Hellow Privacy Policy

Version: 5 (draft, updated 2026-10-15: paid plans through Google Play and RevenueCat, D038, and Hellow booking with Google Calendar, D039; earlier on 2026-10-14: contacts you add yourself, D033, and the data export saved as a file on your phone instead of emailed, D035; version 4 added card swaps, D031) · Effective date: [[PLACEHOLDER: EFFECTIVE_DATE]] · Status: DRAFT, not yet reviewed by a lawyer

Placeholders look like [[PLACEHOLDER: ...]] and points that need a lawyer look like [[LAWYER REVIEW: ...]]. The full list is in docs/legal/README.md. Do not publish this text until every marker is resolved.

This policy explains what personal data Hellow collects, why, where it is processed, how long we keep it, and the rights you have. It covers two kinds of people:

• Sharers: people who install the Hellow app, create a profile, and share it.
• Receivers: people who open a sharer's Hellow link in a web browser. Receivers never need the app or an account.

1. Who we are

Hellow is operated by [[PLACEHOLDER: COMPANY_LEGAL_NAME]], [[PLACEHOLDER: COMPANY_REGISTERED_ADDRESS]], registered with [[PLACEHOLDER: TRADE_REGISTER_NUMBER]], tax ID [[PLACEHOLDER: CUI_VAT_NUMBER]] ("Hellow", "we", "us").

Privacy contact: [[PLACEHOLDER: PRIVACY_CONTACT_EMAIL]]. Data protection officer: [[PLACEHOLDER: DPO_NAME_AND_CONTACT, or state that no DPO is required]].

[[LAWYER REVIEW: controller roles. We take the position that Hellow is the controller for sharer account data and for running the capture and consent service, and that a sharer becomes an independent controller for a receiver's details once they act on them (for example by saving them to their phone contacts or a CRM). Confirm this, or whether Hellow acts as a processor for sharers who use Hellow for business.]]

2. The short version

• Sharing back is optional. A receiver who chooses to share sends their name and phone, and chooses field by field what else to add. Nothing else is sent unless they tick it or add it.
• We store data in the EU (Supabase, EU region). Analytics (PostHog) and crash reports (Sentry) are also EU-hosted and pseudonymous: they never contain names, emails, phone numbers, or note text.
• We do not sell personal data and do not use it for advertising.
• We never track your location. "Where we met" is a place someone types, or an approximate place (about 100 m) recorded only when the sharer has turned it on, or when a receiver presses "Pin my location". Precise coordinates are never stored.
• Hellow never sends follow-up messages itself. It opens WhatsApp, your email app, or LinkedIn with a ready-made message, and we do not store the message.
• If you and the other person both use Hellow, you can swap cards with one tap. That shares your published card, nothing more, and ends when you stop sharing, remove them, or delete your account (section 4a).
• Sharers can add people they met themselves. What a sharer types about someone is the sharer's private record: never shown to that person, and deleted with the sharer's account (section 3).
• Pro is a paid plan. Google Play takes the payment and RevenueCat tells us whether your subscription is active. We never see your card or payment details (section 3a).
• Hellow booking (Pro) can connect your Google Calendar. We read only your free and busy times and create the meetings that people book, and we use that Google data for nothing else (section 3b). A person who books a meeting gives their name and email, with consent, and Google emails them the invitation (section 4b).
• Sharers can export or delete their account in the app. Receivers can see and delete what they shared at any time, without an account.

3. Data about sharers (app users)

Your sign-in session tokens are kept in your phone's secure storage (iOS Keychain / Android Keystore).

Contacts you add yourself. When someone you met does not share their details back, you can add them yourself: a name, and optionally their phone, email, LinkedIn and a note on what you talked about. Notes, reminders and follow-ups work on them like on any other contact. What you type about someone is your own record, like your notes: it is visible only to you, never shown to the person, and Hellow never contacts them. It is included in your export, and it is deleted with your account or when you delete the contact. If that person later shares their details back or swaps cards with you, the app may suggest that the two are the same person, comparing phone, email, the share moment and the name only inside your own account. Nothing is merged unless you confirm it. If you merge, their shared details fill in the contact and the value you typed is kept in the contact's history. These details are never used to find or match people across accounts. [[LAWYER REVIEW: legal basis for details a sharer types about a person (legitimate interest 6(1)(f), as for notes), and how Art. 14 information duties and that person's rights apply, given the person never sees the record and cannot reach it through "My data".]]

Permissions the app may ask for. NFC (Android, to share by tap), location while you use the app (only if you turn on "Remember where I share"; never in the background), camera and photo library (profile photo), notifications (follow-up reminders), and contacts (only to save a contact to your phone when you ask). You can refuse any of these; the related feature then stops working, and the rest of the app keeps working. We never read your phone's address book. Hellow never asks for the microphone.

Dictating notes. If you dictate a note with the microphone button on your phone's keyboard, the speech is handled by your keyboard provider (for example Google or Apple) under their own privacy policies. Hellow only receives the resulting text.

Your place pins (opt-in). With "Remember where I share" on, the app reads your location only while it is open on screen, when you share. It rounds the coordinates to 3 decimals (about 100 m) on your phone before they are stored or sent, and stores them with that share moment. The app never asks for background location. To show a place name, your phone turns the rounded coordinates into a street and city with the geocoder built into its operating system: Google on Android, Apple on iOS. They receive only the rounded coordinates, under their own privacy policies. Hellow uses no other geocoding service. Coordinates never appear in analytics, crash reports or logs.

3a. Subscriptions and payment (sharers)

Hellow has a Free plan and a paid Pro plan (4 EUR a month or 36 EUR a year) [[PLACEHOLDER: PRICES_INCLUDING_VAT, confirm the prices shown in Google Play]]. You buy Pro in the app through Google Play Billing.

• Google Play takes the payment, charges you, handles renewals, cancellations and refunds, and keeps your payment details. Hellow never receives your card number or other payment details. Google acts under its own terms and privacy policy.
• RevenueCat (RevenueCat, Inc.) connects Hellow to Google Play so we know whether your subscription is active. RevenueCat is our processor. It receives your Hellow account ID (a random identifier, used as the "app user ID"), the product you bought (monthly or yearly), the Google Play purchase token, the purchase, renewal, cancellation and expiry times, the subscription status, and technical data such as the app version and country. It does not receive your name, email, contacts or notes.
• What we store. Your plan (free, pro, or beta), set by a status update from RevenueCat when your subscription changes. Only our server can change your plan; the app cannot.
• Why and legal basis. To provide the plan you bought and show or hide Pro features: contract (Art. 6(1)(b)). To keep records the tax and accounting law requires: legal obligation (Art. 6(1)(c)). [[LAWYER REVIEW: who is the seller and the controller for the payment and the invoice (Google Play as merchant of record, or Hellow); what accounting records Hellow itself must keep; and the legal basis and transfer mechanism for RevenueCat, a US company.]]
• Free plan and ending Pro. On the Free plan the newest 25 contacts are visible. Capture never stops: a person's details are always saved. Nothing is deleted when Pro ends, and the older contacts show again if you upgrade.
• Beta. While Hellow is in beta your plan can be beta, which counts as Pro until we tell you in the app that it ends.

3b. Hellow booking and Google Calendar (sharers, Pro)

Hellow booking lets people book a meeting with you from your card page. It is available while you are on Pro (or beta), after you connect your Google Calendar and turn booking on.

What we get from Google. When you connect, Google asks for your consent for two permissions (OAuth scopes) only:

• calendar.freebusy: whether you are free or busy at a time. We read the busy times, not the titles or details of your events.
• calendar.events: so Hellow can create, and cancel, the events that people book with you. We use it to write those meetings. We do not use it to read your other events.

We also get a Google token that lets Hellow keep working without you signing in again.

How we use it. Only to give you the booking feature: to work out which times on your card page are free (your weekly hours minus your busy times, worked out on our server), to check that a time is still free when someone books, and to create, update or cancel the event for that booking in your calendar with the person as a guest. Google then sends the invitations. We do not store your busy times after the check. We do not show your calendar, event titles or busy times to anyone: a person on your card page only sees which time slots are free.

Your Google token. The refresh token stays on our servers only, encrypted at rest (Supabase Vault), and is never sent to the app or the receiver page. When you disconnect Google Calendar in the app, or delete your account, we revoke the token with Google and delete it. You can also remove Hellow's access at any time in your Google Account settings (Security, third-party access). Disconnecting turns booking off on your card.

Your booking settings. Weekly hours, meeting length, buffer, minimum notice, how far ahead people can book, and your time zone. They are kept until you change them or delete your account.

Legal basis. Contract (Art. 6(1)(b)): you turn on and use a feature you asked for. Google also records your consent to the permissions. You can withdraw it at any time by disconnecting. [[LAWYER REVIEW: contract or consent as the basis for the calendar connection.]]

Google API Services User Data Policy: Limited Use. Hellow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words:

• We use Google user data (your calendar free/busy times, and the events Hellow creates) only to provide and improve the user-facing booking feature you can see in Hellow.
• We do not transfer Google user data to others, except as needed to provide or improve that feature, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you. Our processors (section 6) handle it only on our instructions.
• We do not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising.
• We do not allow humans to read Google user data, unless we have your affirmative agreement for specific data, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and anonymised and used for internal operations.
• We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.

[[LAWYER REVIEW: the Limited Use wording against Google's current policy text at the time of the verification submission, the Google OAuth app verification (sensitive scopes) and the demo video, and the transfer of calendar data to Google LLC in the US.]]

4. Data about receivers (people who open a Hellow link)

Viewing a card. When you open a sharer's link, we show only the fields the sharer made public. To protect the service from abuse we process your IP address and request details for rate limiting and security for a short time (see section 7). The receiver page loads no third-party analytics or advertising scripts. We keep only anonymous daily totals for each card (how often it was opened, saved and shared back): no record per visitor, and no IP address, browser details or cookies. [[LAWYER REVIEW: confirm the anonymous daily card counts (slice-060) need no consent.]]

Saving the sharer's contact. The vCard file is generated from the sharer's public fields and goes straight to your phone. We store nothing about you for this.

Leaving your contact for the sharer (optional). The card may show a message asking whether you want to let the sharer know who received their details. You can ignore it: the sharer's details stay fully visible either way. If you choose to share, your name and phone number are required and are sent when you press Send. Email, company and LinkedIn are optional, and each has its own checkbox. A field you do not tick is never sent. You can also say where you met, as text or with your location (below). The form shows what the sharer will see before you submit.

Your location (only if you press "Pin my location"). Your browser reads your location once, only when you press the button, and rounds it to about 100 m before it is sent. Our server rounds it again and stores only the rounded coordinates. You can remove it before you send, and delete it later on its own or with the rest of what you shared (section 8). The sharer's phone may turn it into a street and city name with its built-in geocoder (Google on Android, Apple on iOS). Along with what you send, the sharer sees the date and time and, where known, how you connected (tap or QR).

For each field we store a consent record: the field, its purpose, the version of the consent text you saw, the time you agreed, and which share link it came through. This lets us prove your consent and lets you withdraw it. We also store a one-way hash of your email address (if you shared it) so you can later find and delete your data without an account.

Legal basis: your consent (6(1)(a)), given per field. [[LAWYER REVIEW: consent versus legitimate interest (6(1)(f)) for the required name and phone, and whether requiring a phone number is proportionate.]] You can withdraw it at any time by deleting what you shared (section 8). Withdrawal does not affect anything the sharer did before it, such as saving your details to their own phone. [[LAWYER REVIEW: confirm how to describe copies the sharer made outside Hellow.]]

Asking for your own free profile (optional). If you tap "Get your own free Hellow profile", we store a request with your email address and only the fields you chose, so your new profile can be prefilled. You can also request an invite on the Hellow website by entering only your email address; we use it only to send you the invite. Hellow is invite-only during the beta: we email you when your profile is ready. A request that isn't handled within 14 days is deleted.

Seeing and deleting what you shared. After you send, your browser keeps a cookie that only opens the "My data" page for what you sent from it. Once email links are available, you can also enter your email address on that page and we email you a single-use link that is valid for 15 minutes. The page always shows the same message whether or not we hold data for that address. Legal basis: legal obligation to handle your data-subject requests (6(1)(c)).

Reporting a profile. If you report a fake or abusive profile, we store the report reason and which profile it concerns, and apply rate limits (below). Legal basis: legitimate interest in keeping Hellow safe (6(1)(f)).

Rate limits and bot protection. To stop spam and contact harvesting, we limit how often forms can be sent. Rate limits use a one-way keyed hash (HMAC) of your IP address with a secret that changes regularly, kept only for the limit window. We never store or log your raw IP address for this. The form also uses simple checks such as a hidden field and a minimum fill time. We use no third-party bot challenge. Legal basis: legitimate interest in preventing spam and contact harvesting (6(1)(f)).

4a. Card swaps between Hellow users

When two people both have a Hellow account, one of them can open the other's card in the app and tap Swap cards. This section explains what that does.

What is shared. Only the fields you have published on your card (your public fields), nothing from your private notes, contacts or settings. The other person reads your card live: they see its current content, not a copy, so a change you make to your card shows up for them. The one value we copy is your display name, taken when you swap (and refreshed if you meet again).

Legal basis. Your consent (Art. 6(1)(a)). Tapping Swap cards, under the line that says what is shared and for how long, is the consent. We store the consent text version and the time, like capture consents. Opening a card in the app writes nothing and tells the other person nothing. You can withdraw consent at any time with Stop sharing, or by choosing Remove contact.

What the other person keeps. After you stop sharing, remove them, or unpublish your card, they stop seeing your card. They keep your display name, when and how you met, and their own notes and reminders about you, because those are their records. If you delete your account, nothing is kept: both sides of the swap are deleted, and you disappear from their contacts completely. If they delete their account, you disappear from theirs in the same way.

Blocking. You can block a person you swapped with. We store the two account IDs, the other person's display name and the date, so the block works. The block is deleted when either account is deleted.

Place. If you have turned on place pins ("Remember where I share"), the swap can record an approximate place (about 100 m) as part of "how we met". Without place pins, no place is recorded.

No matching. We never find or match people across accounts by email address, phone number or cookies, and we never tell anyone whether you use Hellow. The other person only learns who you are when you swap. Inside their own account, the app may then suggest that your swap is the same person as a contact they added themselves (section 3).

Limits and analytics. Swaps are rate-limited per user to prevent abuse. We count swaps in analytics with the method only, never names or places.

[[LAWYER REVIEW: consent by tapping Swap with one line of text; that the other person's retention of the display name, meeting time and own notes after withdrawal is justified as their own record (legitimate interest) while deleting the account removes it entirely; the blocking record as legitimate interest.]]

4b. Booking a meeting with a Hellow user (receivers)

When a sharer on Pro has turned on Hellow booking, their card page shows Book a meeting. You do not need an account or the app.

What you give. Your name and your email address, and the time you choose. Both name and email are needed to send you the invitation. Pressing Book, under the line that says what happens (the booking consent text, docs/legal/booking-consent-v1.md), is your consent (Art. 6(1)(a)). We store the consent text version, its language and the time, like capture consents.

What happens. Hellow adds the meeting to the sharer's Google Calendar with you as a guest, and Google emails you the invitation (Hellow does not send it). Google sees your name, your email and the meeting as part of the calendar event, under Google's own privacy policy. The sharer receives your booking as a contact marked "Booked" and a notification in the app. You can cancel through the invitation or by writing to the sharer. [[LAWYER REVIEW: legal basis (consent, or steps at your request before a contract, Art. 6(1)(b)), whether the consent line must name Google as a recipient and the US transfer, and the Romanian wording.]]

What we store. The booking (your name, email, the start and end time, status, the Google event ID) and your consent record. We store no other data about you for booking and set no cookies for it. The free times shown to you are worked out on our server and show nothing about the sharer's calendar apart from which slots are free.

Who sees it. The sharer, Google (as above), and our processors in section 6. We never use your booking details to market to you, and we do not pass them on.

Keeping and deleting. The booking is kept as part of the sharer's contact until the sharer deletes the contact or their account, when the booking and your consent record are deleted with it. To ask for your booking to be deleted, write to [[PLACEHOLDER: PRIVACY_CONTACT_EMAIL]]. Bookings do not appear in "My data" yet. [[LAWYER REVIEW: maximum retention for bookings, and whether a booking should be reachable in "My data".]] The sharer is an independent controller for the details they keep outside Hellow (section 1).

5. What we never do

• Sell personal data, or use it for advertising or cross-app tracking.
• Store precise location, read your location in the background, or read a receiver's location unless they press "Pin my location".
• Read your phone's address book or message history.
• Send messages on your behalf or store the content of follow-up messages.
• Put names, emails, phone numbers, or note text in analytics, crash reports, logs, or URLs.
• Find or match people across accounts by email address, phone number or cookies, or tell anyone whether you use Hellow. Suggesting that a share-back is someone you added yourself happens only inside your own account (section 3).
• Use Google Calendar data for advertising, sell it, let people read it, or use it to train AI models (section 3b).
• Store your payment card or other payment details (Google Play does that).
• Make decisions about you based solely on automated processing.

6. Where your data is processed (subprocessors)

Google (if you choose Google sign-in; for calendar booking see the table above), the geocoder built into the sharer's phone (Google on Android, Apple on iOS; it receives only rounded coordinates), Apple and Google app stores, and WhatsApp, LinkedIn, or your email app (when you start a follow-up) are independent services with their own privacy policies. We pass them only what is needed for the action you choose.

Transfers outside the EEA. We choose EU hosting by default. If a provider or its support staff process data outside the EEA, we rely on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses. [[LAWYER REVIEW: confirm the transfer mechanism for each provider and list it here.]]

7. How long we keep data

[[LAWYER REVIEW: decide whether captured contacts need a maximum retention period (e.g. deleted after N months of sharer inactivity).]]

8. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time.

Sharers can do most of this in the app:

• Edit your profile at any time (correction).
• Export your data from Settings (access and portability): the app saves a machine-readable file (hellow-export-YYYY-MM-DD.json) to a folder you pick on your phone. It is returned only to you, signed in, and not emailed, and Hellow keeps no copy. You can export up to 3 times in 24 hours. Export is in the Android app; on iPhone, ask us at [[PLACEHOLDER: PRIVACY_CONTACT_EMAIL]] for now.
• Delete your account from Settings. Deletion removes your profile, share links, received contacts, contacts you added, notes, and stored files. Your links stop working immediately.
• Turn off analytics in Settings (objection).
• Disconnect Google Calendar in the app at any time (withdrawal of consent): Hellow revokes and deletes the token and turns booking off. Deleting your account does the same and also deletes your bookings.
• Cancel Pro in Google Play (Subscriptions). Cancelling stops renewal; nothing is deleted from Hellow (section 3a).

Receivers can, without an account:

• Go to [[PLACEHOLDER: RECEIVER_SITE_URL]]/my-data from the browser you sent your details from to see every record you shared (sharer name, date, fields, place or pin). You can delete the place or pin alone, one record, or all of them. Deleting removes the record from the sharer's Hellow inbox. Once email links are available, you can also reach your records from another device with your email.
• Otherwise, contact us at [[PLACEHOLDER: PRIVACY_CONTACT_EMAIL]]. This is also how to ask about a booking you made (section 4b).

Anyone can also email [[PLACEHOLDER: PRIVACY_CONTACT_EMAIL]]. We answer within one month, as the GDPR requires. We may ask you to confirm your identity first.

You can complain to the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, www.dataprotection.ro), or to the authority where you live or work.

9. Security

We use encryption in transit (HTTPS/TLS) and at rest, per-user access rules on every database table, random share links that cannot be guessed and can be revoked, single-use and short-lived tokens, and rate limiting. No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the supervisory authority as the GDPR requires.

10. Children

Hellow is not meant for anyone under 16. We do not knowingly collect data from children under 16. If you believe a child has used Hellow, contact us and we will delete the data. [[LAWYER REVIEW: confirm 16 as the age threshold for Romania.]]

11. Changes to this policy

We will publish each new version on this page with a new version number and effective date. If a change affects what receivers consent to, the capture form will show the new consent text version and earlier consent records keep the version that was shown at the time. We will tell sharers about material changes in the app before they take effect.

12. Contact

[[PLACEHOLDER: COMPANY_LEGAL_NAME]], [[PLACEHOLDER: COMPANY_REGISTERED_ADDRESS]] · [[PLACEHOLDER: PRIVACY_CONTACT_EMAIL]]