Privacy Policy

v2.0 — October 2026 · Last updated October 16, 2026

This page explains what information HeyNico holds, why we hold it, who helps us handle it, and what you can ask us to do with it. The short version: your data is yours. We do not sell it, we do not use it for ads, and we do not use it to train AI.

1. Two kinds of information, two roles

About you and your business — your account and business profile. For this information, we decide how it is used, and we are responsible for it.
About your customers and your jobs — what you enter to make estimates. We handle this information for you, as your service provider, only to run HeyNico for you. You decide what goes in. You are responsible for having the right to enter it and for giving your customers any notice the law requires. If one of your customers asks us about their information, we will send them to you.

2. What we hold about you

Your account: email, password (stored only in scrambled, hashed form — we cannot read it), name, phone, language and time zone.
Your business profile: legal business name, the name you do business as, business address, phone and email, contractor license number (optional), logo, your default terms, payment instructions, markups and shop rate.
Your plan: which plan you are on. We also have a place to store a payment-provider customer number; we use no payment provider today, so it stays empty.
Usage records: for each Nico request, the amount of AI used (tokens) and what it cost us; your voice minutes; and errors.
Request logs: our hosting and sign-in providers record requests, including your IP address and browser type. These logs are kept for a short time.
Cookies: only the cookies that keep you signed in, and one cookie (NEXT_LOCALE) that remembers your language. Nothing else.

3. What we hold for you about your work and your customers

Customer names, phone numbers, email addresses and property addresses.
Job descriptions, items, quantities, prices, notes and your catalog.
The estimates you make, and their PDFs.
Photos and files you attach to an estimate.
Your conversations with Nico: your words and Nico's replies, as text.
Transcripts of what you said by voice.

4. Your voice

When you hold the talk button, your browser sends the sound directly to AssemblyAI, our transcription provider, using a short-lived key. Our servers never receive the audio, and we store no recordings. AssemblyAI sends back the text, and we store that transcript with your conversation. Your browser keeps the sound in memory only while you are on that turn, so you can play it back; then it is discarded.

If a customer or anyone else can be heard while you record, recording-consent laws may apply. California requires everyone in a conversation to agree before it is recorded.

5. How we use information

To run HeyNico for you: sign you in, keep your jobs, let Nico draft items, make your PDFs and email them to you.
To answer you when you ask for help.
To keep HeyNico secure and fix problems.
To track what AI and voice cost us.
To bill you.
During the testing period, to see how HeyNico is used so we can improve it (see section 8).

6. What we never do

We never sell or share your information, or your customers' information, for advertising or any other purpose.
We never use your data to train AI. Anthropic does not either; for AssemblyAI, see section 7.
Your prices, markups and catalog are never shown to other HeyNico customers and are never used to suggest prices to anyone else.
Your markups and costs never appear on the estimate your customer sees.
We use no analytics, no tracking tools and no ads.
We send you no marketing email.

7. Who helps us (our providers)

All of them are US companies. Each receives only what it needs for its job:

Supabase — our database, sign-in and file storage. It stores your account, your business profile, your usage records and everything in section 3, in its US East region.
Vercel — hosts HeyNico; every page and request passes through it.
Anthropic (Claude, the AI behind Nico) — receives your conversation text, the job's items and the catalog entries (with your prices) that Nico needs to match what you describe, so Nico can draft. Under Anthropic's API terms, this data is not used to train its models.
AssemblyAI — turns your voice into text. The sound goes from your browser straight to AssemblyAI. Under AssemblyAI's terms it may use audio to improve its models unless the customer opts out. We are moving our account to a plan that allows the opt-out and will turn it on; once that is done, AssemblyAI keeps no audio or transcript from us, and we will update this line.
Resend — sends our email, only to your own address.
Langfuse — receives usage numbers only (AI amount, cost, speed). Never the text of your conversations, items or prices.
Cloudflare — runs our domain's DNS and forwards mail sent to hello@heynico.app.

If we add a payment processor or an error-monitoring service, we will update this page before it handles your data.

8. Who at HeyNico can see your data

HeyNico is run by its founder, who has access to the production systems. The founder may read your data to help you when you need support or, during the testing period, to review how the product is used. Never for any other reason.

9. Security

Everything travels encrypted (TLS) between your device, us and our providers.
Data is encrypted at rest by Supabase.
Each account's data is kept apart inside the database, so one account cannot read another's.
We do not add our own extra layer of encryption on top (sometimes called app-layer encryption). That means someone with production access can read the data, which is why section 8 limits who that is and when.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you as the law requires.

10. How long we keep it, and deleting it

We keep your information while your account is active.

To delete your account, email hello@heynico.app. We first offer you a copy of your data as files. Then we remove it from our active systems within 30 days. Deleting your account also deletes the customer and job information you entered.

After deletion, we keep only:

billing and payment records, if there are any, for as long as the law requires;
security logs, for a short period;
backup copies, until they roll off — within 30 days.

There is no delete or export button in the app yet; email is how you ask.

11. Your rights

Wherever you live, you can ask us to:

tell you what information we hold about you and how we use it;
give you a copy of it;
correct it (you can change most of your account and business details yourself in Settings);
delete it.

We will not treat you differently for asking. To make a request, email hello@heynico.app. We may need to confirm the request comes from you. We do not sell or share personal information.

12. Children

HeyNico is for adults running a business. It is not meant for anyone under 18, and we do not knowingly collect information about children.

13. Changes to this policy

When we change this policy, we change the version and date at the top of this page and tell you in the app or by email.

14. Contact

Questions about your privacy? Write to hello@heynico.app.