Sign in

Draft – pending legal review. This page is not yet in effect and will change before it is published.

Privacy policy

Draft of 3 November 2026. PLACEHOLDER: effective date, set when legal approves this text.

1. Who we are

Heullo is the business SMS service of PrimeTel PLC (“Primetel”, “we”), 141 Omonoias Avenue, 3045 Limassol, Cyprus. PLACEHOLDER: company registration number.

This policy covers the website heullo.com, the Heullo web app at app.heullo.com, the Heullo API and Email-to-SMS. For Primetel’s other services, see the Primetel privacy policy.

Primetel is the controller of the personal data described here. PLACEHOLDER: Primetel’s role for the messages and contacts a customer sends through Heullo (processor on the customer’s behalf, or controller), and whether a data processing agreement is offered.

2. What we process and why

Visiting heullo.com

  • The website sets no cookies and uses no analytics, advertising or other trackers.
  • If you choose the light or dark theme, your choice is kept in your browser’s local storage (heullo-theme). It is never sent to us.
  • Our web servers log each request: the IP address, time, page requested, response status, referring page and browser type. We use the logs to run and protect the service. PLACEHOLDER: server log retention period.

The contact form

  • We receive your name, email address, company, phone number (if you give it), topic and message.
  • The form is sent by email to the Heullo support team. It is not stored in the Heullo platform. PLACEHOLDER: how long the support mailbox keeps these emails.
  • We use it only to answer your request. PLACEHOLDER: legal basis (steps taken at your request before a contract, legitimate interest, or consent).
  • To limit abuse, the server counts recent submissions per IP address. The count is kept in memory only and is never written to disk.

Your Heullo account

  • Sign-in is provided by Auth0 (Okta). Auth0 processes your name, email address and sign-in details. Our Auth0 tenant is in the United States region (see section 4).
  • We keep your profile, your organization and role (admin or member), your settings, your credit balance and your usage history.

Messages and contacts

  • For each SMS you send: the recipient’s number, the text, the sender ID, the time, the delivery status and the number of parts charged.
  • For each SMS you receive: the sender’s number, the text and the number or keyword it was sent to.
  • The contacts and lists you import, including any extra columns.
  • We use this data to deliver messages, show them in your inbox and reports, and charge credits. To deliver an SMS we pass it to mobile network operators.
  • PLACEHOLDER: retention periods for sent and received messages, contacts and reports.

Email-to-SMS

  • For each email sent to a <number>@mail.heullo.com address: the sender and recipient addresses, the subject and the body.
  • We use them to check that the sender is authorised and to send the body as an SMS. The subject is never sent.
  • PLACEHOLDER: retention of received emails.

Calendar reminders

  • When you connect Google Calendar or Microsoft 365, Heullo gets read-only access to that calendar and records the connected account’s email address.
  • Heullo reads the appointments of the next 30 days (title, time and location, and the phone number in the title) only to send the reminders you set up.
  • You can disconnect the calendar at any time on the Connections tab. PLACEHOLDER: what happens to stored appointments and access tokens after you disconnect, and how long they are kept.

Webhooks

If your organization sets up webhooks, Heullo sends inbound messages and delivery receipts to the endpoints you choose.

3. Who receives personal data

  • Auth0 (Okta), for sign-in.
  • Google or Microsoft, only when you connect a calendar.
  • Mobile network operators, to deliver your messages.
  • Your own systems, when your organization sets up webhooks.
  • Public and regulatory authorities, where the law requires it.

We do not sell personal data. PLACEHOLDER: full list of processors (for example hosting and email delivery) for legal review.

4. Transfers outside the EU

Auth0 processes sign-in data in the United States. PLACEHOLDER: the safeguard for this transfer and for Google and Microsoft calendar access (for example standard contractual clauses or the EU-US Data Privacy Framework).

PLACEHOLDER: confirm that all other Heullo data is stored in Cyprus.

5. How long we keep data

We keep personal data only for as long as the purposes above need it, or as the law requires. PLACEHOLDER: confirm whether Primetel’s general rule (up to two years after the relationship ends, Primetel privacy policy section 7.3) applies to Heullo, and fill in the periods marked in section 2.

6. Your rights

Under the General Data Protection Regulation (EU) 2016/679 you have the right to:

  • access your personal data and receive a copy;
  • have incorrect or incomplete data corrected;
  • have your data deleted;
  • object to processing;
  • restrict processing;
  • receive your data to move it to another provider;
  • not be subject to a decision based solely on automated processing;
  • withdraw your consent at any time, where processing is based on consent.

To use any of these rights, contact Primetel’s Data Protection Officer at dpo@prime-tel.com. You can also complain to the Commissioner for Personal Data Protection in Cyprus.

7. Security

Connections to heullo.com, the Heullo app and the API are encrypted with TLS.

8. Changes to this policy

We may change this policy by publishing a new version on this page, with its date at the top.

9. Law

This policy is governed by the laws of the Republic of Cyprus.

10. Contact

For questions about Heullo, email support@heullo.com. For data protection requests, email dpo@prime-tel.com.