Privacy Policy

1. Data controller

Controller: Mykhailo Sheludiakov, private entrepreneur (ФОП), Ukraine

Contact for privacy requests: mykhailo.sheludiakov@gmail.com

Registered address: 49003, Ukraine, 54 Sichovykh Striltsiv Street, apartment 4, Dnipro · Registration: 3134816897

2. What we collect

Depending on features you use, we may process:

• Account data: email, authentication identifiers, preferences, language.
• Capture data: text notes, voice transcripts (not permanent raw audio per our architecture), image-derived text.
• Life context: goals, habits, relationships, documents, reflections, AI-generated summaries.
• Usage metadata: token usage, feature usage counts, crash/error diagnostics (no capture content in logs).
• Payment metadata: subscription status via payment providers (we do not store full card numbers).
• Integration data (when you connect or import): calendar availability and scheduled events (Google Calendar), email thread content you choose to import (Gmail), chat exports (Telegram/WhatsApp/Viber), and assisted-connection metadata (Tinder).

3. Personal data about people you mention

Hephaestus is built for personal reflection, and that often means recording facts about people in your life — relationships, personal details, action items tied to a named person — who are not Hephaestus users themselves and have not agreed to this Policy directly.

We process this data on the basis of legitimate interest (yours, and ours in providing the feature) in helping you maintain your own personal and professional relationships. You are responsible for recording only what is appropriate given your relationship with that person and the context.

This data is protected with the same technical safeguards as your own (encryption at rest, access controls) and is deleted when you delete the relevant entry or your account.

If someone you have mentioned wants to exercise a data-subject right (for example, access to or erasure of what is recorded about them), they can contact us at mykhailo.sheludiakov@gmail.com; we will facilitate this directly or via your account as appropriate.

4. Why we process data

Purposes and typical legal bases:

• Provide the service (contract).
• AI transcription, extraction, and assistance (contract + your in-app consents).
• Security, fraud prevention, and abuse detection (legitimate interests).
• Waitlist or marketing email only with your separate opt-in (consent).
• Legal compliance and responding to requests (legal obligation).

5. AI processing

AI features send minimized/redacted content to orchestrated providers (e.g. OpenAI) to transcribe, extract structure, and assist you. We do not use your content to train public models without your explicit consent.

You can review in-app consents for AI processing, transcription, and related features.

6. Regional storage

Personal data is processed on Google Cloud Platform. Target regions by market: default {{GCP_REGION_DEFAULT}}; EU users {{GCP_REGION_EU}}; India users {{GCP_REGION_INDIA}}. We update this section as regional deployment is finalized.

7. Sub-processors

We use trusted processors including:

• Google Cloud Platform (hosting, infrastructure)
• OpenAI (AI inference, transcription when configured)
• Google (Sign-In OAuth, Calendar API, Gmail API when you connect integrations)
• Stripe / Razorpay / Paystack (payments, by region)
• MailerSend (transactional and waitlist email)
• Expo (push notification delivery)

8. Retention

We retain personal data while your account is active and as needed to provide the service. Raw audio/images are not permanently stored. On account deletion, we erase personal data subject to lawful retention limits.

9. International transfers

Some processors are located outside your country (including the United States). We use appropriate safeguards such as Standard Contractual Clauses where required.

10. Your rights (GDPR / Ukraine)

Depending on your location, you may have the right to access, rectify, erase, restrict, object, and port your data, and to withdraw consent. Use in-app export/delete or email us.

You may lodge a complaint with a supervisory authority (e.g. Ukraine DPA or your EU member state authority).

11. India — DPDP 2023

For users in India, Mykhailo Sheludiakov acts as Data Fiduciary. Grievance Officer: Mykhailo Sheludiakov, mykhailo.sheludiakov@gmail.com.

You may contact the Grievance Officer for complaints regarding processing of your personal data. We will respond within timelines required by applicable Indian law.

Rights may include access, correction, erasure, grievance redressal, and nomination of another person to exercise rights on your behalf where applicable.

12. Africa — Nigeria (NDPA), South Africa (POPIA), Kenya (Data Protection Act)

If you are in Nigeria, South Africa, or Kenya, Mykhailo Sheludiakov processes your personal data under the Nigeria Data Protection Act (NDPA) 2023, South Africa's POPIA, and Kenya's Data Protection Act 2019 respectively.

You may access, correct, delete, object to, and (where applicable) port your data, and withdraw consent — via in-app export/delete or mykhailo.sheludiakov@gmail.com.

You may complain to your national authority: the NDPC (Nigeria), the Information Regulator (South Africa), or the ODPC (Kenya). Where required by volume or risk thresholds, we will register locally and appoint a Data Protection Officer / Information Officer.

Cross-border transfers are made under the safeguards required by each of these laws.

13. Children

The service is not intended for anyone under 18.

14. Changes

Last updated: 2026-07-09. We will post material changes on this page.