Privacy Policy of heyteo AG
Steigstrasse 18, 8463 Benken (ZH), Switzerland
Version 2.1 · Effective from 3 July 2026
1 What does this Privacy Policy contain?
The protection of your personal data is very important to us. With this Privacy Policy, we inform you about which personal data we process, the purposes for which we process it, how long we retain personal data, what rights you have regarding your personal data, and whom you can contact with any concerns. This Privacy Policy is aligned with both Swiss data protection legislation (revFADP) and the European General Data Protection Regulation (GDPR).
2 Who is responsible and how can you contact us?
The following company ("we" or "us") is responsible for the processing of your personal data in accordance with this Privacy Policy:
heyteo AG
Steigstrasse 18, 8463 Benken (ZH), Switzerland
If you have any questions regarding the processing of your personal data, you can reach us at:
Chris Einsele · chris.einsele@heyteo.com · +41 52 533 63 63
3 Who is this Privacy Policy intended for?
"Personal data" means any information relating to an identified or identifiable natural person. This Privacy Policy applies to all individuals ("you" or "your") whose personal data we process. In addition to this Privacy Policy, other documents and policies of ours (e.g. Terms of Use, General Project Terms, DPA, Cookie Policy) may contain information regarding the processing of personal data.
4 What personal data do we process?
4.1 In the context of providing services
In connection with offering and providing our services (software agents / AI chat services, including product-specific variations such as Teo HR Coach), we collect and process in particular the following data in our systems:
Names of our clients and partners
Contact details of our clients/partners: address, email address, mobile number, website, correspondence
Contact details of contact persons of our clients/partners: name, address, email address, mobile number, correspondence
Contact details of third parties with whom we initiate or have concluded contracts: name, address, email address, landline/mobile number, website, correspondence
Billing and payment information
4.2 When you use our services
In connection with the use of our services (software agents / chats), we collect and process the following data in our systems:
Information entered by the user and responses provided by the system
Information about user behaviour within the chat (e.g. clicking links, chat latency)
Technical data regarding our own systems (e.g. computing power used and latency times)
Technical data regarding the systems used by the user (e.g. IP address, device and connection data)
4.3 Data from the WhatsApp Business Platform (Meta)
When you connect your WhatsApp Business account ("WABA") to our service via Meta's Embedded Signup, we collect and process the following data via Meta's Graph API under the permission whatsapp_business_management:
Your WABA ID and associated phone number identifiers
Metadata regarding phone numbers (displayed number, verified name, verification status, quality rating)
Message templates linked to your account
A business access token issued by Meta that authorises us to manage these assets on your behalf, which we store in encrypted form
Via this permission, we do not access the content of WhatsApp messages exchanged with your guests.
5 For what purpose do we process your personal data?
5.1 In the context of providing services
We process personal data in connection with the initiation, conclusion, and execution of contracts. The purpose covers everything that is expedient and necessary to initiate, conclude, execute, terminate, and enforce contracts — in particular:
Provision of contractual services (e.g. conversational engagement, up-/cross-selling, customer-driven innovation)
Decisions regarding contractual modalities
Termination of contracts
Invoicing, debt collection, accounting
Enforcement of legal claims arising from contracts
Archiving of contracts
We also process personal data for communication, marketing, and informational purposes (customer service, responding to enquiries, newsletters, promotional emails, printed materials, event invitations) as well as to comply with legal obligations and enforce our rights (clarification, enforcement, and defence of claims, handling complaints, disclosure to public authorities where legally required or justified). Administration includes the analysis and improvement of processes, accounting, IT, and archiving.
5.2 When you use our services
We process personal data for the continuous improvement of our services (product development, improvement of user experience such as query refinement and dialogue evaluation, improvement of acceptance such as intent recognition optimisation, benchmarking, further development of our technology) and to protect our IT systems (defence against and investigation of malware and cyberattacks, access control, backups, testing and analysis of our networks and IT systems).
5.3 Data from the WhatsApp Business Platform (Meta)
We process data obtained via the WhatsApp Business Platform exclusively to connect and administer your WhatsApp Business account and its assets — in particular to read, create, and manage message templates and read phone number details — so that we can provide and operate the Virtual Concierge service for you. We do not use this data for advertising and we do not sell it. Our use of information from Meta's APIs complies with Meta's Platform Terms and Developer Policies, including all restrictions regarding usage, storage, and security.
6 What legal bases do we rely on for processing?
To the extent that the GDPR applies to the personal data, we specify the legal basis below.
6.1 In the context of providing services
Regarding personal data of our clients and partners, we process this on the basis of Art. 6(1)(b) GDPR (contract performance or pre-contractual measures).
Regarding personal data that does not relate to our clients/partners, we rely on Art. 6(1)(f) GDPR (legitimate interests), namely to offer, provide, and invoice services to our clients/partners.
To the extent that consent is required for marketing purposes, we rely on Art. 6(1)(a) GDPR.
6.2 When you use our services
We process technical personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests) in order to understand and resolve technical issues, improve, support, and maintain systems, and carry out security-related analyses.
We process information entered by the user and responses provided by the system on the basis of Art. 6(1)(f) GDPR (legitimate interests) to improve our services.
6.3 Data from the WhatsApp Business Platform (Meta)
We base the processing of data received via the WhatsApp Business Platform on the performance of our contract with you (Art. 31(2)(a) FADP; Art. 6(1)(b) GDPR) and on our legitimate interest in providing and securing the service (Art. 31(1) FADP; Art. 6(1)(f) GDPR).
7 With whom do we share personal data?
When we use third-party services, we may share your personal data with such third parties. These "processors" are obliged to process the personal data strictly in accordance with our instructions and to implement appropriate data security measures. Through contractual agreements (in particular DPAs), we ensure that data protection is maintained throughout the entire processing.
In particular, personal data may be shared with third parties for the following services:
IT services
Payment services
Consulting services such as fiduciary and tax consultancy
In the context of providing our services (software agents / chats), personal data is also shared with the following subcontractors: OpenAI Ireland Ltd., Google Ireland Ltd., Meta Platforms Ireland Ltd. (operator of the WhatsApp Business Platform, from which we receive administrative data on WhatsApp Business accounts and with which we exchange such data), Twilio Inc. (USA), and XIAG AG (Switzerland). An up-to-date list of subcontractors forms an integral part of our Data Processing Agreement (DPA).
Detailed information regarding the applicable data protection provisions can be found here: Google Ireland Ltd. · Google Cloud GDPR
8 Do we disclose personal data abroad?
Your personal data is generally stored and processed by us in Switzerland and in the European Union. However, we may also process your personal data, or have it processed, outside this territory (in particular by Twilio Inc. in the USA). If the respective recipient country does not have an adequate statutory level of data protection, we ensure the protection of your personal data through appropriate safeguards (e.g. EU Standard Contractual Clauses, Swiss/EU-US Data Privacy Framework). Google is certified under the Swiss/EU-US Data Privacy Framework and thus provides an adequate level of data protection pursuant to the GDPR and Art. 16(1) FADP.
9 Do we process sensitive personal data?
We do not intend to process sensitive personal data (special category data). We only process sensitive personal data if you provide it to us voluntarily and unprompted via our services. We do not engage in profiling with sensitive personal data, nor do we use it for automated individual decision-making.
10 How long do we retain your personal data?
10.1 In the context of providing services
Personal data that we process within the scope of our services is retained for ten (10) years following the termination of the service for the respective client/partner, unless contractual or statutory provisions stipulate a longer retention period. This period corresponds to Section 7 of our DPA. Your personal data will be deleted or anonymised after these periods have expired.
10.2 When you use our services
Technical data is usually retained for a few days, but this can extend up to 2 years. Certain technical data is deleted once the session ends or use of the service ceases.
Information entered by the user and responses provided by the system are generally deleted or anonymised after 48 months.
10.3 Data from the WhatsApp Business Platform (Meta)
You may request the deletion of data that we have received regarding your WhatsApp Business account at any time. To do so, please follow our Data Deletion Instructions (https://www.heyteo.ch/legal-pages/data-deletion). Upon verification of your request, we will irrevocably delete or anonymise this data — including the stored access token — and revoke our access to your WhatsApp Business account within 30 days, subject to statutory retention obligations.
11 What rights do you have?
When we process your personal data, you generally have the following rights:
Right to object: If we process your personal data on the basis of a legitimate interest, you may object to the processing.
Right of access: You can request confirmation from us as to whether we are processing your personal data.
Right to rectification: You have the right to have inaccurate personal data corrected and incomplete personal data completed.
Right to restriction of processing: Under statutory conditions (e.g. if the accuracy is contested, processing is unlawful, or an objection has been lodged).
Right to erasure or anonymisation: You can request that your personal data be deleted or anonymised if the statutory conditions are met.
Right to data surrender or portability: You can request the surrender of personal data that you have provided to us in a common electronic format.
Right to withdraw consent: You may withdraw consent granted at any time with effect for the future. Other legal grounds remain unaffected.
Right to notification: In the event of rectification, erasure, or restriction, we are required to notify all recipients unless this proves impossible or involves disproportionate effort.
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement.
The rights mentioned above may be restricted or excluded in individual cases if the statutory requirements are not met, legal obligations conflict, or overriding legitimate interests must be safeguarded.
These rights also include the right to request the deletion of the data we hold regarding your WhatsApp Business account; please see our Data Deletion Instructions pursuant to Section 10.3.
12 Changes to this Privacy Policy and Language
We may amend this Privacy Policy from time to time. The currently published version shall apply in each case. In the event of discrepancies between the German version and any other language version of this Privacy Policy, the German version shall prevail.
Version 2.1 of 3 July 2026