Privacy Policy

Data Controller

Introduction

This notice describes how Heysuvi Labs, LLC ("Heysuvi," "we," "us") collects, uses, shares, and protects personal data when you use our website, GreenAI API, future user chat interface, other AI models and tools, and (where offered) our learning and certification features (together, the "Service"). We are committed to transparency, security, and giving you control over your information.

At a Glance

• Heysuvi is an AI research lab. You may submit content and data to GreenAI (including via API and, when offered, chat) and to our other AI tools; your content stays yours.
• GreenAI inference is offered in two regions you choose: United States (eastus) and European Union (swedencentral, when live). Your prompts for a call are processed in the region of the endpoint you use.
• We may use content and data you submit to develop, train, and improve our own AI models. You can object to or opt out of this (see "AI Processing and Model Training"), and we instruct third-party AI providers not to use your data to train their models.
• We do not sell personal data, and we do not use it for cross-context behavioral advertising.
• Where we offer learning and certification features, learning progress, assessment attempts, and certification results are stored, and issued certificates are permanently stored and publicly verifiable.
• Because we operate from the EU and offer the Service to individuals in the EU/EEA, the GDPR applies; you also have rights under US state privacy laws.
• You can access, export, correct, or delete your data by contacting privacy@heysuvi.com.
• GreenAI is available to anyone with a valid subscription. Assistive student chat / tutoring-style Q&A is our primary intended use case (useful for students), not a students-only or exclusive-audience product. Humans remain responsible for checking AI outputs. GreenAI is not offered for automated grading for credit, admissions decisions, or biometric proctoring.
• We inform users that they are interacting with an AI system (EU AI Act transparency). API customers who build chat UIs must surface that disclosure to end users.
• We minimize logging of full prompt/completion bodies by default; operational logs focus on request metadata and are retained in line with the Retention section.

Who We Are and Scope

This policy applies to greenai.eco, heysuvi.com, the Heysuvi web and mobile applications, the GreenAI API (regional hostnames such as us.api… / eu.api…), the future GreenAI user chat interface when offered, our AI models and tools, and (where offered) our learning courses and certification services. The Service (including GreenAI) is available to anyone with a valid subscription; assistive student chat and tutoring-style Q&A is a primary use case, not an audience restriction (see Terms § 2). High-risk education decisioning (automated grading for credit, admissions decisions) and biometric proctoring are not GreenAI product features (see our Terms). It does not cover third-party websites you reach through external links. The Service is intended for adults and is not directed to anyone under 18.

Regional Processing (US / EU)

GreenAI is designed for dual-region hosting. You (or your application) choose the processing location for inference by calling the corresponding regional base URL:

• United States: Azure eastus (East US) — prompts and related inference inputs for that request are processed in the United States.
• European Union: Azure swedencentral (Sweden Central) — when that region is provisioned, prompts and related inference inputs for that request are processed in the EU.

There is no automatic failover between regions. Choosing a region for API or chat inference determines where that inference runs; it does not move all Heysuvi systems exclusively into that region. Account administration, billing, support, marketing-site analytics, email, and similar back-office processing may still occur in the United States or other countries, with safeguards described under "International Data Transfers."

Until the EU stack is publicly available, only the US inference region may be offered.

Information We Collect

Account and identity. Name, email, hashed password, profile details; session tokens, device/browser identifiers, multi-factor settings; single sign-on tokens/profile if used.

API credentials and usage. API keys or tokens (we store secrets in hashed or otherwise protected form where applicable), key metadata (creation time, last used, label), caller identifiers, selected region/endpoint, request volume, rate-limit events, and billing-related usage meters when fee-based plans apply.

Content and files you submit. Documents, images, text, prompts, instructions, excerpts, chat messages, and other inputs you provide to GreenAI or our other AI models or tools, together with metadata such as titles, structure, timestamps, and conversation or request IDs. Where collaboration features are offered, this includes content you choose to share and the related sharing settings.

AI interactions (API and chat). Your prompts, instructions, files, and excerpts; model outputs; safety or abuse-check signals; optional transparency metadata; abuse/policy category signals; and limited operational data (request identifiers, latency, region, error codes). We do not collect biometric templates or camera/microphone exam-proctoring streams for GreenAI chat (GreenAI chat does not provide those features). Soft-proctoring for separate Heysuvi certification products, if any, remains as previously described and is distinct from GreenAI chat.

Learning, assessment, and certificate data (where these features are offered). Course enrollment and progress, completion status, and time spent; assessment attempts, including questions presented, answers submitted, scores, pass/fail status, timestamps, duration, and number of attempts; soft-proctoring signals during certification assessments (tab-switch and focus-change events and attempt metadata; we do not use camera, microphone, or screen recording); and certificate data (recipient name as you provide it, certificate title, issuing organization, issue date, score, and a unique certificate ID).

Payments and subscriptions. Billing contact, plan or purchase selection, and transaction records; payments are handled by our payment provider (we do not store full card details).

Device, diagnostic, and security data. IP address, browser/OS/timezone/language; security and fraud-prevention signals (including bot detection); application and API logs, errors, and performance metrics; and support communications.

Cookies and local storage. Sessions, preferences, consent settings, and editor functionality/drafts. We also use session analytics and interaction replay tools (including Microsoft Clarity) on the marketing site to understand how the site is used: pages viewed, clicks, scrolls, and similar behavioral signals. The GreenAI API itself does not rely on marketing cookies; browser-based chat (when offered) may use session cookies or local storage needed for login and conversation state.

Regional consent. Visitors in the EU/EEA/UK must accept tracking to use the marketing site (or leave the site). Privacy Policy and Terms remain available without that acceptance. Outside those regions, this use is disclosed here and in our Terms; you may contact privacy@heysuvi.com with questions or requests.

How We Use Information

• Operate and secure the Service: authentication, API authorization, storage, and (where offered) collaboration, chat, and real-time editing.
• Provide GreenAI and other AI responses based on your prompts and context in the region you select.
• Enforce API authentication, rate limits, tool allowlists, and abuse controls, and maintain reliability of the API and chat.
• Provide AI transparency notices and related compliance signals.
• Operate assistive student-chat and tutoring-style features — not automated credit grading, admissions decisioning, or biometric proctoring as GreenAI features.
• Develop, train, evaluate, and improve our own AI models (see "AI Processing and Model Training").
• Where offered, administer learning and certification features, track progress, issue certificates, and monitor assessment integrity through soft-proctoring signals.
• Process payments, manage purchases or API plans, and send transactional communications.
• Respond to support requests and send service and security notices.
• Prevent fraud and abuse and enforce our terms.
• Improve reliability, performance, and quality, including optional analytics where you consent.
• Comply with law and legal process.

Legal Bases (EU/UK GDPR)

Contract: to provide the Service you sign up for, including API access, chat (when offered), and any learning and certification features.

Legitimate interests: security, abuse prevention, reliability, assessment integrity, and developing and improving our own AI models and the Service, where these interests are not overridden by your rights (we carry out a balancing assessment).

Consent: optional analytics, marketing communications, and any use of your data that requires consent under applicable law.

Legal obligations: tax, accounting, compliance, lawful requests, and certificate-verification requirements.

AI Processing and Model Training

Your prompts and relevant content may be sent to our GreenAI infrastructure in the region corresponding to the endpoint you call, and may involve cloud providers hosting that region, to generate outputs.

We may use content and data you submit to develop, train, evaluate, and improve our own AI models. Where practicable we use this data in de-identified or aggregated form. You may object to or opt out of the use of your data for model training (see "Your Choices and Controls"); opting out does not remove your access to core AI features.

We do not use special-category data (such as health, biometric, or similar sensitive data) to train our models.

Where you use the Service for business or enterprise purposes, our use of your content for training is governed by the applicable business agreement, and we do not train on such content except as that agreement permits.

We instruct third-party AI infrastructure providers not to use your data to train their own foundation models.

Safety and abuse checks may inspect inputs and outputs. Outputs may be stored with your history for review, editing, or deletion.

AI transparency and student use

AI disclosure. GreenAI is an AI system. Chat interfaces we operate will disclose that you are interacting with AI at or before the first interaction. When you use the API to present GreenAI to people, you must provide an equivalent clear disclosure.

Assistive student use. Prompts and outputs in assistive student-chat / tutoring-style scenarios are processed to generate assistive answers. That scenario is our primary intended use case for paying subscribers generally—not a limit that only students may use GreenAI. We do not offer GreenAI as a product that assigns official grades for credit, makes admissions decisions, or performs biometric identification or emotion recognition of students.

Safety and abuse checks. Automated safety/abuse checks may inspect inputs and outputs for policy violations (for example, illegal content or attempts to extract secrets). We log categories and request identifiers; we do not needlessly retain full bodies.

How We Share Information

• Service providers under confidentiality and data-protection obligations: cloud hosting (including regional Azure deployments), database, storage, and backups; AI infrastructure; email and communications; payment processing; identity, security, and bot detection; support; and logging and monitoring.
• Collaboration and user-directed sharing (where offered): content is visible to collaborators you authorize; you control the permissions.
• Certificate verification (where offered): certificate ID, recipient name, title, and issue date are publicly accessible for verification.
• Compliance, safety, and business events: lawful requests, protection of safety and integrity, and corporate transactions with equivalent safeguards.
• We do not sell personal data.

International Data Transfers

Our systems and our providers operate in the United States, the European Union (when the EU inference region is live), and in other countries as needed for the Service. Your data may be processed outside your country of residence. If you call the US GreenAI endpoint, inference for that request is processed in the United States. If you call the EU endpoint (when available), inference for that request is processed in the EU.

Where we transfer personal data out of the EEA or UK, we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, together with access controls and other safeguards.

Retention

• Account data: retained while your account is active; deleted or anonymized within about 30 days of closure unless the law requires otherwise.
• API keys: retained while active; deactivated keys may be kept for a short security/audit window (typically up to 90 days) then deleted or anonymized, unless longer retention is required for fraud or legal holds.
• Content, chat, and AI interactions: retained until you delete them or close your account; typically removed from active systems within about 30 days and from backups within about 90 days after deletion.
• API operational logs (request IDs, latency, region, status codes; not full prompt bodies unless needed for abuse investigation): retained up to 180 days, aligned with security and system logs below. When prompt/completion bodies are captured for abuse investigation, we aim to delete or anonymize them within about 30 days after the investigation closes, unless a longer legal hold applies.
• Learning progress: retained while your account is active; deleted on account closure.
• Certification attempts: retained for 7 years after the attempt date for verification and compliance.
• Certificates: permanently retained for public verification; certificate data cannot be deleted while the certificate remains valid.
• Proctoring data: retained for 1 year after the assessment, then deleted.
• Security and system logs: retained up to 180 days.
• Support interactions: retained up to 24 months.
• Billing and tax records: retained as legally required (for example, up to 7 years).

Security

• Encryption in transit and at rest across our infrastructure.
• Least-privilege access, audit logging, API authentication, rate limiting, and bot detection.
• Secret redaction in application logs; CORS allowlisting for browser clients; TLS at the public edge; regional hostname pinning so inference stays in the chosen region.
• Patching, backups, monitoring, and incident response.
• Limited staff access under confidentiality obligations.

Your Choices and Controls

• Update your account information in your profile (where offered).
• Choose the GreenAI inference region by configuring the US or EU API base URL (or the equivalent control in chat when offered).
• Rotate or revoke API keys you control.
• Where offered, manage content sharing and permissions, and view your learning and certification history.
• In the EU/EEA/UK, accept or decline site tracking via the access gate (decline means leaving the marketing site). Elsewhere, contact privacy@heysuvi.com with analytics questions or requests. You may also object to or opt out of the use of your data for AI model training as described in this policy.
• Manage cookies and local storage through your browser; disabling essential cookies may affect login.
• Opt in or out of non-essential communications.
• Delete your account or request a data export by contacting us.

Your Privacy Rights

EU/UK/EEA (GDPR): depending on your situation, you have rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent. You also have the right to lodge a complaint with your data-protection supervisory authority.

US state privacy rights (including California): rights to know, delete, and correct. We do not sell or share personal information for cross-context behavioral advertising, and we do not discriminate against you for exercising your rights.

Note on certificates: because of their verification purpose, certificate data cannot be fully deleted while the certificate remains valid; you may request anonymization of your name on the certificate.

To exercise your rights, contact privacy@heysuvi.com (we may need to verify your identity). We aim to respond within 30 days.

Children's Data

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us at privacy@heysuvi.com and we will delete it.

Changes to This Policy

We may update this policy for operational or legal reasons. Material changes will be communicated in-product or by email with an effective date. Continued use after that date constitutes acceptance, except where applicable law requires your consent.