Privacy Policy

The HeyFred app and heyfred.ai are operated by Hey Fred AI LLC, 5419 Orsello St, Palmetto, FL 34221, United States. Questions about privacy go to lennart@heyfred.ai.

• Business verification. When you request customer texting, we collect your legal business name, address, authorized contact, website, and tax registration details. EINs are encrypted. We use this information to register your business with Telnyx, The Campaign Registry, and carriers. It is not displayed on customer consent pages or used as AI assistant context.
• Account details. Your mobile phone number (used to sign in with a one-time code), your name, your business name, trade, address, timezone, logo, and business contact details.
• What you tell Fred. When you hold the button and speak, the recording is sent to our servers, converted to text, and the text is used to carry out your request. We keep the text transcript and Fred's reply so you can see what Fred did. We do not keep the audio after it has been transcribed.
• Your business records. The customers, jobs, estimates, proposals, invoices, notes, and messages you or Fred create. This includes your customers' names, phone numbers, email addresses, and job addresses, which you are responsible for collecting lawfully.
• Photos and documents. Job photos, captions, selected sample invoices and logos. Job photos stay in your business records; a photo is sent for AI analysis when you request that feature and allow AI sharing.
• Messages and connected email. Texts and emails sent on your behalf, delivery status and customer replies. If you connect Gmail or Outlook, we collect the mailbox address, granted permissions and encrypted access tokens. With your additional reply-reading permission we retrieve relevant customer replies, including sender, recipients, subject and message text. We do not use mailbox access to send messages without your instruction.
• Live conversations. Microphone audio is streamed while a Live call is active. We keep the conversation transcript, actions and usage information; HeyFred does not store a Live audio recording. Recordings or typed drafts waiting to send may be stored locally on your device until sent or removed.
• Your choices. We record your AI-sharing permission, disclosure version and the date of your choice, along with the separate permissions you give for messaging, notifications and connected services.
• Payment details. Subscription and payout processing is handled by Stripe. We store Stripe identifiers and payment status, never card or bank numbers.
• Technical data. Device type, app version, IP address, and error reports, used to keep the service working.

• To run the service: sign you in, understand your requests, and carry them out (create records, schedule jobs, send proposals and invoices, text customers when you ask).
• To send you service messages such as login codes and, if you enable them, reminders about your own schedule and unpaid invoices.
• To improve HeyFred, fix problems, and prevent abuse.
• To bill you and pay you out.

We do not sell your information, and we do not use your customers' contact details for our own marketing.

Before your first AI request, HeyFred explains the data and recipients below and asks you to choose whether to allow sharing. Signing in, accepting general terms or granting microphone or camera access does not grant AI-sharing permission. You can decline and continue to view and edit your business records manually.

• OpenRouter and Anthropic (Claude): typed messages, voice-note transcripts, conversation history and relevant business records for understanding requests and drafting replies. Those records can include customer names, contact details, job addresses, notes, invoice details and email content you ask Fred to use.
• Cloudflare Workers AI using Deepgram models: voice recordings you choose to transcribe and Fred’s reply text when you request spoken audio.
• OpenRouter and Google (Gemini): the photo, sample invoice or logo you select, your instructions and relevant business or design details for photo and design analysis.
• OpenRouter and Recraft: your business trade and the description you enter to generate logo options.
• OpenAI: microphone audio during Live conversations, conversation context and relevant business records needed to answer you and carry out your requests.

Only the services needed for the feature receive its data. We restrict AI routing to the named providers. You can withdraw permission in Settings → Privacy → AI data sharing in the app, or Settings → Privacy & account on the web. Withdrawal prevents new requests and asks active Live conversations to close; a request already sent may finish. A changed disclosure requires a new choice.

We require service providers handling personal data for us to provide the same or an equal level of protection as this policy: use limited to the service, confidentiality, appropriate security, and retention and deletion controls. Our service agreements and the providers’ applicable data-protection terms govern this processing. We do not sell personal information or authorize providers to use it for their own advertising.

• The AI providers named above process the data described for their specific features. AI sharing is optional and subject to your in-app permission.
• Cloudflare hosts our service, database, stored files and speech processing.
• Telnyx, The Campaign Registry and messaging carriers process login and customer texts, delivery information and business registration details.
• KeyKeeper processes service emails and replies delivered through HeyFred’s email service. Google or Microsoft processes messages through Gmail or Outlook when you connect that mailbox.
• Stripe handles subscriptions and customer payments. We store identifiers and status, not full card or bank details.
• Apple and Google provide app distribution and optional web sign-in. Expo and Apple or Google push services deliver notifications when you enable them.

Cloudflare states that Workers AI content is not used for model training without explicit consent. OpenAI states that API content is not used for training by default and may retain abuse-monitoring data for up to 30 days, with legal and safety exceptions. OpenRouter offers provider data-use controls; our chat and analysis requests exclude providers that collect data for training. Provider processing may occur in the United States and other countries where they operate.

Provider details: Cloudflare Workers AI, OpenAI API data controls, and OpenRouter data practices.

• HeyFred login texts are a separate program: you choose SMS consent on the sign-in screen, enter your number, and request a one-time code. One code is sent per request. Email and Google sign-in are available on the web without SMS consent.
• Customer messages belong to the contractor’s business, with its own registration, dedicated number, and customer consent. We record the phone number, consent wording and version, source, date, and opt-out events. Providing a number alone is not consent.
• Message frequency varies. Message and data rates may apply.
• Anyone can reply STOP to stop receiving texts and HELP for help.
• Phone numbers and SMS opt-in information are not shared with third parties or affiliates for marketing purposes.

We keep your account and business records while your account is active. HeyFred discards submitted voice recordings after transcription; transcripts and resulting records stay in your account. Saved device drafts remain until sent, discarded or cleared during account deletion on that device.

You can permanently delete your account inside the app at Settings → Delete account, or on the web at Settings → Privacy & account → Delete account. Review the affected businesses, choose a successor if you are the only owner of a shared business, and type DELETE to confirm. You do not need to call or email us. The app shows a completion screen and signs you out.

Confirmation removes your identity, sessions, private Fred conversations, personal drafts and mailbox access from the active database. A business with no other members and its records are also deleted. Shared business records remain with the other members, as explained before confirmation. Existing copies of messages and documents sent to other people are not recalled.

Stored-media cleanup and requests to service providers are completed within 30 days. Database backup copies expire within 30 days and are not used to restore a deleted account to active use. Providers may retain payment, fraud-prevention or other records required by law. We retain the minimum SMS opt-out information needed to respect a person’s request not to be contacted, and an anonymous deletion receipt for up to 30 days so an interrupted request can be confirmed.

• You can see and edit your business records in the app, withdraw AI-sharing permission, disconnect a mailbox, or delete your account in Settings.
• You can ask us for a copy of your data, or to correct or delete it, by emailing lennart@heyfred.ai.
• Residents of California, the EU, the UK, and other regions with privacy laws have additional rights, including the right to know, delete, and object; the same email address handles those requests.

Data is encrypted in transit and at rest. Access to production systems is limited to the people who run the service. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you.

HeyFred is a business tool for adults. We do not knowingly collect information from anyone under 18.

If we change this policy in a meaningful way, we will update the date above and let you know in the app.