Hey AI Foundation / Legal
Privacy Policy
How Hey AI Foundation collects, uses, and protects information when you visit this website or request archive access.
Who we are
Hey AI Foundation is a California nonprofit public benefit corporation organized for charitable and educational purposes. Our principal office is 8350 Wilshire Blvd, Suite 210, Beverly Hills, CA 90211. Questions about this policy or personal information can be sent to info@heyaifoundation.org.
Information we collect
When you request archive access, we process the email address you enter so we can send a one-time verification link. The short-lived verification record includes that email address and expires after 20 minutes. If you verify it, we create a random session credential for your browser. Our session store associates that credential with a keyed, non-readable reference to your email address so we can revoke all sessions for that address when requested; it does not store your raw email in the session record. Session records expire after 30 days, or sooner if you sign out or confirm an all-session sign-out request. We also use short-lived, one-way hashes of email addresses and network addresses to limit automated requests; these rate-limit records expire after about one hour.
If you separately select the optional updates checkbox and verify your email, we retain that address in Resend’s contact service so we can send Hey AI Foundation updates. We record when the choice was made and which version of the checkbox wording was shown. Archive access does not depend on this choice. If you do not select it, your email is not added to the updates contact list.
We also receive information included in messages you send us. Our hosting and security providers may process limited technical information needed to operate and protect the website, such as IP address, browser type, device information, and server logs.
If you choose “Accept analytics” in our cookie banner, Google Analytics 4 collects information about how you use the website, such as pages visited, browser and device details, approximate location, and the site that referred you. We configure page-view URLs to omit query strings and fragments, which can contain one-time verification tokens. We do not send email addresses or Archive credentials to Google Analytics. Analytics is not loaded when you reject or have not yet chosen optional analytics. You can change your choice at any time using the Cookie settings button on any page.
We do not currently collect payment-card information through this website. Before online donations are introduced, the relevant payment provider and donation-specific practices will be identified here and at checkout.
How we use information
- Send and verify member access links, maintain your authenticated session, and respond to your enquiries.
- Send Hey AI Foundation updates only to people who selected the optional updates choice and verified their email.
- Operate and secure the website, and, if you consent to analytics, understand aggregate website use so we can improve it.
- Meet legal, accounting, safeguarding, and recordkeeping obligations.
- Protect the foundation, visitors, and our services from fraud, abuse, and security incidents.
Service providers and sharing
We use service providers that help us host the website, send transactional and optional update emails, temporarily store access-session and abuse-prevention data, and provide optional site analytics. These providers process information to provide their services to us and as required by law. We do not sell personal information or use it for cross-context behavioral advertising.
Our member-access infrastructure uses Vercel for hosting, Resend to send verification emails and manage update subscriptions, and Upstash Redis for verification records, browser-session markers, and rate-limit records. We use Google Analytics 4 for optional site analytics after you consent; see Google’s Privacy Policy for information about Google’s data practices. Resend may process the email address and message content to deliver emails and maintain its own service records under its terms. We may disclose information where required by law or to protect rights, safety, and security.
Retention and choices
Unverified email addresses in access-link records expire after 20 minutes. Session records expire after 30 days; signing out deletes the current session, and a confirmed all-session sign-out deletes the active sessions associated with your email reference. A short-lived revocation counter may remain for up to 21 minutes to prevent an older access link from restoring a signed-out session. Anti-abuse rate-limit hashes expire after about one hour. If you opt in to updates, we keep your address on the updates list until you unsubscribe or ask us to remove it. Resend may retain delivery and suppression records according to its terms and retention practices; an unsubscribe record may be needed to honor your choice. You may also ask us to address information we hold about you by contacting us at the address above.
Sign out of all archive sessions
Enter the email address used for archive access. We’ll send a confirmation link to that address. Confirming it immediately revokes all active archive sessions associated with that address. This does not unsubscribe you from email updates or delete your updates contact; use an update email’s unsubscribe link to change that preference. For other privacy or deletion requests, email us with the subject line “Privacy Request.”
Confirm to sign out every browser with archive access for this email address.
Children and young people
This public website is intended for people aged 13 and over. We do not knowingly collect personal information from children under 13 through this website. A parent or guardian who believes a child has provided personal information may contact us to request its deletion. Programs that collect student information will provide their own age-appropriate notice and consent process where required.
California privacy notice
California residents may request information about personal information we collect, use, or disclose, and may request correction or deletion where applicable. We will not discriminate against a person for exercising a privacy right. Submit a request by email with the subject line “Privacy Request.” We may take reasonable steps to verify a request before acting on it.
Changes to this policy
We may update this policy when our practices, programs, or legal obligations change. The date above shows when it was last revised.