Privacy Policy

This Privacy Policy describes how Savvy Sales AI LLC, a Wyoming limited liability company (“Hylo,” “we,” “us,” or “our”) collects, uses, stores, and shares information in connection with the Hylo application for the connected CRM platform (the “Platform”), available as a marketplace app embedded at app.hylo.pro and through the Hylo platform at hylo.pro (collectively, the “Service”).

By installing, accessing, or using the Service, you agree to the practices described in this Privacy Policy.

Hylo is an automation assistant for the Platform. It connects to your connected account, provides an AI chat interface, and executes the Platform's API actions on your behalf (for example, creating contacts, sending conversations, managing opportunities and workflows).

• Company: Savvy Sales AI LLC (Wyoming, USA)
• Website: https://hylo.pro
• Privacy contact: david@savvysales.ai

2.1 Connected account data (via OAuth)

When you install the Service from the app marketplace, you authorize Hylo through the Platform's OAuth flow. We request a broad set of the Platform's permission scopes (currently more than 100 scopes) so the Service can read and act on your Platform data on your instruction. Depending on the actions you take, this may include:

• Contacts and their fields, tags, and notes
• Conversations and messages
• Opportunities and pipelines
• Workflows and automations
• Calendars, appointments, and other Platform objects accessible through the Platform's API

Hylo accesses this data only to perform the operations you request through the chat interface or that you have configured. We do not browse or harvest your Platform data for unrelated purposes.

2.2 Authentication and identity data

• We authenticate you via the Platform's single sign-on (SSO) when the app loads inside the Platform's embedded view.
• We store identifiers such as your sub-account ID and user/account identifiers needed to scope your data and connections.
• When an AI assistant connects to Hylo, we log the time, IP address, and client software of each connection attempt, for security and abuse prevention.

2.3 Chat content, AI requests, and uploaded files

• Chat messages you send to the AI assistant, and the assistant's responses.
• AI request records: if you connect Hylo to your own AI assistant (for example ChatGPT or Claude), we record each request it makes through Hylo: the operation, its inputs, and the Platform data returned. We use these records for support, debugging, and abuse prevention, including review by an automated diagnostic agent that we operate to find and fix failed requests (see Sections 4 and 6). They are deleted from our database after 90 days.
• Uploaded files, including images and PDFs (from which we extract text). These are used to generate AI responses to your requests. Files are stored in Supabase Storage at unguessable links; anyone who has a link can open the file.

2.4 Billing and usage data

• Wallet and billing records for the prepaid token wallet (per sub-account), processed through Stripe.
• Usage logs recording, for example, token consumption and which operations were run, used for billing, support, and abuse prevention.
• Account records: for hylo.pro accounts, we keep your email address and subscription status in our own customer records, which we manage on the Platform.
• We do not store your full payment card details. Card data is collected and processed by Stripe; we receive only limited information such as transaction status and identifiers.

2.5 Credentials you provide

• The Platform's OAuth tokens are stored encrypted at rest (Fernet encryption).
• Private integration tokens you add for a sub-account, and the workflow builder credential if you connect it, are stored encrypted the same way.
• API keys and AI connector secrets that we issue to you are stored in our database only as one-way hashes. Connectors that carry their secret in the connection URL may also appear in our hosting provider's request logs, which are kept for about 30 days.

We use the information described above to:

• Operate the Service and execute the Platform actions you request;
• Generate AI assistant responses to your messages and uploaded files;
• Authenticate you and maintain your session;
• Process billing, maintain your token wallet, and prevent abuse;
• Provide support, debug issues, and improve reliability and security of the Service.

We do not sell your personal information. We do not use your Platform data or chat content to train our own models.

The Service is an AI assistant. To generate responses, your chat messages, relevant context, and the content of files you upload are transmitted to a third-party Large Language Model (LLM) provider.

• Hylo uses Anthropic (Claude) as the LLM provider.
• If you use Hylo through your own AI assistant (for example ChatGPT or Claude) instead of the chat in the Hylo app, the Platform data your assistant requests is returned to that assistant and handled under your agreement with its provider.
• Separately, the automated diagnostic agent described in Section 2.3 may process AI request records with OpenAI or Anthropic models to find and fix failed requests.

The LLM provider processes this content to produce a response, which is returned to you through the Service. Your use of the AI features is therefore also subject to the privacy practices of the LLM provider. Please review their policy:

• Anthropic — https://www.anthropic.com/legal/privacy
• OpenAI — https://openai.com/policies/privacy-policy

Do not submit information through the AI chat that you are not authorized to share with this third-party provider.

• Encryption at rest: All application data is stored in databases that our provider encrypts at rest. In addition, the credentials listed in Section 2.5, and the message text and tool results of chats in the Hylo app inside the Platform, are encrypted by Hylo itself (Fernet symmetric encryption).
• Hosting: Our backend runs on Render (Oregon, United States). Application data is stored in a Supabase-managed PostgreSQL database and Supabase Storage, hosted in the United States (us-west-2). Our automated diagnostic agent runs on Hetzner, also in the United States.
• Transport security: Data is transmitted over encrypted (HTTPS/TLS) connections.
• Access controls: Stored connections, chat history, and wallets are scoped per user and per sub-account.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We share data with the following third-party service providers (“sub-processors”) strictly as needed to provide the Service:

• Connected CRM platform — The platform the Service integrates with. Data shared: connected account data via API and OAuth.
• Anthropic — LLM provider for AI responses, and one of the model providers for our diagnostic agent. Data shared: chat messages, context, file content, and excerpts of AI request records.
• OpenAI — Model provider for our diagnostic agent. Data shared: excerpts of AI request records.
• Hetzner — Hosting for our diagnostic agent (United States). Data shared: the AI request records it reviews.
• Supabase — Database, sign-in, and file storage. Data shared: all stored application data, including chat history, AI request records, and uploaded files.
• Render — Backend hosting. Data shared: application data processed by the backend, including operational and request logs.
• Vercel — Hosting for our web applications. Data shared: request metadata such as IP address.
• Resend — Account email (for example, trial notices). Data shared: your name and email address.
• GitHub — Code hosting and internal issue tracking. Data shared: details of failed operations, which may include record identifiers or values from the failed request.
• Stripe — Payment processing for the token wallet. Data shared: billing/transaction data and payment details.

• We retain your Platform OAuth tokens, chat history, uploaded files, wallet/billing records, and usage logs for as long as your installation is active and as needed to provide the Service.
• Upon uninstall (see Section 8), we clean up your stored OAuth tokens.
• We may retain certain records (such as billing records and usage logs) for a longer period where required for legal, accounting, tax, or fraud-prevention purposes.
• You may request deletion of your data as described in Section 9.

AI request records (Section 2.3) are deleted from our database after 90 days; excerpts held by the providers listed in Section 6 are subject to their own retention. We do not apply fixed retention windows to other data: we retain it until you delete it or request deletion, except where longer retention is required for the legal, accounting, tax, or fraud-prevention purposes noted above.

When you uninstall the Hylo app from the Platform, the Platform sends an UNINSTALL webhook to our backend. On receiving it, we clean up the stored Platform OAuth tokens associated with your installation so the Service can no longer access your connected account.

Other data (such as chat history, wallet balances, and usage logs) may persist after uninstall as described in Section 7. To request full deletion, contact us per Section 9.

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information;
• Object to or restrict certain processing;
• Export your data in a portable format.

To exercise these rights, contact us at david@savvysales.ai. We will respond within the timeframe required by applicable law.

You can also disconnect the Service at any time by uninstalling the app from the Platform.

The Service is intended for business use and is not directed to children under the age of 16. We do not knowingly collect personal information from children.

Our servers and databases are located in the United States. Your information may therefore be processed and stored in a country other than your own, including by the sub-processors listed in Section 6. Where required, we rely on appropriate safeguards for such transfers.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

Questions about this Privacy Policy or our data practices?

• Company: Savvy Sales AI LLC (Wyoming, USA)
• Email: david@savvysales.ai
• Website: https://hylo.pro