Privacy Policy

Heya ("Heya Beauty Club") respects your privacy. This policy explains what data we collect, and how we use and protect it when you use our app and services. By using the app, you agree to this policy.

Information We Collect

• Account data: your phone number (for login and one-time-code verification), name, email (optional), and your marketing preference.
• Usage data: the deals and beauty centers you browse, save, or contact, and visits confirmed via a verification code.
• Subscription & payment data: your subscription status and purchase information, managed through the Apple App Store, Google Play, and our subscription provider.
• Technical data: your push-notification token and your device platform (iOS or Android), used only to deliver notifications, and standard server logs (such as IP address and request time) kept by our hosting provider for security and troubleshooting.

Location

With your permission, the app uses your device's current location only while you are using the app — never in the background — to show beauty centers and offers near you and to calculate how far away they are. The app does not keep a history of your locations. Your coordinates are sent only as part of a distance request and are processed on our behalf by our hosting and backend provider, Supabase, to calculate distances for that request; they are not stored as a location history, not saved to your account, and not shared with centers. Without Premium, you see only an approximate distance range (for example, 1–3 km); Premium members also see exact distances and a map of partner branches. In this policy, “Premium” also includes members with active Creator access. Your phone's permission settings let you allow precise or approximate location, and the app works with either. Location is optional: if you do not allow it, the app keeps working, but distances are not shown. You can turn location off at any time in your phone's settings, which you can also open from the app (Profile › My Location).

Jameela AI Assistant

Jameela is an optional AI beauty assistant available to Premium members. When you send Jameela a message, your recent messages in that conversation and your chosen language are sent, together with a list of relevant Heya offers and centers (which may be selected using the city in your profile), to our AI provider, Anthropic, to generate a reply; Anthropic processes this data under its applicable commercial terms. Your name, phone number and account identifiers are not included. Heya does not store the content of your conversations; the chat is kept only on your screen while it is open. We keep only a count of the messages you send each month, to apply your monthly limit. Please avoid sharing sensitive personal or health details in the chat; Jameela does not give medical advice. In the Partner Portal, the assistant sends a staff member's questions, together with basic facts about their own center, to Anthropic in the same way, and the AI tools for translation and offer descriptions send the text or offer details entered for them; only usage counts are stored.

Creator Program

If you apply to the Heya Creator Program, we use the details you submit (such as your name, phone number, email, social media accounts and audience figures) to review your application. As a creator, you upload a screenshot of your published content as proof for each creator benefit; the app opens your photos only when you choose that screenshot. Screenshots are kept in private storage and can be viewed only by authorized Heya team members who review creator content; they are not shared with partner centers or other members. If you replace a screenshot before it is reviewed, the previous one is deleted. Screenshots are kept for as long as needed to run the Creator Program, are deleted when you delete your account, and you can ask us to delete them at any time at support@heyaclub.com.

Notifications

Push notifications are optional and are sent only if you allow them in your phone's notification permission. In the app (Profile › Settings) you can turn each type on or off: New deal alerts, Expiry reminders, and News & announcements. To deliver notifications we store your device's push token, which is removed when you sign out or delete your account. To stop all push notifications, turn notifications off for Heya in your phone's settings.

No Advertising or Tracking

The Heya app shows no advertising and contains no third-party advertising or analytics tools. We do not track you across apps or websites owned by other companies, we do not use your device's advertising identifier, and we do not sell or share your data with data brokers. Our subscription provider, RevenueCat, links your purchases to your Heya account only to manage your subscription.

How We Use Your Data

• Operate the app, show deals, and let you connect with centers.
• Log you in and verify your identity via phone number.
• Manage your subscription and related benefits.
• Send notifications (if enabled) and marketing messages (only if you opt in).
• Improve the service, keep it secure, and prevent abuse.

Sharing With Third Parties

We share the minimum necessary data with trusted service providers solely to operate the app, including:

• Google Firebase — Firebase Authentication for phone sign-in, including sending your one-time verification code by SMS; on Android devices, push notifications are delivered through Firebase Cloud Messaging.
• Supabase — our backend, database and file storage, and the processing performed on our servers (including distance requests).
• RevenueCat — subscription management.
• Anthropic — AI processing for the Jameela assistant and the Partner Portal AI tools, under Anthropic’s applicable commercial terms.
• Resend — delivery of transactional e-mails and Creator Program e-mails.
• Expo — Expo Push Service, used to deliver push notifications to the app. It passes them to Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android).
• Cloudflare Turnstile — security and anti-abuse protection on the website’s forms (Creators application, support and account deletion requests).
• Apple and Google — in-app payment processing.

We do not sell your personal data. We may disclose it where required by law.

Data Retention & Security

We retain your data while your account is active or as needed to provide the service, and we take reasonable measures to protect it from unauthorized access.

Account Deletion

You can delete your account at any time in the app: Profile › Settings › Delete Account. For your protection, the app may first ask you to verify your phone number again. Your sign-in is removed first, then your profile and every record linked to your account, together with any Creator Program screenshots; there is no waiting period and the account cannot be restored. If you can no longer sign in, you can send a deletion request from our account deletion page, and we will verify that the account is yours before deleting it. Deleting your account does not cancel a subscription billed by Apple or Google: cancel it in your App Store or Google Play account settings. Purchase and renewal records sent to us by the stores and RevenueCat are kept as business and accounting records, and messages you sent to our support team stay in our support mailbox.

Your Rights

You may access, correct, or delete your data. You can edit your profile in the app, delete your account as described above, or contact us at support@heyaclub.com. For a summary of the privacy controls available to you, see Your privacy choices.

Children

The app is intended for adults and is not directed to children under 18.

Changes to This Policy

We may update this policy from time to time; the "last updated" date at the top will reflect any changes.

Contact Us

For any privacy question, contact us at: support@heyaclub.com