Last updated October 2026

Privacy policy

Hey Tomo ("we") provides AI employees to businesses. This page explains what we collect on this website and how we handle data inside the product.

On this website

• When you fill in the early-access form, we keep your name, business, WhatsApp number, email and message, and use them only to contact you about Hey Tomo.
• Questions you type into the "Ask Tomo" chat are sent to an AI service to answer them. Please don't share personal or payment details there.
• We save your light or dark theme choice in your browser. We use no advertising trackers.

In the product, and the DPDP Act

• Your business is the data fiduciary for its customers' data. We act as your data processor under a data processing agreement.
• Files are encrypted, stored under your workspace only, and opened through short-lived links.
• Raw files are deleted after 90 days by default. You can change this, and a "delete everything" button removes all your data.
• Aadhaar numbers are masked to the last 4 digits as soon as they are read. PAN is shown only in part.
• We notify you of a personal data breach without delay.

Cookies

The website uses essential cookies and similar browser storage to run: to keep you signed in, keep sign-in secure and remember your theme. These are always on.

Analytics cookies, which count visits so we can improve the site, and marketing cookies, which measure our ads on other sites, are used only if you allow them. Today the website loads no analytics or marketing scripts at all.

You can change your choice at any time with "Cookie settings" at the bottom of the home page. Your choice is stored in your browser with the date you made it.

Business account sign-in security

When you sign in to your business account, we use a salted hash of a small set of browser signals to recognise new devices, protect the two-step sign-in check and limit repeated sign-ups. We store the hash, not the original browser signals. A random security seed stays in your browser; a remembered two-step device expires after 30 days. We do not use this device check to fingerprint your business’s customers or for advertising. Sign-in records and your required Terms acceptance time are kept with your account; product-news consent is optional.

Contact

Write to hello@hey-tomo.com to see, correct or delete your data.