1. Scope

This Privacy Notice explains how Heho.ai handles personal data and workspace data when you use the service. This notice is effective as of March 7, 2026, and was last updated on March 23, 2026.

2. Product reality: private workspace

Heho.ai is currently a private workspace product. Lyrics and projects are private by default. Heho.ai currently does not provide a public lyrics publishing feature. Access is limited to the account owner and authorized workspace collaborators.

3. Person responsible for personal information protection

Under Quebec's Act respecting the protection of personal information in the private sector (Law 25), the person with the highest authority within the organization is responsible for personal information protection by default.

For questions, access requests, or complaints related to personal information, contact support@heho.ai.

4. Data we collect

Account and workspace data

• account identifiers (such as email and authentication IDs);
• organization and workspace identifiers;
• role and permission settings.

Billing and subscription data

• plan tier, billing status, and subscription metadata;
• transaction references from payment providers.

Heho.ai does not intentionally store full payment card numbers. Payment processing is handled by Stripe.

Product content data

• lyrics, project structures, and editing history;
• chat sessions and prompts used for writing assistance;
• imported or exported text artifacts.

Technical and usage data

• device and browser data, IP address, and request metadata;
• logs for errors, security events, and performance monitoring.

Cookies and browser storage

We use strictly necessary cookies for authentication, payment processing, and preference management. We do not use advertising, marketing, or behavioral tracking cookies. For a complete list of cookies and browser storage technologies used, see our Cookie Policy.

5. How we use data

We use data to:

• provide and operate core features;
• secure accounts and prevent abuse;
• process subscriptions and billing;
• provide support and respond to requests;
• maintain and improve quality, reliability, and safety.

Heho.ai may use your prompts, inputs, outputs, workspace content, and related usage data to operate, train, improve, and evaluate product features, including AI-enabled features, directly or through third-party AI providers.

If we materially change how we use data, we will update this Privacy Notice before those changes take effect.

6. Consent

Where required by law, we collect and use personal information based on your consent. Consent is obtained at or before the time of collection, and is specific to each stated purpose.

You may withdraw your consent at any time by contacting support@heho.ai or, for cookies, by using the cookie settings option in the site footer. Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal. If you withdraw consent for data that is necessary to provide the service, some features may become unavailable.

7. Data sharing

We do not sell personal data. We share data only when necessary, including:

• service providers for hosting, authentication, billing, and infrastructure;
• legal disclosures when required by law or to protect rights, safety, and security;
• transaction-related disclosures during merger, acquisition, or asset transfer.

Service providers are expected to process data under contractual safeguards. This includes providers such as Clerk (authentication), Stripe (payments), Sentry (error monitoring), and third-party AI infrastructure providers.

8. Retention and deletion

We retain data while your account is active and as needed to provide the service. After account closure or deletion requests, we delete or de-identify data within reasonable operational timelines, except where retention is required for legal, security, fraud-prevention, or backup integrity purposes.

9. International data transfers

Heho.ai and its service providers may process data outside of Quebec and Canada, including in the United States. The following services process data in the United States: Clerk (authentication), Stripe (payments), Sentry (error monitoring), and Vercel (hosting).

Before transferring personal information outside Quebec, we conduct a privacy impact assessment as required by Law 25. Transfers are made only when the destination jurisdiction provides adequate protection, or when contractual safeguards are in place to provide an equivalent level of protection.

10. Security

We use technical and organizational safeguards designed to protect data, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights

Depending on your location, you may have the following rights:

• Access: request a copy of the personal information we hold about you;
• Rectification: request correction of inaccurate or incomplete information;
• Deletion: request deletion of your personal information, subject to legal retention requirements;
• Portability: request a copy of your personal information in a structured, commonly used format;
• Withdrawal of consent: withdraw consent at any time, as described in Section 6;
• De-indexing: request that personal information indexed by a search engine cease to be disseminated, where applicable.

To exercise any of these rights, contact support@heho.ai. We may need to verify your identity before completing a request. We will respond within 30 days of receiving a complete request, or within the timeframe required by applicable law.

12. Children and sensitive data

Heho.ai is not intended for children under the age of majority in their jurisdiction. Do not upload sensitive personal data unless the service explicitly supports that use case.

13. Incident response

In the event of a confidentiality incident involving personal information that presents a risk of serious injury, we will notify the affected individuals and the relevant supervisory authority as required by applicable law, including Quebec's Commission d'acces a l'information where applicable.

14. Changes to this notice

We may update this Privacy Notice from time to time. If changes are material, we will provide notice in-app, by email, or both, with an updated effective date.

15. Contact

For privacy questions, access requests, complaints, or to exercise any of the rights described in this notice, contact support@heho.ai.