Privacy Policy
Last updated: 12 October 2026
This policy explains what personal data HeySuna collects, why we collect it, who we share it with and what rights you have. We've tried to write it in plain English.
1. Who we are
HeySuna is operated by Have it OÜ, a private limited company registered in Estonia.
- Registry code: 14400737
- VAT number: EE102718672
- Address: Sepapaja tn 6, 15551 Tallinn, Estonia
- Email: contact@heysuna.com
Have it OÜ is the data controller for the personal data described in this policy. In this policy, "HeySuna", "we", "us" and "our" mean Have it OÜ.
2. What this policy covers
This policy applies to:
- our website at heysuna.com, including the Full Volume challenge pages
- the HeySuna app (the "Service")
- emails we send you, including the Full Volume challenge emails
3. What data we collect
Data you give us
- Account data: your name, email address, password (stored in encrypted form) and account settings.
- Business profile: information you share about your business, your services and your ideal clients, so we can suggest relevant content topics.
- Interview data: the audio recordings of your interviews, the transcripts made from them, and your answers.
- Generated content: the articles, newsletters, posts and one-liners created from your interviews, and any edits you make to them.
- Email signup data: if you join the Full Volume challenge or another email list, your email address and how you found us (for example the campaign link you came from).
- Messages: anything you send us by email, such as support questions.
Please don't include sensitive personal data (for example health information about yourself or your clients) in your interviews unless you need to. If you talk about other people, such as your clients, avoid details that would let someone identify them.
Data we collect automatically
- Usage and device data: your IP address, browser and device type, the pages you visit and the actions you take on our website and in the Service.
- Email engagement: whether you open our emails and click the links in them.
- Cookies and similar technologies: see section 10.
Data from third parties
- Payment data: payments are handled by Stripe. We don't see or store your full card number. Stripe shares limited details with us, such as your name, billing country, the last four digits of your card, and your payment and invoice history.
- Advertising data: if you interact with our ads on Facebook or Instagram, Meta may tell us that a visit or signup came from one of our ads.
4. Why we use your data, and our legal basis
Under the EU General Data Protection Regulation (GDPR), we must have a legal basis for each way we use your data.
| What we do | Legal basis |
|---|---|
| Create and run your account, run your interviews, and generate and store your content | Performance of our contract with you |
| Send you the Full Volume challenge emails and other marketing emails you signed up for | Your consent, which you can withdraw at any time by unsubscribing |
| Send you service emails, for example about your account, billing or important changes | Performance of our contract with you |
| Take payments, issue invoices and keep accounting records | Performance of our contract, and our legal obligations under Estonian accounting and tax law |
| Measure how our website and Service are used (Google Analytics) | Your consent |
| Measure and improve our advertising (Meta pixel) | Your consent |
| Keep the Service secure, prevent abuse and fix problems | Our legitimate interest in running a safe, working service |
| Answer your questions and support requests | Performance of our contract, or our legitimate interest in helping you |
| Comply with the law and defend legal claims | Legal obligation, or our legitimate interest in protecting our rights |
5. How we use AI
HeySuna uses artificial intelligence to run your interviews and to turn your answers into content. To do this, your interview data, business profile and related content are sent to our AI providers (see section 6), which process them on our behalf.
- We do not use your data to train AI models, and we do not allow our AI providers to use it for training.
- AI makes decisions about wording and structure of your content. It does not make decisions about you that have legal or similarly significant effects.
- AI can make mistakes. Always review generated content before you publish it.
6. Who we share your data with
We do not sell your personal data. We share it only with service providers that help us run HeySuna. They process it on our instructions under data processing agreements.
| Provider | What they do for us |
|---|---|
| Amazon Web Services (AWS) | Hosting and storage for the Service, including your recordings and content |
| Anthropic | AI processing for interviews and content generation |
| Zep | AI memory, so interviews and content can build on what you've told us before |
| Brevo | Sending emails, including the Full Volume challenge |
| Stripe | Payment processing and billing |
| Google (Google Analytics) | Website and product analytics |
| Meta (Meta pixel) | Advertising measurement |
We may also share data when the law requires it, to protect our rights or the safety of others, or as part of a sale, merger or restructuring of our business. In that last case, we'll tell you before your data becomes subject to a different privacy policy.
7. International transfers
Some of our providers are based in the United States or store data there. When your data is transferred outside the European Economic Area, we make sure it is protected, for example through the EU-US Data Privacy Framework (where the provider is certified) or the European Commission's Standard Contractual Clauses.
8. How long we keep your data
- Account, interview data and content (including audio recordings and transcripts): for as long as your account exists. When you ask us to delete your account, we delete this data within 30 days.
- Email signup data: until you unsubscribe. After that, we keep your email address on a suppression list only so we don't email you again by mistake.
- Billing and accounting records: for 7 years, as required by the Estonian Accounting Act.
- Analytics data: for up to 14 months.
- Support emails: for as long as needed to handle your request, and up to 2 years after that.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it
- correct data that's inaccurate or incomplete
- delete your data
- restrict how we use your data
- receive your data in a portable format and have it sent to another service
- object to us using your data on the basis of our legitimate interests
- withdraw your consent at any time, without affecting what we did before you withdrew it
To use any of these rights, including deleting your account, email contact@heysuna.com. We'll reply within one month. We may ask you to confirm your identity first.
You can unsubscribe from marketing emails at any time with the link at the bottom of every email.
If you're unhappy with how we handle your data, please contact us first. You also have the right to complain to a data protection authority. In Estonia, that's the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). You can also complain to the authority in the country where you live or work.
10. Cookies
Cookies are small files stored in your browser. We use:
- Essential cookies that keep you logged in and make the website and Service work. These don't need your consent.
- Analytics cookies from Google Analytics, which tell us how people use our website and Service.
- Advertising cookies from the Meta pixel, which help us measure whether our Facebook and Instagram ads work.
We only load analytics and advertising tools, and only set their cookies, after you click "Accept" in our cookie banner. If you click "Decline" or close the banner, nothing is loaded from Meta or Google.
Visitors in the United States don't see the banner: analytics and advertising tools load by default, and you can opt out at any time with the "Cookie settings" link at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as an opt-out and load nothing. We use your approximate location (country only, from your IP address, as provided by our hosting provider Cloudflare) to decide whether to show the banner; we don't store it.
We remember your choice in a cookie called heysuna_consent. If you accept or decline, we remember it for 12 months. If you close the banner without choosing, we ask again after 7 days.
You can change your mind at any time with the "Cookie settings" link at the bottom of every page, or by clearing cookies in your browser. If you withdraw your consent, we delete the analytics and advertising cookies we can reach and stop loading those tools.
11. Children
HeySuna is for people aged 18 and over. We don't knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we'll delete it.
12. Security
We use technical and organisational measures to protect your data, including encrypted connections (HTTPS), encrypted password storage and access controls. No system is completely secure, but if a data breach puts your rights at risk, we'll tell you and the relevant authority as the law requires.
13. Changes to this policy
We may update this policy from time to time. We'll change the date at the top when we do. If the changes are significant, we'll tell you by email or in the Service before they take effect.
14. Contact
Questions about this policy or your data? Email contact@heysuna.com or write to Have it OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia.