Privacy Policy
Last updated: October 16, 2026
1. Introduction
This Privacy Policy is intended to inform users of the Hekko service (hereinafter "the Service") about the methods of collection, use, and protection of their personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).
Hekko is committed to protecting the privacy of its users and to processing their personal data in a transparent, fair, and secure manner.
2. Data controller
The data controller is Hekko, operated by Elian Tornikoski, sole proprietor (entrepreneur individuel), registered under SIRET number 106 175 532 00014.
Contact: contact@hekko.ai
3. Data collected
In the context of using the Service, the following data may be collected:
3.1 Identification data
- Email address
- Password (stored in encrypted form)
3.2 Content data
- Audio content provided by the user when using the Service
- Automatically generated text transcriptions
- Notes, meeting summaries and other content generated by artificial intelligence
- Folder organization and associated metadata
- Documents you import (PDF, slides, etc.) and their text content
3.3 Technical data
- IP address
- Browser type and version
- Operating system
- Connection and usage data
- Technical cookies necessary for operation
4. Processing of recordings and documents
The audio recordings and documents you import are used exclusively to generate the content of your courses and meetings.
Important: audio files are not retained and are automatically deleted once the content has been generated. Likewise, the files of documents you import are deleted once the content of your course or meeting has been generated. Only the generated content and the text needed to generate it (including the transcript) are kept in your account.
4a. Recorded meetings (Hekko Pro)
Hekko also lets you record or import meetings, in particular with the Hekko Pro plan for professionals and non-profit associations. A meeting contains the voice and words of people who do not necessarily have a Hekko account: the participants.
Who is responsible for participants' data?
When a business customer records a meeting as part of its activity, it decides to record it and what to do with it: it is the controller of the participants' data. Hekko then acts as a processor, on its behalf and on its instructions (Article 28 GDPR). A data processing agreement (DPA) is available on request at contact@hekko.ai. Hekko remains the controller of its customers' account and billing data.
Before recording, the user must inform the participants and, where the law requires it, obtain their consent. The user is also responsible for answering participants who wish to exercise their rights; Hekko helps on request. Recording someone without their knowledge is prohibited. Hekko reminds you of this obligation the first time you record.
Meeting data
- The meeting audio: deleted automatically once the summary has been generated
- Attached documents (agenda, presentation): files deleted after generation; their text is kept so the summary can be regenerated
- The text transcript of the meeting
- The summary and points to watch
- Action items, with the names of the people responsible and the deadlines mentioned during the meeting
- The follow-up email draft and the recipients you enter
- Your conversations with the assistant about your meetings
This data is kept for as long as the account exists, including after a subscription ends. A deleted meeting goes to the trash and is permanently erased within 30 days; deleting the account erases all its meetings within 30 days. You can download all your data at any time from Settings ("Download my data").
Share links
If you share a meeting, anyone with the link can read its summary and action items without an account. The link is not offered to search engines (noindex tag). You can turn sharing off at any time: the link then stops working.
Teams
In a Hekko Pro team, the person who pays (and the co-administrators they appoint) sees, for each member, their email address, the number of meetings in the last 30 days and the date of last activity. They never see the title or content of a member's meetings. Each member alone has access to their meetings, unless they choose to share them; a member removed from the team keeps their account and meetings.
Demo and quote requests
The demo and quote forms on the Hekko Pro page send your email address and message, and for a quote your name, your organization's name and the number of seats, to our contact@hekko.ai inbox so we can reply. For a demo, an alert containing no personal data is also sent to our internal messaging (Telegram). If you are signed in, the request is noted in your account, without your address or message. These exchanges are kept for 3 years after the last contact.
Providers that process your meetings
- Audio transcription : Groq (United States)
- Writing (summary, action items, recommendations, follow-up email, assistant) : OpenAI and Anthropic (United States); Google (Gemini) may locate figures in some imported documents
- Storage : Supabase (database hosted in Ireland)
- Hosting and processing : Vercel and Trigger.dev
- Emails : Resend (United States)
These AI providers are contractually bound not to use data sent through their API to train their models. They may keep it temporarily to detect abuse (up to 30 days, 55 days for Google), then delete it. Transfers outside the European Union are covered by the safeguards provided for by the GDPR (standard contractual clauses, EU–US Data Privacy Framework).
5. Purposes of processing
The collected data is used solely for:
- Provide transcription, note-taking and meeting summary services
- Managing your user account and subscriptions
- Improving the quality and performance of the Service
- Ensuring the security and proper functioning of the platform
- Communicating with you regarding your account or the Service
- Complying with our legal obligations
No data is sold or transferred to third parties for commercial purposes.
6. Legal basis for processing
The processing of your personal data is based on:
- Performance of a contract : for the provision of the Service to which you have subscribed
- Consent : for marketing communications (if applicable)
- Legitimate interest : for improving the Service and security
- Legal obligations : for the retention of certain data
7. Data recipients
Your personal data may be transmitted to the following categories of recipients:
- Our technical subcontractors : hosting, payment processing, AI services (in compliance with the GDPR)
- Competent authorities : in case of legal obligation
We make sure our processors provide sufficient data protection guarantees. Hekko does not train any artificial intelligence model on your data, and our AI providers are contractually bound not to use the data we send them to train their models (see section 4a).
8. Data transfers outside the EU
Some of our subcontractors may be located outside the European Union. In such cases, we ensure that appropriate safeguards are in place (standard contractual clauses, adequacy decisions, etc.) in accordance with the GDPR.
9. Data retention period
Data is retained for the following periods:
| Data type | Retention period |
|---|---|
| Audio recordings | Not retained (immediately deleted after processing) |
| Imported documents (original files) | Deleted after the course content is generated |
| Transcripts, notes and meeting summaries | As long as the account is active; permanently deleted within 30 days after a course or the account is deleted |
| Account data | Permanently deleted within 30 days after the account is deleted |
| Billing data | 10 years (legal obligation) |
| Connection logs | 12 months |
| Hekko Pro demo and quote requests | 3 years after the last exchange |
10. Data security
Appropriate technical and organizational measures are in place to ensure the confidentiality, integrity, and security of data:
- Encryption of data in transit (HTTPS/TLS)
- Password encryption
- Hosting on secure servers
- Restricted access to personal data
- Regular backups
- Monitoring and intrusion detection
11. Your rights
In accordance with the GDPR, you have the following rights:
Right of access
You can obtain confirmation that data concerning you is being processed and receive a copy.
Right to rectification
You can request the correction of inaccurate or incomplete data.
Right to erasure
You can request the deletion of your personal data, subject to our legal retention obligations.
Right to restriction of processing
You can request the restriction of the processing of your data in certain cases.
Right to data portability
You can receive your data in a structured and commonly used format.
Right to object
You can object to the processing of your data on legitimate grounds.
Exercising your rights
To exercise your rights, you can:
- Use the features of your personal space (export, deletion)
- Contact us at: contact@hekko.ai
We will respond to your request within one month. This period may be extended by two months in case of a complex request.
12. Cookies
Hekko uses the following categories of cookies:
- Authentication cookies : to maintain your logged-in session
- Preference cookies : to remember your settings (language, etc.)
- Analytics cookies : to understand how the site is used and improve it — only set after you agree
- Sharing and referral cookies : to credit your friend when you arrive through a shared link — they only record the landing page, never campaign data
- Marketing measurement cookies : to know which campaign introduced you to Hekko, kept for 90 days — only set after you agree
- Advertising cookies (Meta and OpenAI pixels) : to measure how well our ads on Instagram, Facebook and ChatGPT perform and show them to relevant audiences; this data is shared with Meta Platforms Ireland Ltd. and OpenAI — only set after you agree
Authentication, preference and sharing cookies are strictly necessary for the Service to work and do not require your consent; the cookie that remembers your choice below is one of them. Analytics and marketing measurement cookies are only set after your explicit agreement, which you can withdraw at any time below. We also measure traffic and performance with Vercel Analytics and Speed Insights, which set no cookies and cannot identify you. The only advertising tracker we use is the Meta pixel, set only after your explicit consent.
13. Minors
The Service is not intended for persons under 16 years of age. We do not knowingly collect personal data from minors under 16.
14. Policy modifications
Hekko reserves the right to modify this Privacy Policy at any time. In the event of a substantial modification, we will inform you by email or through the Service.
15. Contact and complaints
For any questions regarding this Privacy Policy or to exercise your rights, you can contact us:
- By email: contact@hekko.ai
If you believe that your rights are not being respected, you can file a complaint with the CNIL (French National Commission on Informatics and Liberty):
- Website: www.cnil.fr
- Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
Hekko
Automatic course notes and meeting summaries