Privacy statement
Version 1.0 · In effect from 6 October 2026 until 13 October 2026
This is an earlier version, kept for reference. The current privacy statement is at hypamoon.com/privacy.
This statement covers all of Hypamoon: the website hypamoon.com, the portal at app.hypamoon.com, the API and the MCP server at api.hypamoon.com, and the calls, messages and chats that run through your project. We collect as little as possible, and here we tell you exactly what we do keep, and for how long.
Who is responsible
Hypamoon is a service of Hypamoon B.V.
Lorentzstraat 89, 2665 JG Bleiswijk, the Netherlands
Chamber of Commerce 42000833
hello@hypamoon.com
We have two roles, and the difference matters:
- We are the controller for the data we need to have you as a customer: your account, your company details and verification, payments and invoices, the use of your keys, and what you leave on the website. Most of this statement is about that.
- We are a processor for the data in your project: the calls with your callers, transcripts and summaries, the texts you send and the chats on your website. You are the controller there and we act on your instructions. See Data in your project.
Why we may process this data
| What | Legal basis |
|---|---|
| Your account, team, project, keys, connected apps, webhooks and the service itself | Our contract with you |
| Company verification and number documents | Our contract with you, and the legal rules for phone numbers |
| Payments, invoices and the data behind them | Our contract with you, and the statutory retention obligation for the invoices |
| Fraud checks, counters per IP address and key, reports of misuse | Our legitimate interest in preventing fraud and misuse |
| Bounces and spam complaints | Our legitimate interest in delivering email reliably |
Source of your sign-up (hm_herkomst) | Our legitimate interest in knowing which channels work |
| Contact form | Your request |
| Data in your project | We act as processor on your instructions; you determine the basis |
Where we rely on legitimate interest, you can object. Email hello@hypamoon.com and we will weigh your situation against our interest.
On the website
hypamoon.com sets no cookies, does no visitor analytics and loads nothing from other parties. Fonts and scripts come from our own server. If you choose Dutch or English at the top, your own browser remembers that choice; it never reaches us.
- Contact form: your name, your company if you enter it, your email address, your message and the language you viewed the site in. We only use this to answer your question and, if you want, to prepare a conversation or partnership. The legal basis is your request itself.
- Your IP address, briefly, when you send the form, to slow down anyone who sends many messages in a row. We do not store it with your enquiry.
- Technical data that every web server sees, such as your IP address and browser type, to show and secure the site.
Your account and the portal
- Signing in: your email address and your name. You sign in with a one-time code or link by email. We store codes and sessions only as a hash, never as readable text.
- A session cookie keeps you signed in to the portal. It is needed for the portal to work; without it you cannot sign in. A session expires after 30 days.
- A source cookie: if you arrive at the portal through a link that carries a source, for example from our website, our docs or an ad, the portal sets one more cookie,
hm_herkomst. It holds only that source and the campaign name, nothing about you or your device, and it expires after 30 days. It is our own cookie: no other party reads it, and we do not use it to follow you across pages or sites. If you sign up within those 30 days, we keep the source with your sign-up. The portal sets no advertising cookies. - Your team: name and email address of colleagues you invite, and their role.
- Sign-up: when you sign up, we add your email address to our own customer system, so we know who is new and can help you. If you came through an ad or a link that carries a source, we keep that source and the campaign name with your sign-up, taken from the
hm_herkomstcookie. We use this only to learn which channels bring customers, never to build a profile of you. The legal basis is our legitimate interest in knowing which of our channels work. - Email we send: if a message to you bounces or is marked as spam, our email supplier tells us. We keep a keyed hash (HMAC) of the address involved, not the address itself, so we stop sending to an address that does not work or does not want our mail. We keep it for 90 days. The legal basis is our legitimate interest in delivering email reliably and not sending mail that is unwanted.
The legal basis is our contract with you: without this data we cannot give you an account.
Company details and verification
Whoever calls through Hypamoon calls on our account with our telephony supplier, and Dutch numbers may only be registered to a verified business. Depending on what you want to use, we therefore ask for:
- Company: Chamber of Commerce number, company name and registered address (we check these in the Dutch Business Register), name and phone number of a contact person, and, if you enter them, your VAT number and billing details.
- Number documents for a regional number: a copy of an identity document, proof of address and a Chamber of Commerce extract. We pass these on to our telephony supplier, because the registration of the number requires it.
- Full verification for outbound calls and a higher spending cap: name and role of the director or authorised person, and your confirmation that the details of the ultimate beneficial owners are correct. We review this ourselves and record who approved or rejected what and when, with the reason.
The legal basis is our contract with you and the legal rules for phone numbers. We also use this data to prevent misuse and call fraud; that is our legitimate interest, and that of everyone who would otherwise be called.
Fraud checks. To keep fraud and abuse off the platform we also run a few checks of our own:
- When you sign up, we look at the category of the network you sign up from, such as a VPN or a data centre. We keep the category, not a profile of your connection.
- At your first payment, we compare the country of your card or bank account (IBAN) with the country of your IP address.
- We check the addresses of the sites you publish through Hypamoon, and the links on them, against lists of unsafe sites kept by a specialised supplier. Only the address goes to that supplier, never the content of your site or data about you.
A check can lead us to ask for more information, to hold a step until we have looked at it, or to stop a site. A person at Hypamoon reviews any decision that blocks your account, and you can always ask us to explain or reconsider it. The legal basis is our legitimate interest in preventing fraud and misuse.
Payments and invoices
- Payments run through a payment provider. You enter your card or account details there, not with us. We only keep what we need to know how you pay: the type of payment method, for a card the brand, the last four digits and the expiry date, and the status of your mandate and of each payment.
- Balance and usage: every top-up and every deduction (calls, texts, chat, numbers), with amount and date.
- Invoices are made in our accounting software, with your company name, address, VAT number, contact person, email address and the invoice lines. We email them and they are in the portal.
The legal basis is our contract and, for the accounts, the statutory retention obligation.
Use of the API and the MCP server
- API keys: we store a key only as a hash, with the name you gave it, its permissions, and when it was last used.
- Connected apps (through OAuth, such as an AI assistant you connect to your project): which app, when it was connected and revoked. Codes and tokens only as a hash.
- Webhooks: your endpoints and a log of every delivery, with status, error code and retries, so you can see what went wrong.
- Idempotency keys you send, with our response, so a repeated request does not do something twice.
- Counters per IP address and per key, to slow down misuse and overload.
- A log of actions in your project, such as issuing and revoking keys, connections, changes to the spending cap and verification. Email addresses are stored there only as a hash.
We do not keep a full copy of every API request. Our hosting provider keeps short technical logs to run the service and trace faults.
Reports of misuse
Anyone can report a site, number or message on Hypamoon that they think is misused. We use the report to investigate and, where needed, to stop the misuse. We do not store the email address or IP address of the person who reports in readable form: we keep a keyed hash (HMAC) of each, so we can recognise repeated or automated reports without knowing who sent them. We keep that hash for 30 days. The legal basis is our legitimate interest, and that of everyone affected, in stopping misuse of our service.
Data in your project
What comes in or goes out through your numbers, your assistant, your texts and your chat widget, we process on your behalf. You are the controller, which includes informing your callers and website visitors. This covers:
- Calls: phone numbers, time, duration and cost, and for an AI call the transcript, the summary and what the caller passed on. A recording only if recording is switched on.
- Texts: the recipient's number, the text and the delivery status.
- Chat and the chat widget: your visitors' messages and your assistant's answers, the name, email address or phone number your visitor or your code provides, and the summary. To slow down misuse we count requests per IP address. If you switch on the bot check, a specialised party runs a short check in your visitor's browser.
The data processing agreement between you and us applies to this. You can get it at hello@hypamoon.com. If a caller or visitor asks us for access or deletion, we forward the request to you.
We do not use the calls and chats in your project to train AI models.
How long we keep data
A daily job carries out the periods below automatically, except those for invoices, the action log and the contact form.
| What | How long |
|---|---|
| Call transcripts, summaries and notes | 12 months; after that only the line for the invoice remains |
| Call recordings | 90 days |
| Voicemails, file and transcript | 12 months |
| Texts: recipient and content | 12 months; the line for the cost remains |
| Chats, including the chat widget | 12 months after the chat started |
| Events from the phone network, with numbers | 60 days |
| The other party's number in the call history | Masked after 24 months, down to the country code and the last digits |
| Expired sign-in codes and sessions | 7 days after expiry |
| Expired team invitations | 30 days after expiry |
| Counters per IP address | 7 days |
| Idempotency keys | 7 days |
| OAuth codes and tokens | Codes 1 day, tokens 30 days after expiry or revocation |
| Number documents | After you delete your account, as soon as your numbers have been released |
Source cookie hm_herkomst in your browser | 30 days |
| Email and IP address of whoever reports misuse, as a keyed hash | 30 days |
| Bounces and spam complaints, address as a keyed hash | 90 days |
| Invoices, payments and the data behind the invoice (who, when, how long, what it cost) | 7 years, as the law requires |
| Log of actions | Not deleted; email addresses are stored only as a hash |
| Contact form | As long as we need it for your question and any partnership; deleted sooner on request |
What is not in the table, such as your account, your company details and the settings of your project, we keep for as long as you are a customer. There is no automatic period yet for after you leave: email us and we delete what we no longer need for the invoice or the law.
If you are the last user and delete your account, we immediately delete the content of your calls, voicemails, texts and contacts. We release your numbers after 7 days. Chats follow the period in the table. Invoices and the data behind them stay, because the law requires it. Something we deleted can remain in a backup for a while, until that backup expires.
Suppliers we use
We work with specialised suppliers, who only receive what they need for their part. These are suppliers for:
- telephony, numbers, texts and speech recognition, and the voice and language model of the assistant on the phone;
- the language model behind the chat and the summaries;
- hosting, database and storage;
- payments and accounting;
- sending email;
- bot checks for the chat widget, if you switch them on;
- checking site addresses and links against lists of unsafe sites.
We have a data processing agreement with each of these suppliers; usually it is part of the terms we agreed with them. Want the list with names and locations? Email us and we will send it.
Where your data is
We keep your data in the European Union. For some parts, such as telephony, the language model and the security of our website, we work with suppliers that also process in the United States. That only happens as far as needed to deliver the service, and under the safeguards the GDPR requires, such as the standard contractual clauses of the European Commission.
Security
All connections are encrypted. Each project only sees its own data; we decide that on the server, not from what a browser or app sends along. Secrets such as keys, codes and tokens are stored only as a hash. Recordings and documents can only be fetched with a temporary link, after we have checked that you are allowed to see them.
Your rights
Under the GDPR you have the right to access, correct, delete, restrict and port your data, and you can object to processing. You can change much of it yourself in the portal. For the rest, or for a question about this statement, email hello@hypamoon.com. We reply within a month. If you disagree with us, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
Are you a caller or website visitor of one of our customers? Then that customer is responsible and is the quickest place to go. If you email us, we forward your question.
Changes
If anything changes in what we process or how long we keep it, we update this statement and the date at the top. If it matters for your project, we email you.