhatsApp Business Platform (Meta)
When you connect your WhatsApp Business account (WhatsApp Business Account, "WABA") to our service via Meta's Embedded Signup, we collect and process the following data via Meta's Graph API under the whatsapp_business_management permission:
Your WABA ID and associated phone number identifiers
Metadata on phone numbers (displayed number, verified name, verification status, quality rating)
The message templates associated with your account
A Business Access Token issued by Meta, which authorises us to manage these assets on your behalf and which we store in encrypted form
We do not use this authorisation to access the content of the WhatsApp messages exchanged with your guests.
5 For what purpose do we process your personal data?
5.1 In connection with the provision of services
We process personal data in connection with the initiation, conclusion and execution of contracts. The purpose covers everything that is expedient and necessary to initiate, conclude, perform, terminate and enforce contracts — in particular:
Provision of contractual services (e.g. conversational engagement, up-/cross-selling, customer-driven innovation)
Decision on contract modalities
Termination of contracts
Invoicing, dunning, accounting
Enforcement of legal claims arising from contracts
Archiving of contracts
We also process personal data for communication, marketing and information (customer service, responding to enquiries, newsletters, advertising emails, printed matter, invitations to events) as well as for compliance with legal obligations and enforcement of our rights (clarification, enforcement and defence of claims, processing of complaints, disclosure to authorities in case of legal obligation or factual reason). Administration includes analysis and improvement of processes, accounting, IT and archiving.
5.2 When you use our services
We process personal data for the ongoing improvement of our services (product development, user-friendliness improvement such as query refinement and dialogue evaluation, acceptance improvement such as intent recognition optimisation, benchmarking, further development of our technology) as well as to protect our IT systems (defence against and investigation of malware and cyber attacks, access control, backups, testing and analysis of our networks and IT systems).
5.3 Data from the WhatsApp Business Platform (Meta)
We process data received via the WhatsApp Business Platform exclusively to connect and administer your WhatsApp Business account and its assets — in particular to read, create and manage message templates and to read phone number information — so that we can provide and operate the Virtual Concierge service for you. We do not use this data for advertising and we do not sell it. Our use of information from Meta APIs is in accordance with Meta's Platform Terms and Developer Policies, including all restrictions regarding use, storage and security.
6 What legal bases do we rely on for the processing?
Insofar as the GDPR applies to the personal data, we specify the legal basis below.
6.1 In connection with the provision of services
Regarding the personal data of our customers and partners, we process these on the basis of Art. 6 (1) (b) GDPR (performance of a contract or pre-contractual measures).
Regarding personal data that do not relate to our customers/partners, we rely on Art. 6 (1) (f) GDPR (legitimate interest), namely to offer, provide and invoice services to our customers/partners.
Insofar as consent is required for marketing purposes, we rely on Art. 6 (1) (a) GDPR.
6.2 When you use our services
We process technical personal data on the basis of Art. 6 (1) (f) GDPR (legitimate interest) to understand and resolve technical issues, improve, support and maintain systems, and conduct security-related analyses.
We process information entered by the user and responses provided by the system on the basis of Art. 6 (1) (f) GDPR (legitimate interest) to improve our services.
6.3 Data from the WhatsApp Business Platform (Meta)
We base the processing of data received via the WhatsApp Business Platform on the performance of our contract with you (Art. 31 (2) (a) FADP; Art. 6 (1) (b) GDPR) and on our legitimate interest in providing and securing the service (Art. 31 (1) FADP; Art. 6 (1) (f) GDPR).
7 Who do we share personal data with?
If we make use of the services of third parties, we may pass your personal data on to such third parties. These "processors" are obliged to process the personal data in accordance with our instructions and to take suitable measures for data security. By means of contractual agreements (in particular DPAs), we ensure that data protection is guaranteed throughout the entire processing.
Personal data may be pass on to third parties, in particular for the following services:
IT services
Payment services
Advisory services such as fiduciary and tax advice
As part of providing our services (software agents / chats), personal data are also passed on to the following sub-processors: OpenAI Ireland Ltd., Google Ireland Ltd., Meta Platforms Ireland Ltd. (operator of the WhatsApp Business Platform, from whom we receive and with whom we exchange administrative data on WhatsApp Business accounts), Twilio Inc. (USA) and XIAG AG (Switzerland). An up-to-date list of sub-processors is part of our Data Processing Agreement (DPA).
Detailed information on the applicable data protection regulations can be found here: Google Ireland Ltd. · Google Cloud GDPR
8 Do we disclose personal data abroad?
Your personal data are mostly stored and processed by us in Switzerland and the European Union. However, we may also process or have your personal data processed outside of this territory (in particular by Twilio Inc. in the USA). If the respective recipient country does not have an adequate level of statutory data protection, we ensure the protection of your personal data using appropriate measures (e.g. EU Standard Contractual Clauses, Swiss/EU-US Data Privacy Framework). Google is certified under the Swiss/EU-US Data Privacy Framework and thus offers an adequate level of data protection in accordance with GDPR and Art. 16 (1) FADP.
9 Do we process sensitive personal data?
We do not intend to process sensitive personal data. We only process sensitive personal data if you submit it to us unsolicited and voluntarily through our services. We do not create profiling with sensitive personal data, nor do we use it for automated individual decisions.
10 How long do we store your personal data?
10.1 In connection with the provision of services
Personal data we process in connection with our services are stored for ten (10) years from the termination of the service for the respective customer/partner, unless contractual or legal requirements provide for a longer retention period. This period matches Section 7 of our DPA. Your personal data will be deleted or anonymised after these periods have expired.
10.2 When you use our services
The storage of technical data usually lasts a few days, but can take up to 2 years. Certain technical data are deleted again after the end of the session or use of the service.
Information entered by the user and responses provided by the system are generally deleted or anonymised after 48 months.
10.3 Data from the WhatsApp Business Platform (Meta)
You can request the deletion of data received about your WhatsApp Business account at any time. To do so, follow our Data Deletion Instructions (https://www.heyteo.ch/legal-pages/data-deletion). Upon verification of your request, we will irretrievably delete or anonymise this data — including the stored access token — and revoke our access to your WhatsApp Business account within 30 days, subject to statutory retention obligations.
11 What rights are you entitled to?
If we process your personal data, you generally have the following rights:
Objection: If we process your personal data on the basis of a legitimate interest, you can object to the processing.
Right of access: You can request confirmation from us as to whether we process your personal data.
Rectification: You have the right to have inaccurate personal data corrected and incomplete personal data completed.
Restriction of processing: under the legal requirements (e.g. if the accuracy is contested, the processing is unlawful or an objection has been filed).
Erasure or anonymisation: You can request that your personal data be deleted or anonymised if the legal conditions are met.
Data disclosure or portability: You can request the disclosure of the personal data you have provided in a standard electronic format.
Withdrawal of consent: You can withdraw any consent granted at any time with effect for the future. Other legal bases remain reserved.
Right to be informed: In the event of rectification, erasure or restriction, we are obliged to notify all recipients, unless this is impossible or involves disproportionate effort.
Right of appeal: You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work or place of the alleged violation.
The rights mentioned above may be restricted or excluded in individual cases if the legal requirements are not met, statutory obligations conflict or interests worthy of protection must be preserved.
These rights also include the right to request the deletion of the data we hold about your WhatsApp Business account; see our Data Deletion Instructions pursuant to Section 10.3.
12 Changes to this privacy policy and language
From time to time, we may adjust this privacy policy. The version published at the time applies. In the event of any discrepancies between the German and any other language version of this privacy policy, the German language version shall prevail.
Version 2.1 of 3 July 2026