This policy explains what HeyBMO collects, why, who helps us handle it, and the choices you have. It covers heybmo.com, the app at app.heybmo.com, the Windows app, the HeyBMO command line tool and the HeyBMO connection for AI apps. Questions: privacy@heybmo.com.
01The short version
- We collect what we need to run your account and keep it safe, and nothing more.
- Your data is yours. We do not sell it, we do not show advertising, and we do not use it to train AI models.
- HeyBMO has no AI of its own. When you connect an AI app such as Claude or ChatGPT, it reads and changes only what you allow, and its provider handles that data under its own privacy policy.
- You can see, export and delete your data at any time.
02Who we are
HeyBMO is run by an individual based in Morocco, who is the controller of your personal data. We follow Moroccan law No. 09-08 on the protection of personal data, and, for people in the United Kingdom and the European Union, the UK GDPR and the EU GDPR. You can reach us at privacy@heybmo.com.
03What we collect
- Account details: your name, email address and password. Passwords are stored only as a secure hash; nobody can read them.
- Google sign-in: if you sign in with Google, we receive your name, email address, profile picture and Google account id. We do not get access to your Gmail, Drive, Calendar or contacts.
- What you store in HeyBMO: your expenses, debts, notes, files, reminders, lists and anything else you add through the features you switch on.
- Files and pictures: files you upload are stored with your account. To make them searchable, the text inside pictures and PDFs is read on our own servers; no outside service sees them.
- Connections: the AI apps and command line sessions you connect, what each may use, when they were connected and when they were last used.
- Notifications: if you allow notifications, a notification address for your browser or device, so reminders can reach you.
- Security information: IP address, browser or device type and sign-in times, used to keep your account safe and stop abuse.
- Usage information: which features and actions are used, from where (web, command line or an AI app), whether they worked and how long they took. This never includes the content you store.
- Payments: if you buy a paid plan, our payment provider Creem collects your card and billing details. We receive only your name, email, country, plan, subscription status and invoice references, never your full card number.
- Cookies: only the ones needed to keep you signed in and protect forms. See the cookie policy.
04People you mention
You may store details about other people, for example who owes you money or a name in a note. We process that information only to provide HeyBMO to you. Those people can contact privacy@heybmo.com to exercise their rights.
05Why we use it, and on what basis
- To provide HeyBMO (contract): store your data, run the features you switch on, send reminders you set, and let you and your connected apps reach it.
- To keep it safe (legitimate interests): detect suspicious sign-ins, block abuse and limit how fast requests can be made.
- To improve HeyBMO (legitimate interests): using usage information in summary form.
- To send service emails (contract): confirming your address, resetting your password, security notices and the reminders you choose to receive by email. We do not send marketing emails without your permission.
- To keep tax records (legal obligation): for paid plans, as long as tax law requires, usually six years.
06Google user data
HeyBMO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in data only to create and secure your account.
07AI apps you connect
When you connect an AI app, it can read and change the features you give it, with your account's permissions. What it reads leaves HeyBMO and is handled by that app's provider under its own privacy policy. Deleting data for good or switching a feature off always needs your approval in HeyBMO. You can disconnect any app at any time from Settings.
08Who helps us run HeyBMO
We share data only with services that run HeyBMO for us, and only what each one needs:
- Hetzner (servers in the European Union): stores your account and data.
- Cloudflare: network, security protection and file storage.
- Resend: delivers our emails, including the text of reminders you receive by email.
- Google: sign-in, if you choose it.
- Browser and device notification services (such as those run by Google, Apple, Microsoft and Mozilla): deliver notifications you allow.
- Creem (Armitage Labs OÜ, Estonia): processes payments for paid plans as merchant of record, under its own privacy notice.
Your data is stored in the European Union. Some of these services may process data in other countries. Where data leaves Morocco, the UK or the EU, we rely on the protections each law requires, such as adequacy decisions, standard contractual clauses or approval from the relevant authority.
We may disclose information if the law requires it, and we will tell you when we are allowed to.
09How long we keep it
- Your data is kept while your account is open.
- When you delete your account, your data is deleted within 30 days, and removed from backups as they expire within a further 30 days.
- Security records are kept for up to 90 days.
- Records of payments are kept as long as tax law requires.
10Your choices and rights
- See and export your data, correct it, or delete it, in the app or by writing to privacy@heybmo.com.
- Disconnect any AI app or command line session at any time.
- Turn off notifications in your browser, device or HeyBMO settings.
- Object to how we use your data, or ask us to limit it.
- If you are not happy with our answer, you can complain to the data protection authority where you live: the CNDP in Morocco, the Information Commissioner's Office in the UK, or the authority of your country in the European Union.
11Security
Connections are encrypted, passwords are hashed, and each person's data is kept separate inside the database itself, so one account can never read another's. If you find a security problem, write to security@heybmo.com.
12Children
HeyBMO is not for children under 16, and we do not knowingly collect their data.
13Changes
If this policy changes, we will update the date at the top. For important changes, we will also tell you by email before they apply.