Privacy Policy

Last updated: 5 November 2026

This Privacy Policy explains how Area2 (HK) Limited (“Area2”, “we”, “us”, or “our”) collects, uses, and shares personal data in connection with the HeyCS platform, mobile apps, and website at https://dashboard.heycs.app.

1. Who we are

The data controller for account and platform administration data is Area2 (HK) Limited, a company incorporated in Hong Kong, operating the HeyCS service.

When you use HeyCS to communicate with your own customers, you typically act as the controller of that customer data, and Area2 processes it on your instructions as a processor / service provider (as applicable under relevant law).

2. Data we collect

Account data: name, email, organisation name, authentication data, role/permissions.
Service data: conversations, messages, contacts, files, notes, and configuration you store in HeyCS.
Usage / technical data: IP address, device/browser information, logs, approximate location derived from IP, and product analytics needed to operate and secure the Service.
Support communications: messages you send to us about the Service.

2a. Google account and Gmail data

Google sign-in: when you choose to sign in with Google, HeyCS accesses your name, email address, and profile picture to identify your HeyCS account and display your profile. Signing in does not grant HeyCS access to your Gmail messages.

Gmail inbox connection: only when you separately authorise a Gmail inbox connection, HeyCS accesses the connected mailbox's messages, message headers (including sender and recipient email addresses), and attachments to import customer conversations and send replies from HeyCS. We store OAuth access and refresh tokens to maintain the connection without your Google password. The Gmail API integration being submitted for Google verification requests gmail.readonly to read messages and attachments and gmail.send to send customer replies. It does not request permission to delete messages or modify mailbox settings. This integration will be activated only after Google approves the requested permissions. Existing IMAP/SMTP connections previously authorised with https://mail.google.com/ continue using their existing grants until their owners reconnect after approval. That legacy permission permits reading, composing, sending, and permanently deleting Gmail messages; HeyCS uses it for inbox synchronisation and customer replies and does not delete imported messages from Gmail.

Use and sharing: Google user data is used to provide the features you enable, including sign-in, the shared inbox, customer replies, and AI-assisted features you choose to use. Imported conversations are available to the workspace members you authorise. Our hosting and storage providers process this data to operate HeyCS; Google receives messages sent through your connected Gmail inbox. If you enable AI-assisted processing of a conversation, its relevant content may be sent to the AI service providers identified in section 3a to generate a reply or summary. We do not sell Google user data, use it for advertising, or use Google Workspace API data to develop, improve, or train generalised or non-personalised AI or machine-learning models.

Limited Use: HeyCS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Transfers are limited to providing the user-facing features you request, security and abuse prevention, legal requirements, or a business transfer subject to the protections in that policy. Human access to this data is limited to your authorised workspace users, your explicit consent for specific data, security investigations, or legal requirements.

Protection and retention: we use HTTPS for the public HeyCS service and Google OAuth exchanges, keep integration tokens on the server, and restrict access through workspace roles and permissions. Imported messages, attachments, and associated records are retained for the service and the retention purposes described in section 7. Tokens are retained to support the connection until the integration or account is deleted, subject to applicable retention requirements.

Your controls: you can disable or delete the Gmail inbox connection in HeyCS and revoke HeyCS's access in your Google Account connections. Revoking access stops future authorised access to Google; it does not automatically delete conversations already imported into HeyCS. To request deletion of imported Google data and associated tokens, follow our User Data Deletion instructions or contact [email protected].

3. How we use data

to provide, maintain, secure, and improve the Service;
to authenticate users and prevent abuse or fraud;
to communicate service notices, security alerts, and (where permitted) product updates;
to comply with law and enforce our Terms of Service;
with your direction, to process Customer Content for AI-assisted features you enable (for example suggested replies or knowledge retrieval).

3a. AI processing and your choices

AI features process the information supplied through your workspace and connected channels. This can contain personal data about you, your colleagues, and your customers. Depending on the feature you request, the data sent includes:

Writing assistance: your draft text for spelling, grammar, and tone changes. Improving a reply also includes conversation history, contact details, and conversation attributes.
Summaries and suggested replies: the conversation's message text, channel, conversation identifier, creation time, and custom conversation attributes. Suggested replies also use the agent's name and configured message signature. Personal details within messages are included even where separate contact fields are omitted.
Follow-up instructions: your additional instruction, the original task context, previous AI output, and the refinement history.
Knowledge and automated replies: the websites, documents, FAQs, conversation context, and connected-tool results used to answer an enquiry. Knowledge text is also processed to create searchable embeddings.
Image and audio understanding: images submitted to an AI-enabled conversation may be analysed; voice messages may be transcribed. Extracted text and transcripts can then be included in subsequent AI requests.

AI providers: HeyCS primarily uses MiniMax AI models for its AI features. We also use Alibaba Cloud / DashScope, including for knowledge embeddings. The relevant information described above is sent to these providers as needed for the AI features enabled in your workspace.

Your choice: AI writing assistance is optional. In updated versions of the mobile app, the AI sharing prompt describes the information and recipients before each requested generation or refinement. Choose “Allow this request” to send the data, or “Cancel” to continue without that AI request. Viewing this policy or granting camera or microphone permission does not itself authorise AI sharing. Workspace administrators control automated assistants, connected channels, knowledge sources, and transcription settings; they must ensure the people whose data they submit receive the required notice and that they have permission or another applicable legal basis to process it.

Protection and provider use: we require AI service providers to protect personal data with confidentiality, security, retention/deletion, and applicable transfer safeguards that provide the same or equivalent protection as this policy. We remain responsible for selecting providers and handling your privacy requests. We do not sell your personal data or use AI inputs for advertising. Provider processing is governed by the applicable service terms and published privacy policies linked below. These describe security, operational use, retention, and rights to access, correct, or delete data. Depending on those terms, providers may also use de-identified inputs and outputs to improve their services; this can include model improvement where their terms permit it. We do not promise that all providers offer zero retention or prohibit all model training. For mobile writing assistance, cancel the AI request if you do not wish to share data. Workspace administrators can disable automated assistants and audio transcription through the relevant settings. Contact us to request access, correction, deletion, or assistance with a provider's processing.

MiniMax Open Platform Privacy Policy and service terms.
Alibaba Cloud Privacy Commitment (including knowledge embeddings).

Generated results and transcripts can be stored with your workspace data under section 7. You can review AI suggestions before sending them as customer replies. AI output can be inaccurate; avoid submitting information you are not authorised to share. Requests to access or delete data, including data processed by AI providers, can be made using the contact and deletion instructions below.

3b. Camera, photos, and microphone

The mobile app requests camera access when you choose to take a photo or video to attach to a customer conversation, for example a photo showing a product's condition. It requests microphone access when you choose to record a voice reply, and photo-library access when you choose an existing image or video to attach. These attachments are uploaded to HeyCS and shared with the recipients of the conversation when you send them. If AI image analysis or transcription is enabled for that conversation, the relevant media is also processed as described in section 3a. You can deny or revoke device permissions in system Settings and continue using text-based messaging.

4. Legal bases (where applicable)

Depending on your location, we may rely on: performance of a contract; legitimate interests (such as securing and improving the Service); consent (where required); and legal obligations.

5. Sharing

We may share personal data with:

infrastructure and subprocessors that host or help deliver the Service (under appropriate contracts);
channel providers you connect (for example WhatsApp / Meta or other messaging platforms) as needed to send and receive messages;
professional advisers or authorities when required by law or to protect rights and safety;
a successor entity in connection with a merger, acquisition, or asset transfer, subject to appropriate safeguards.

We do not sell your personal data.

6. International transfers

Data may be processed in Hong Kong and in other countries where we or our subprocessors operate. Current AI service endpoints include mainland China, so information submitted to AI features may be processed and stored there. Where required, we use appropriate transfer safeguards.

7. Retention

We retain personal data for as long as needed to provide the Service, meet legal/accounting requirements, resolve disputes, and enforce agreements. You may request deletion of your data as described on our User Data Deletion page, subject to legal retention needs and technical limitations.

8. Security

We implement technical and organisational measures designed to protect personal data. No method of transmission or storage is completely secure; please use strong passwords and control access within your organisation.

9. Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability. To exercise rights relating to your HeyCS account, contact us using the details below or follow the User Data Deletion instructions. If we process Customer Content as your processor, we will assist you in responding to your end users’ requests in accordance with our agreement with you.

10. Children

The Service is not directed to children under 16 (or a higher age required in your jurisdiction). We do not knowingly collect personal data from children for HeyCS accounts.

11. Cookies

We use cookies and similar technologies for authentication, security, preferences, and analytics necessary to run the dashboard. You can control cookies through your browser settings; disabling some cookies may affect Service functionality.

With your permission, Google Ads measures application-button clicks and confirmed payments on heycs.app and its dashboard. Payment events include the paid invoice reference, amount and currency; form fields and conversation content are not included. You can allow or decline when prompted, and reset your choice by clearing this site’s cookies in your browser settings. Advertising personalisation and enhanced user-data sharing remain disabled.

12. Changes

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. Material changes may also be notified in-product or by email.

13. Contact

Privacy and data requests:
Area2 (HK) Limited
Email: info@area2.com
Service: HeyCS — https://dashboard.heycs.app