Privacy Policy

Last updated: August 24, 2026

1. Scope and our roles

Heysegment LLC, a Florida limited liability company ("Heysegment," "we," "us," or "our"), provides a business-to-business Brand Experience Enablement Platform: a software interface for customer-experience workflows, reputation management, content preparation, reporting, and integrations with customer-selected communications services. This Privacy Policy explains how we handle personal information in connection with our websites, platform, integrations, and support (the "Service").

Our business customers include agencies and the businesses they serve ("Client Businesses"). Those businesses determine the purposes, audiences, and approved configurations of their campaigns. Our software can process contact information, generate suggested content, and transmit API requests and message content through communications accounts they connect, including Twilio and Signal House. Describing our role as a software intermediary does not mean that we do not process or transmit information.

For account administration, billing, website operations, and other activities for which we determine purposes, we are responsible for our own handling of personal information. When we process Client Business contact information on documented customer instructions, we act as a service provider, processor, or subprocessor as applicable. A business's own privacy notice governs its independent use of your information. Applicable law determines these roles based on the actual processing.

This Policy is a privacy notice, not a consumer's agreement to messaging, a liability release, or consent to receive marketing. A business customer's contractual obligations are addressed separately in the Terms of Service and applicable data-processing terms.

2. Information we collect and receive

Account and business information. We receive names, email addresses, supplied contact details, company and business information, account identifiers, login and authentication information, user roles, permissions, branding, domains, logos, and configuration settings. Payment providers process payment details; we receive transaction, billing, and payment-status information but do not store full payment-card numbers.

Customer-submitted information. Customers may upload, import, or synchronize Contact names, telephone numbers, email addresses, business associations, customer-relationship or visit fields, consent evidence, opt-out records, and other information they are authorized to use. This can include contact details submitted through a customer-configured Zapier workflow. We process campaign settings, message templates, prompts, adopted content, replies, feedback, and related records. Customers are instructed not to submit prohibited sensitive information or information about children.

Connected services. Depending on the integration and authorized permissions, we receive OAuth tokens or other credentials, service and location identifiers, business-profile and review information, CRM records, communication records, connection settings, and Provider account and registration information. For example, a Signal House connection may provide account, number, brand, campaign, message, and delivery information. We use connected credentials to support the functions the customer enables, not to take ownership of its accounts or numbers.

Activity and technical information. We collect log records, IP addresses, browser and device information, session and cookie identifiers, pages and features used, account actions, and integration activity. Message records may include job and Provider identifiers, timestamps, delivery or failure status, link interactions, replies, classifications, suppression events, and campaign stopping activity. Information generated by enabled AI or automation features may be associated with the relevant records.

Support, verification, and compliance records. We receive information in support requests, complaints, account-verification materials, consent or authority evidence supplied for review, security reports, and communications with customers, Providers, advisers, or authorities. Contract acceptance records may include the representative, business, document version, acceptance action, timestamp, and associated technical evidence.

3. HighLevel and automatic provisioning

When a customer installs, authorizes, or opens the HighLevel/GoHighLevel integration, HighLevel may provide a user's name, email, user identifier, company or agency identifier, subaccount or location identifier, role and access information, installation details, approved permissions, and OAuth tokens. It may also supply authorized business, CRM, Contact, and communications data.

We use this information to authenticate users, create or locate accounts and profiles, link agencies and locations to the correct workspaces, assign access based on the integration information and account configuration, maintain the integration, and synchronize authorized data. Installation may automatically create an agency-associated account. A profile may be created on installation or first access through HighLevel.

Users identified as having agency- or company-level access may be associated as Account Owners. Users with location-only access may be associated with the linked business workspace; an unlinked location may result in a profile without business access. Account-level administrators may be able to view and manage multiple businesses. Customers are responsible for verifying their authorized personnel and requesting corrections to access.

Disconnecting or uninstalling HighLevel does not necessarily delete a Heysegment account, profile, access membership, or data previously received. Customers should manage access in both systems and contact us for assistance. Retention and deletion are described in Section 9. HighLevel independently handles information under its own terms and privacy notice.

4. How and why we use information

We use information to provide requested functions; authenticate users; administer accounts and billing; maintain authorized integrations; host and synchronize records; prepare content and execute customer-configured workflows; submit customer-directed message instructions through connected Providers; process replies, reviews, and opt-outs; and provide reports and support.

We also use appropriate information to maintain and improve reliability, troubleshoot errors, investigate security incidents and misuse, verify authority and compliance evidence, enforce agreements, prevent fraud, address complaints, respond to lawful requests, and establish or defend legal claims. We may review blocking and delivery-failure patterns, complaint and opt-out rates, relevant message samples, and records submitted for an investigation. Such review does not mean every account or message is continuously monitored or certified compliant.

We may contact account representatives about billing, security, product administration, or support. We send our own promotional communications only as permitted by law and subject to applicable choices and consents. We do not use Client Business Contact lists for our independent marketing.

Product development and analytics may use account and technical information and appropriately deidentified or aggregated information, subject to applicable law and data-source restrictions. We do not repurpose identifiable customer Contact information for unrelated advertising. Where we maintain information as deidentified, we take reasonable measures to prevent reidentification and do not attempt to reidentify it except as law permits for testing those measures.

5. Mobile information, SMS consent, and opt-outs

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. We do not sell, rent, or transfer SMS opt-in information or consent to another business for its own marketing. A customer's use of our Service does not authorize Heysegment or another customer to market to that customer's Contacts.

We may disclose the minimum information necessary to communications Providers, hosting and support providers, and other contracted vendors that help deliver the requested service, administer consent or suppression, secure systems, or investigate misuse. Such recipients may process information for those limited service purposes, not acquire permission to use a Contact's consent for independent marketing. Necessary disclosures for legal compliance, protected investigations, and a lawful business transition are described in Section 7 and do not turn consent into a transferable marketing asset.

The relevant Client Business must obtain valid consent for its messaging. Providing a telephone number, receiving a message, using our website, or agreeing to a business contract does not by itself establish SMS marketing consent. Consent must be appropriate to the actual sender and program.

To stop a Client Business's text program, reply STOP to its message or use another reasonable opt-out method available under applicable law. For help, reply HELP where supported or contact that business using its program information. We do not require a person to create a Heysegment account to ask for help with a message processed through our Service. You may contactsupport@heysegment.com with the business name, sender number, and relevant message details; do not send passwords or unnecessary sensitive information. We will route the matter appropriately and assist as required.

A Client Business or Provider may send one nonpromotional opt-out confirmation when permitted. Opting out of texts does not necessarily close an account or delete records needed to honor the opt-out. We or the relevant business may retain limited suppression information to avoid contacting you again. Message and data charges from your wireless provider may apply. This Policy does not enroll you in a Heysegment SMS program.

6. AI-enabled functions and Google information

When a customer enables AI-assisted functions, relevant prompts, selected business information, message or review content, and related context may be processed by AI service providers to generate drafts, classifications, suggested responses, personalized content, or other enabled outputs. Customers should limit the information supplied and must not submit data prohibited by the Terms. AI-generated information can be inaccurate and should not be treated as a verified fact about an individual.

Customer Personal Data is not used to train generalized AI models for our own or an AI provider's independent use. AI processing for the enabled service remains subject to applicable contractual purpose restrictions. A customer-requested new use requiring a different legal basis or disclosure must be addressed before that use occurs, not inferred from this Policy.

Information obtained through Google integrations is used for the authorized, disclosed functions. Where the Google API Services User Data Policy, including Limited Use requirements, applies, it restricts our use and transfer of that information and any applicable derived data. We do not use such information for advertising or unrelated profiling contrary to those requirements. Access, support review, and business-transfer disclosures remain subject to applicable Google restrictions and any required additional user consent.

7. When we disclose information

Vendors acting for us. We disclose information as needed to providers supporting hosting and infrastructure, security, payment processing, support, analytics, and enabled AI functions, subject to appropriate contractual and legal restrictions. The categories and identities relevant to customer-data processing can be requested fromsupport@heysegment.com. A named integration is not necessarily our subprocessor for every activity.

Customer-directed integrations. We exchange authorized information with services a customer connects, such as Twilio or Signal House for messaging, SendGrid or Mailgun for email, Google for business profiles and reviews, HighLevel for CRM and account synchronization, and Zapier for customer-configured workflows that send Contact information and review-request instructions to Heysegment. These providers may have direct contractual relationships with the customer and independently process information under their own policies. Connecting one service does not authorize unrelated disclosure to every other integration.

Account administration and authorized businesses. Agency account administrators and users with appropriate permissions may access information for the businesses they manage. We may disclose account or workspace information to the relevant customer, business, or authorized representative to administer access, provide support, or address a request. We verify authority where appropriate and apply applicable access restrictions.

Legal, security, and professional purposes. We may disclose necessary information to legal or other professional advisers, insurers, Providers, carriers, registries, or authorities when required by law or reasonably necessary and legally permitted to investigate misuse, respond to legal process, protect rights and safety, enforce agreements, or establish or defend claims. We do not permit a recipient to repurpose SMS consent for marketing by describing the disclosure as a compliance review.

Business transactions. Information may be reviewed or transferred in a proposed or completed merger, financing, reorganization, or sale under appropriate confidentiality and legal safeguards. Any successor must handle it consistently with applicable law and the commitments governing the information. Consent does not automatically extend to a new sender or different marketing purpose. Additional consent will be obtained where required, including under applicable Google data restrictions.

At your direction. We may make other disclosures you specifically request or authorize, subject to applicable restrictions. We do not sell personal information or share it for cross-context behavioral advertising. This restriction does not prevent properly restricted service-provider disclosures needed to operate the Service.

8. Cookies, analytics, and communications choices

We use cookies and similar technologies for authentication, session security, preferences, and understanding Service usage. Browser controls may allow you to block or delete cookies, although necessary functions may stop working. Where applicable law requires consent for a nonessential technology, that technology must be subject to the required consent control.

Where legally applicable, we honor recognized browser-based opt-out preference signals for covered processing. Such a browser signal does not itself communicate an SMS opt-out to a Client Business. Use the messaging opt-out process described in Section 5 to stop a particular text program.

You may unsubscribe from our promotional emails through their unsubscribe mechanism. Essential account, security, billing, and requested support communications may continue as permitted by law. A customer must separately maintain the preferences that apply to its own communications.

9. Retention, export, and deletion

We retain information only for as long as reasonably necessary for the purposes described here, considering the nature and sensitivity of the information, the customer relationship, service and security needs, applicable retention duties, consent and suppression evidence, legal holds, dispute periods, and deletion requests.

Account and billing records may be retained for administration, accounting, fraud prevention, and legal obligations after an account closes. Customer Content then held in the Service is ordinarily available for an export request for 30 days after termination, subject to lawful security restrictions and legal holds. After that period, or following an earlier valid deletion instruction, Customer Personal Data is deleted from active systems in the ordinary deletion cycle, except for limited, justified retention.

Restricted backup copies expire through ordinary backup rotation. If a backup is restored, relevant deletion and suppression instructions must be reapplied before routine processing resumes. Limited consent, suppression, security, acceptance, and dispute records may be retained where necessary and legally permitted; they are not retained for new marketing. Actual retention depends on the record category and applicable system. Contact us for information about the schedule relevant to a request.

Disconnecting an integration does not itself erase previously received data, and deleting a Heysegment copy does not necessarily delete a copy held by a Client Business or its independent Provider. We will assist with applicable deletion obligations in our role. We do not promise indefinite storage or recovery of deleted information.

10. Security

We maintain reasonable administrative, technical, and organizational safeguards appropriate to the information and risks, including encryption in transit, access restrictions, and controls for connected credentials. Authorized personnel receive access appropriate to their responsibilities. Customers also have responsibility for their accounts, user permissions, Provider access, and information they submit.

No transmission, storage system, or security measure is infallible. This statement is not a waiver of our legal security duties or of rights that cannot be waived. We address reportable incidents and notifications in accordance with applicable law and relevant data-processing agreements. Send suspected security issues tosupport@heysegment.com without including unnecessary secrets or sensitive information.

11. Privacy rights and requests

Depending on the law applicable to you and our processing, you may have rights to confirm whether we process your information; access, correct, delete, or obtain a portable copy; restrict or object to processing; withdraw consent; opt out of certain uses or disclosures; appeal a denied request; and complain to an appropriate authority. Applicable exceptions may permit or require limited retention or prevent disclosure of another person's information. We will not unlawfully discriminate against you for exercising a right.

For information we handle for our own purposes, contactsupport@heysegment.com or write to the address in Section 14. Specify the request and the information or account involved. We may take reasonable steps to verify identity and an agent's authority before responding. Do not provide identity documents or sensitive credentials unless we request a necessary, secure verification method.

For Contact information controlled by a Client Business, ordinarily contact that business first because it determines the relevant uses. You may still contact us; we will refer or assist with the request as appropriate rather than require you to become our customer. We will respond directly when law requires us to do so. Where an appeal right applies, email the same address with "Privacy Appeal" and the prior request reference. We will explain the result and available escalation options as required by the applicable law.

Where European or UK data-protection law applies to processing for which we are responsible, we rely, as appropriate, on providing a requested contract, legitimate interests in operating and securing the business, compliance with legal obligations, or consent for activities requiring it. You may object to applicable legitimate-interest processing or complain to your competent supervisory authority. Withdrawal of consent does not affect lawful processing before withdrawal. These statements do not claim that every part of the Service is approved for international customer-data processing.

12. Children and sensitive information

The Service is intended for business users age 18 or older, not for children. Customers are prohibited from submitting children's information or using the Service for prohibited sensitive data without an expressly approved arrangement. We do not knowingly collect personal information from children under 13 through our own website or account registration. If you believe a child has supplied information, contact us so we can investigate and take appropriate action.

The Service is not a general repository for health records, financial credentials, or other highly sensitive data. A customer must not submit protected health information requiring a business associate agreement unless the necessary agreement and safeguards are in place. Information included voluntarily in a message or review can still be sensitive; customers and users should minimize such submissions.

13. International processing and Policy updates

We and our service providers may process information in the United States and other countries where permitted. Those countries may have different privacy protections. Where applicable law requires a transfer mechanism or additional safeguards, the necessary arrangement must be implemented before the restricted transfer occurs. We do not represent that we hold a privacy certification or rely on an international-transfer framework unless specifically identified and validly applicable.

We may update this Policy at any time to reflect changes in our practices, technology, or legal obligations. The published version will show its update date. For material changes, we will provide appropriate notice, such as an email, prominent website notice, or in-product message, before the new practice takes effect when required. We will obtain consent where required for a new or materially different use of information. Posting a revision or a person's continued use does not, by itself, authorize an incompatible new use of previously collected information or supply marketing consent.

14. Contact

Heysegment LLC
74 Emarie Grey Circle
Santa Rosa Beach, FL 32459
United States
support@heysegment.com

Contact us with privacy questions, rights requests, complaints, or requests for processing information, a data-processing addendum, or current subprocessor information.