Skip to the content

Privacy Policy

Effective date: October 15, 2026

1. Introduction

The Soda Machine Co. ("Company", "we", "us") operates Hyper, which consists of the desktop application, the iOS application, the website at heyhyper.ai, and the services behind them (together, the "Service"). This Privacy Policy describes the information the Service collects, how we use it, the parties that process it, and the choices and rights available to you.

Hyper is an AI agent. You sign in, connect the tools you already use, and instruct Hyper to find information, act in those tools, run scripts on your computer or in a cloud sandbox, and run automations on a schedule or in response to events in a connected tool. The information described below is collected so that the Service can perform that work for you.

2. Information we collect

Account information. When you sign in with Google or Apple, we receive your name, email address, and profile photo. When you create a workspace, we store its name, its members, and the email addresses of the people you invite.

Connected accounts. When you connect a third-party tool, we store its access token in encrypted form. We then retrieve the data listed on that tool's permission screen, which may include emails, calendar events, documents and files, chat messages, contacts, CRM records, tickets, and source code. The Service keeps a copy of that content on our servers so that it can be searched and used to answer your requests. You choose which tools to connect, and you may disconnect any of them at any time.

Content you create in the Service. Your chat messages, the files you attach, your responses to approval prompts, the automations you create and their runs, and the output the agent produces. Together with the connected-account content above, this is "Your Data".

Computer activity. If you allow Hyper to use your desktop, the agent writes scripts that run on your computer under your user account's permissions, starting in the folders you have allowed. The text of each script and its output are transmitted to our servers and stored with the chat. The Service does not upload files from your computer unless a script returns them as a result.

Voice. When you use dictation, audio from your microphone is streamed to Deepgram and converted to text. We store the text. We do not store the audio.

Information collected automatically. Application version, operating system, timestamps, and logs of requests and errors. Product analytics events that record which features you use, associated with your user id, email address, and name. Session replays of the desktop and iOS applications, only when you enable "Share session information" under Settings → Privacy; these replays are masked so that typed text, form inputs, and media are not captured. Session replays of the website, which are enabled by default. Your IP address when you use the website.

Website forms. The email address you provide when you join the waitlist or contact us.

3. How we use information

We use the information we collect:

  • To provide the Service: respond to your requests, act in your connected tools, and run your automations
  • To operate and secure the Service: monitoring, debugging, and abuse prevention
  • To improve the Service: product analytics and session replays
  • To communicate with you: workspace invitations, product updates, and support
  • To comply with legal obligations

We do not sell your personal information, and we do not use it for advertising.

4. AI providers

To respond to a request, the Service sends the content that request requires to a model provider: your message, the relevant connected content, and the results of the tools the agent used. The provider depends on the model you select. Anthropic also generates the title of each chat.

Under our API agreements, Anthropic and OpenAI do not use Your Data to train their models. We do not train models on Your Data.

Other providers support specific features. Deepgram converts dictation to text; we have opted out of its model improvement program. Exa receives the search queries the agent composes when it searches the web. E2B provides the cloud sandbox used when no desktop is connected; the sandbox has no internet access and no access to your connected accounts, and it is destroyed when the session ends. Kernel provides the cloud browser where that feature is available in your version of the Service and you enable it for a chat. Unipile relays LinkedIn, WhatsApp, and Telegram connections and maintains the session for those accounts.

Hyper's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the features you request in the Service. We do not use it for advertising, we do not sell it, and no person at the Company reads it except with your consent, to investigate a security problem, or as required by law.

5. Service providers

The following companies process data on our behalf under agreements that restrict their use of it:

  • Supabase — authentication and database hosting
  • Amazon Web Services — servers, secret storage, logs, and metrics
  • Backblaze — storage of files you attach and files the agent produces
  • Cloudflare — delivery of profile photos and application updates
  • Anthropic, OpenAI, Deepgram, Exa, E2B, Kernel, Unipile — as described in section 4
  • PostHog — product analytics and session replay
  • Resend — delivery of the emails we send

6. How we share information

Workspace members. Members of your workspace can see the automations and chats you share, and can use the connected accounts you designate as shared. Content the Service retrieved through a shared connection may appear in another member's chat.

Share links. When you share a chat, anyone who has the link can read the snapshot you shared. Deleting the chat disables the link.

Connected tools. When the Service acts on your behalf, for example by sending an email or posting a message, that content is transmitted to the relevant tool under your account.

Company personnel. Our personnel access Your Data only to provide support you have requested, to investigate and resolve a security problem, or as required by law.

Business transfers. If the Company is acquired by or merged with another company, Your Data may be transferred to the successor, which will remain bound by this Privacy Policy. We will notify you before any such transfer takes effect.

Legal requirements and safety. We disclose information when required by law, or when necessary to protect the rights and safety of our users or of the Company.

7. International transfers and legal bases

Our servers, database, file storage, and analytics are located in the United States. If you use the Service from another country, your information is transferred to and processed in the United States. For transfers from the European Economic Area, the United Kingdom, or Switzerland, we rely on the necessity of the transfer to provide the Service you have requested, and on standard contractual clauses in our agreements with the providers listed in section 5.

Where applicable law requires a legal basis for processing, we rely on:

  • Performance of our contract with you, for providing the Service: your account, your connected accounts, your chats, your automations, and the scripts you authorize
  • Our legitimate interests in operating, securing, and improving the Service: logs, monitoring, product analytics, and communications about the Service
  • Your consent, for features you enable: session replay in the applications, dictation, and each tool you connect. You may withdraw consent at any time by disabling the feature or disconnecting the tool.
  • Compliance with legal obligations, for records we are required to keep

8. Security

Data is transmitted over TLS, including between our servers and our database. Data at rest is encrypted at the storage layer. Access tokens for your connected accounts are additionally encrypted with a key held in a separate secret store. Every request is authorized against your user account and your workspace. Hyper is CASA Tier 2 approved for Google restricted-scope access. No system is completely secure, and you are responsible for the security of the devices and accounts you use to sign in. If a security incident affects Your Data, we will notify you and the relevant authorities as required by law.

9. Retention and deletion

We retain your account and Your Data for as long as your account exists. When you disconnect a tool, the content the Service copied from it is deleted together with the connection, and we revoke our access to that tool. Chats that quote that content are retained until you delete them. When you delete a chat, its share link is disabled. Operational logs are retained for as long as necessary to operate and secure the Service.

To delete your account and all associated data, email us from the address you use to sign in at founders@heyhyper.ai. We complete deletion within 30 days, except for records we are required by law to retain. Copies in our database backups expire within a further 30 days.

10. Your choices and rights

At any time, you may:

  • Disconnect any tool in the application
  • Disable session sharing under Settings → Privacy
  • Unsubscribe from product emails using the link in each message
  • Request a copy of Your Data, a correction, or deletion

Depending on your jurisdiction, you may also have the right to object to or restrict certain processing, and to lodge a complaint with a data protection authority. To exercise any of these rights, contact us at founders@heyhyper.ai.

11. Cookies and local storage

The applications store your sign-in token in your device's secure storage. The website uses PostHog, which stores an identifier in your browser for analytics and session replay. We do not use advertising cookies. We do not respond to "Do Not Track" browser signals.

12. Children's privacy

The Service is not intended for children under 13, and we do not knowingly collect information from children under 13.

13. Changes to this policy

We will post any changes to this Privacy Policy on this page and update the effective date. For a material change, we will also notify you in the application or by email before the change takes effect.

14. Contact

Questions about this Privacy Policy may be sent to founders@heyhyper.ai or by mail to The Soda Machine Co., 601 California St, Suite 525, San Francisco, CA 94108, USA.