Hailr
Start with 25 free messages

Privacy Policy

Last updated: October 2026

1. Introduction

Hailr is operated by Platform as a Service SRL, a company registered in Romania ("we", "us", or "our"). We run the Hailr platform at hailr.ai, a B2B SaaS service for automated website discovery and outreach. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services.

By using Hailr, you agree to the practices described in this policy. If you do not agree, please do not use our services.

2. Data We Collect

Account Information

When you register, we collect your name, email address, and password (stored as a hashed value). If you subscribe to a paid plan or buy messages on Pay as you go, Starter or Growth, we collect billing information through our payment processor, Stripe.

Usage Data

We automatically collect information about how you use the platform, including:

  • Campaign configurations and settings
  • Number of websites discovered, scouted, and contacted
  • Usage and billing history, including your message history (messages granted, bought and delivered)
  • Log data (IP address, browser type, access times)

API Keys and the Providers That Run Your Campaigns

On Pay as you go, Starter and Growth, your campaigns run on our own OpenAI, Serper, 2Captcha and proxy accounts: website content, the messages written for your campaigns and the forms they fill are processed by these providers under our accounts, only to run your campaigns.

On BYOK, every account runs on its own keys: its own OpenAI and Serper accounts, a proxy for campaigns that fill contact forms and an optional 2Captcha key. You add them in Settings. Your keys are encrypted with AES-256 when saved to your account and are decrypted only on our servers, to run your own campaigns. We do not resell them and we do not use them for any other account. The providers bill you directly for what your campaigns use.

Emails go out through the email (SMTP) account you connect, on the plans that send emails (Growth and BYOK).

Campaign Data

Data generated during campaigns (discovered URLs, email addresses, contact form information, outreach messages) is stored in association with your account.

Data About the Businesses You Contact

Your campaigns collect business contact details from public websites: website addresses, email addresses, contact form pages, a short excerpt of each homepage and a one-sentence description of the business. They also keep the messages that were sent. For this data you are the controller and we process it on your behalf, only to run your campaigns. When someone unsubscribes, we keep that record with the campaign, so no campaign of your account contacts that email address or website again. Deleting that campaign deletes the record too.

Your Reply Inboxes

If you connect a reply inbox in Settings, the app reads every new message in the inbox folder of that mailbox, from the "Read from" day on. Your own mail, mail from your own company domain (not a public mail provider) and automatic mail (out of office replies, bounces, newsletters and bulk mail marked as such by their headers) are skipped by their headers. Every other message is sent to OpenAI (with our account on Growth and with your own key on BYOK), to decide whether it is a reply from a lead. This mail is read automatically by our systems and by AI models, not by people, so that the leads can be sorted correctly. Only leads are stored, with their conversation. For every other message we keep only its message identifier and how it was sorted, never its content. The mailbox is opened read only: nothing is marked as read, moved or deleted, and the only thing we add is a copy of each reply you send from Leads, in your Sent folder. Your IMAP user and password are encrypted with AES-256 when saved.

3. How We Use Your Data

We use your data to:

  • Provide, maintain, and improve the Hailr service
  • Process your campaigns (harvest, scout, qualify, and contact)
  • Process payments and manage your subscription
  • Send service emails: a welcome email and an email verification link when you sign up, and a password reset link when you ask for one. Payment emails such as receipts come from Stripe, and campaign alerts go out through your own email sender.
  • Monitor and prevent abuse of the platform
  • Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

Legal Basis

We process your account data to perform our contract with you, to meet our legal obligations (for example for billing records), and for our legitimate interest in keeping the platform secure and preventing abuse. Data about the businesses you contact is processed on your instructions, as described in Section 2.

4. Third-Party Services

We use the following third-party services to operate the platform. Each has its own privacy policy governing how they handle data. OpenAI, Serper and 2Captcha are called with our accounts on Pay as you go, Starter and Growth and with your own keys on BYOK, and only to run your campaigns:

  • Stripe: Payment processing. Stripe handles all payment card data directly; we never store your card details.
  • OpenAI: AI processing for website analysis, message generation, form analysis and sorting the mail of a reply inbox you connect. Website content and the messages of that inbox may be sent to OpenAI's API for processing.
  • Serper: Search API for discovering websites during the harvest phase.
  • 2Captcha: CAPTCHA solving, with our account on Pay as you go, Starter and Growth and with your own key on BYOK if you connect one.
  • Proxy and email providers: Contact forms are submitted through our proxies on Pay as you go, Starter and Growth and through the proxy you connect on BYOK, and emails are sent through the email account you connect. You choose and pay your email provider, and on BYOK your proxy provider too.
  • Our hosting provider: the servers that run the platform, store its database and keep its backup copies.
  • Our email service: sends the welcome email and the verification link when you sign up, and password reset links.

Some of these providers, for example OpenAI and Stripe, are based in the United States and may process your data outside the European Union, under their own transfer safeguards. The proxy and email providers process data where they operate.

5. Data Storage and Security

Your data is stored on servers located in the European Union. We implement appropriate technical and organizational measures to protect your data, including:

  • AES-256 encryption of API keys and credentials when they are saved to your account
  • Encrypted connections (HTTPS) between your browser and our servers
  • Password hashing using industry-standard algorithms
  • Access controls and authentication for all internal systems

6. Cookies

We use only the cookies needed to sign you in. We do not use tracking cookies or third-party advertising cookies.

  • Sign-in cookie: keeps you signed in. It expires 30 days after you last used the platform, or when you log out.
  • Sign-in security cookie: protects signing in against cross-site requests. It is removed when you close your browser.
  • Return cookie: remembers which page to send you back to after you sign in. It is removed when you close your browser.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

  • Access: Request a copy of all personal data we hold about you.
  • Rectification: Request correction of inaccurate data.
  • Erasure: Request deletion of your personal data and account.
  • Export: Request your data in a portable, machine-readable format.
  • Restriction: Request that we limit processing of your data.
  • Objection: Object to processing of your data for specific purposes.

You can export your data and delete your account yourself in Settings.

To exercise any of these rights, email us at hello@hailr.ai. We will respond within 30 days.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the problem happened.

8. Data Retention

We keep your account and campaign data for as long as your account exists. You can delete a campaign at any time.

If you delete your account in Settings, your account, keys, settings, campaigns, websites and messages are removed from our live database at once, and a paid plan is cancelled. Our internal log keeps a record of the deletion and the cost summaries of your campaigns (campaign name, counts and provider costs). Copies in our backups are deleted as the backups rotate.

9. Children's Privacy

Hailr is a business-to-business service and is not intended for use by individuals under 18 years of age. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on the platform at least 30 days before they take effect. Your continued use of Hailr after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

Hailr is operated by Platform as a Service SRL, CUI 32219778, Str Viilor 143G, Navodari, Constanta, Romania.

If you have questions about this Privacy Policy or how we handle your data, email us at hello@hailr.ai.