Privacy Policy

Who is responsible for your data

Hailmo is run by Respiresoft LLC, 32 N Gould St, Sheridan, WY 82801, United States. Respiresoft LLC is the controller of your personal data: it decides why and how the data described on this page is used. Privacy questions and requests go to the contact address at the end of this page. For the chats a business keeps online and the orders it receives, see “How your messages are stored”.

What we collect

Your account email address and the display name you choose; a phone number, only if you add one (it is optional, and nobody can find you by it until it is verified); the messages you send and receive, and the photos, videos, voice notes and files you attach — sealed so that we cannot read them wherever a chat is end-to-end encrypted (see “How your messages are stored” below); a record of your calls — who, when and for how long, never what was said; your location, only when you choose to send it in a message, to share it live with a chat for a time you choose, or to tap “Near me” to find businesses close to you (for “Near me” your position is sent to our server for that one search and is not stored) — never otherwise. When you search for a place or open a map, the words you search for and the map area on your screen are sent to our server to answer; our application does not keep them with your account, but our server can see them while it answers; the orders you place with a business (what you ordered, the totals, the status and any note you add); the questions you ask the Hailmo assistant, only after you agree to the screen that comes first (see “Who processes your data”); a notification token for your device, if you turn notifications on; and, if you protect your account with them, your two-step PIN — kept only as a one-way fingerprint, never the PIN itself — and, for each passkey you add, its public key, a name, the kind of passkey and when it was added and last used (a passkey's private key never leaves your device or its password manager). About each phone or browser you sign in on: its make and model, its operating system, browser and app version, its screen size, processor, memory and graphics chip, its language and time zone, the internet (IP) address it connects from (the first and the latest, kept as they are, not shortened) and the browser or app identification string, which we delete 30 days after the device was last used; and identifiers of the device and of the app install, which we keep only as one-way fingerprints. Your notification token is kept as it is, because it is needed to send you notifications, and is deleted when the device is removed. If you choose to find your contacts on Hailmo, the phone numbers in your contacts are sent to our server as they are (not scrambled) to check which of them belong to people here; they are compared and then forgotten — never stored or logged. We have no address field and take no payment or card details: Hailmo has no in-app payment, and an order only records what you asked for (you settle with the business yourself). Anything you write in an order note, such as a delivery address, goes to the business with the order.

Your age and your date of birth

You must be at least 16 to use Hailmo, or older where the law of your country sets a higher age. Business accounts and the Hailmo assistant are for people aged 18 or older. If we find an account that belongs to someone under 16, we close it and delete its data. We ask for your date of birth once, when you sign up, to check that you are old enough, and that check is done by our software: under the minimum age you cannot create an account. We never store the date itself. We keep only whether you are 18 yet and, if you are not, the month you turn 18, so we know when business accounts and the AI assistant open up to you.

Why we collect it

Every item above exists to run the messaging service itself: creating and signing you into your account, delivering your messages and attachments to the people and businesses you message, showing a business the conversations it is part of, and sending you a notification when you ask for one. The details of the phone or browser you use are kept to protect accounts and the people on Hailmo: to show you where you are signed in, to recognise the same device behind more than one account, and to notice an account we closed for abuse coming back. They alone never sign you out or refuse you anything — a person at Hailmo looks first. Our server also writes performance lines to its log: for a message, its identifier and how many milliseconds each step took; for a call, its identifier, the app version and platform, and how long each step of setting it up took and whether it connected directly or through our server. They hold no message text, names, file names, addresses or tokens. Nothing is collected for advertising or for any purpose unrelated to running the product.

On what basis we use your data

Where the law of your country asks for a legal basis, these are ours, for each purpose:

• Running your account and delivering your messages and attachments: this is needed to provide the service you asked for (contract). Without your email address and display name we cannot give you an account.
• Keeping accounts and people safe, including the device details, the automatic checks described below, reports and the handling of abuse: our legitimate interest in keeping Hailmo safe. You can object to this (see “Your rights”).
• The location you choose to share, finding your contacts, notifications and the Hailmo assistant: your consent. You can withdraw it at any time in the app's settings or your device's settings; what was done before you withdrew is not undone.
• Answering valid requests from courts and authorities, and keeping the records the law requires us to keep: a legal obligation.
• Checking your age: our legitimate interest in keeping people under the minimum age out of Hailmo and, where the law requires an age check, a legal obligation.

How your messages are stored

Chats between people are end-to-end encrypted. Each message, photo, file and voice note is sealed on the sender's device and can be opened only by the devices in the chat; calls between people are end-to-end encrypted as well. Messages inside groups of people are end-to-end encrypted too. Our server carries the sealed message, cannot read it, and deletes it once it has reached every device in the chat (or after 30 days if a device never comes back for it). Hailmo's server does not hold the keys that open your messages, so it cannot open a chat by itself. It does hold a copy of the key that unlocks your chat backup (see “How long we keep things”): that backup is the one exception. Your history lives on your own devices and in that backup. What our server does see is what it needs to deliver a message and to apply the rules of a chat: who it is from and to, when, what kind it is (text, photo, voice note and so on), how big it is, whether it is a reply, when it was delivered and read, and the disappearing-message timer. During a call, the other person's device and our call-setup server can see your internet (IP) address. Hailmo's staff cannot set a person's own account to keep its chats online. What is not end-to-end encrypted in this release, even between people: your status updates (text, photos, videos, who can see them, who viewed them and reactions); the name, description, picture and member list of a group, and its invite link; your profile (name, about text, photo, country, last seen); place searches and the map tiles your screen asks for, which tell our server roughly where on the map you are looking; and the phone numbers you send when you ask Hailmo to find your contacts. Link previews: in a chat that is not sealed, the web address you type is sent to our server, which fetches the page to build the preview. In a sealed chat on the phone apps, your phone fetches the page itself, so the website can see your internet (IP) address and our server never sees the link; sealed chats on the web show no preview. You can turn link previews off in Settings.

A conversation with a business is end-to-end encrypted in the same way, unless that business keeps its chats online. A business's conversation belongs to the business: its owners decide which members of its team see it, and the devices of those team members can open it. When a business keeps its chats online — a setting only Hailmo's staff can turn on for a business, and for which your phone asks you first — our server stores a readable copy so the business can search and export its history, and Hailmo's staff can read it when they handle a report or a support request. Such a chat is not end-to-end encrypted, and the top of the chat says so. Not end-to-end encrypted in any case: chats with the Hailmo assistant (it has to read your question), chats with Hailmo's own accounts such as Support (our support staff read and answer them), orders, automatic and broadcast messages from a business, channels, status updates, and group details (see above). Orders in particular are sent in the clear to the business, because an order is the business's own commercial record of a sale: the business's team can read it and it is kept with the business's records. Because it belongs to the business, deleting your account clears the personal note on your orders but the business keeps its record of the sale. For the chats a business keeps online and the orders it receives, the business decides what happens to them on its side and Hailmo keeps them on its behalf; for your account, the business directory and safety, Hailmo is responsible.

Where and how it is stored

Everything is stored on our own server, in a MongoDB database with whole-database encryption at rest (AES-256). File attachments — photos, videos, voice notes and other files — are additionally encrypted individually, with their own rotating keys. Every time one of our staff opens a person's details or a support ticket, the access is recorded in a log. Encryption at rest protects your data if a storage disk were ever physically lost or stolen; it is a real, meaningful protection, but it is not the same claim as end-to-end encryption, and it does not mean the operator of this service can never access what is stored — only that the database and its backups are unreadable without the server's own keys.

Who processes your data

Respiresoft's own server, which hosts the product, its database and its call server. Emails (account verification, password reset, and notices about your account's security and decisions about it) come from Respiresoft's own mail server (respiresoft.com), not a third-party email service. Notifications in a browser travel through the standard Web Push service of your browser or device maker, encrypted so that only your browser can read them. Notifications in the Android app travel through Google's Firebase Cloud Messaging, and notifications on iPhone travel through Apple's Push Notification service (APNs): each receives your device's notification token and a signal that something arrived. The signal may carry the message in an encrypted form that only your phone can open, so all they can tell is that a signal went to your device, when, and its rough size. Otherwise it carries only reference numbers that mean nothing outside Hailmo, and your phone fetches the message from our server. Neither ever receives the text of a message or anyone's name. The Hailmo assistant is optional and asks first: before you can send it anything, a screen names the AI provider and its country and asks you to agree. After you agree, what you type to the assistant (and the earlier turns of that conversation, or a few messages you choose to share with it) is sent through Respiresoft's AI service to the AI provider named on that screen, which is currently DeepSeek, a company processing in China, to write the reply. Sending your text there rests on your consent. In the European Union, the European Economic Area, the United Kingdom, Switzerland and any other place where sending your text to China is not allowed, the assistant uses a different provider or is not available; the screen always names the provider that will receive your text. Nothing else in your chats is ever read or sent. The provider keeps those messages for up to 30 days at present (the screen states the number for the provider in use); we have not given it permission to train a model on them, but we cannot see inside its systems. We keep a record of each request for up to 90 days. The assistant is an artificial intelligence, not a person, and its answers can be wrong. To count your monthly allowance, the AI service is also given a random code per person; it is made from your account by a secret that only our servers hold, and it is not your name, email address or phone number. You can withdraw your agreement in Settings, and nothing more is sent after that. If we change the provider, the screen changes and you are asked again. When you choose a password, our server checks it against known data breaches with the Have I Been Pwned service by sending only the first five characters of a one-way fingerprint of it — never the password or your email. If you choose to continue with Google or Apple, you sign in with them through Google's Firebase Authentication — or, in the iPhone app, through Apple's own sign-in and Google's own sign-in page — which then tells our server your email address (with Apple, it may be an address Apple makes to hide yours), your name and an account number for that sign-in — never your Google or Apple password. You can connect or disconnect each of them in Settings › Security. When you sign up, change your email or invite a colleague, our server checks that the address is a real mailbox — not a temporary-mail service, and on a domain that receives mail — by looking that domain up in the public internet directory (DNS); the address itself is sent to nobody. Maps come from Google Maps (or OpenStreetMap) through our server: when you search for a place, our server sends Google what you typed and the area you are looking at — never your name, account or device — and map pictures are fetched by our server too. “Near me” in the business directory does not use Google: your position goes only to our own server, which looks up listed businesses close to it, and is not kept. Link previews in chats that are not sealed are fetched by our server as well. In a sealed chat on the phone apps your phone fetches the page itself: the website then sees your internet (IP) address, and our server never sees the link. Sealed chats on the web have no link preview. You can turn link previews off in Settings. Stripe and Link, part of Stripe, for assistant purchases: payment, tax and receipts. We never see your card details.

Transfers to other countries

Respiresoft LLC is a company in the United States, so the people who run the service can reach the data we hold from outside your country. Several of the services named above are provided by companies in the United States (Google, Apple, Stripe), and the assistant may send your text to China, as described above, only on your consent. Where the law of your country requires a safeguard for a transfer, write to the contact address below and we will tell you which one applies. If a breach of security puts you at risk, we tell you and the authorities within the time the law gives us.

Automatic checks

Some checks run by themselves: whether your date of birth meets the minimum age; whether a password appears in known data breaches; whether an email address is on a real mail domain and not a temporary-mail service; a comparison of device details, to notice an account we closed for abuse coming back; limits on how fast messages and reports can be sent; and a word filter on public names and listings. None of them closes your account or takes a decision with legal or similarly significant effect on you by itself: a person at Hailmo looks first. If a check stops something you were doing, write to the contact address below and a person will look at it.

No ads, no tracking, no data sale

This product carries no advertising, no third-party analytics SDK, and no tracking of any kind. We do not sell your data, and we do not share it with data brokers or advertisers. Nothing above goes to anyone else except the services named on this page, each only for the job named next to it, and a valid legal request from a court or an authority, which we answer as described on our “Government and legal requests” page and only with what we hold. We do not respond to Do Not Track signals, because we do not track you across sites.

How long we keep things

• Messages in end-to-end encrypted chats, personal or business: not stored past delivery — deleted once they have reached every device in the chat, or after 30 days undelivered.
• Messages of a business that keeps its chats online: kept for as long as the conversation is active, as part of the business’s own record.
• Photos, videos, voice notes and files: in an end-to-end encrypted chat, the sealed file is deleted once every device in the chat has it, or after 30 days. For a business that keeps its chats online: kept for up to 365 days; the business may configure a shorter period, never a longer one.
• Chat backups (kept in your own Google Drive on Android or iCloud on iPhone, not by us): about once a day, at night, the app saves a backup of your messages, photos, voice messages and files (videos only if you choose). The backup is encrypted with a key our server keeps for your account, so it can be restored only by signing in to that account. Because our server holds the key, chat backups are not end-to-end encrypted. You can turn them off in the app's backup settings. Deleting your account deletes the key, and its backups can no longer be opened.
• Our own server backups (a different thing from your chat backups): taken every night, encrypted, and kept for 30 days, so an account you delete, with its search entries and cached copies, has left every one of them within 30 days.
• Device details: the make, model and system of a device and its fingerprints are kept while the account exists. The internet (IP) addresses and browser strings are deleted 30 days after the device was last used. A device's notification token is deleted when the device is removed.
• A data export: made the moment you ask for it and downloaded straight to your device. We keep no copy.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, to object to a use that rests on our legitimate interests, or to receive it in a form you can move to another service. Where a use rests on your consent, you can withdraw it at any time. In the app, Settings → Data & storage gives you the export and the deletion yourself; for everything else write to the contact address at the end of this page. We answer within one month.

If you think we have not handled your data properly, you can complain to the data protection authority of the country where you live or work. In the European Union the authorities are listed at edpb.europa.eu; in the United Kingdom it is the Information Commissioner's Office.

If you live in California or another US state with a privacy law, you can ask what we hold about you and ask us to delete it, using the same contact address. We do not sell or share your personal data.

Exporting and deleting your data

Inside the app, go to Settings → Data & storage to request a machine-readable export of your own data, or to permanently delete your account. If you cannot sign in, use the public account-deletion page below instead.

Delete your account

Changes to this policy

If we materially change what we collect or how we use it, we will update this page and its “last updated” date.

Contact

Hailmo is operated by Respiresoft LLC, 32 N Gould St, Sheridan, WY 82801, United States.

Questions? Email us at support@respiresoft.com.