Privacy statement

Version 2.2 · In effect from 27 October 2026. Replaced by version 2.3 on 9 November 2026 · Previous version

This statement covers all of Hypamoon: the website hypamoon.com, the portal at app.hypamoon.com, the API and the MCP server at api.hypamoon.com, and the calls, messages and chats that run through your project. We collect as little as possible, and here we tell you exactly what we do keep, and for how long.

Who is responsible

Hypamoon is a service of Hypamoon (KvK 42000833).

We have two roles, and the difference matters:

• We are the controller for the data we need to have you as a customer: your account, your company details and verification, your balance, payments and invoices, where you are for tax purposes, the security of your sign-in, the use of your keys, and what you leave on the website. Most of this statement is about that.
• We are a processor for the data of the people you serve through your project: the calls with your callers, transcripts and summaries, the texts you send, the chats on your website, the users and data of your sites and apps, and the orders of your customers. You are the controller there and we act on your instructions. See Data in your project.

Why we may process this data

Where we rely on legitimate interest, you can object. Email hello@hypamoon.com and we will weigh your situation against our interest.

On the website

hypamoon.com sets no cookies, does no visitor analytics and loads nothing from other parties. Fonts and scripts come from our own server. If you choose Dutch or English at the top, your own browser remembers that choice; it never reaches us.

• Contact form: your name, your company if you enter it, your email address, your message and the language you viewed the site in. We only use this to answer your question and, if you want, to prepare a conversation or partnership. The legal basis is your request itself.
• Your IP address, briefly, when you send the form, to slow down anyone who sends many messages in a row. We do not store it with your enquiry.
• Technical data that every web server sees, such as your IP address and browser type, to show and secure the site.

Your account and the portal

• Signing in: your email address and your name. You sign in with a one-time code or link by email. We store codes and sessions only as a hash, never as readable text.
• A session cookie keeps you signed in to the portal. It is needed for the portal to work; without it you cannot sign in. A session expires after 30 days.
• A source cookie: if you arrive at the portal through a link that carries a source, for example from our website, our docs or an ad, the portal sets one more cookie, hm_herkomst. It holds only that source and the campaign name, nothing about you or your device, and it expires after 30 days. It is our own cookie: no other party reads it, and we do not use it to follow you across pages or sites. If you sign up within those 30 days, we keep the source with your sign-up. The portal sets no advertising cookies.
• A "seen before" cookie: once you have signed in, the portal sets hm_bekend with the value 1. It only tells the sign-in page to show "Welcome back" instead of the sign-up screen. It holds nothing about you, your account or your device, only we read it, and it expires after 400 days. You can delete it at any time; the only effect is that you see the sign-up screen first.
• Two-step verification and passkeys, if you switch them on. For an authenticator app we keep its secret encrypted and tied to your user, and the last code we accepted, so a code works only once. Recovery codes exist only as a hash. For a passkey we keep its public key, its identifier, the name you gave it and when it was added and last used. The private key never leaves your device, and if your device unlocks a passkey with your face or fingerprint, that stays on your device too. We keep all of this until you remove it or your account.
• Your team: name and email address of colleagues you invite, and their role.
• Sign-up: when you sign up, we add your email address to our own customer system, so we know who is new and can help you. If you came through an ad or a link that carries a source, we keep that source and the campaign name with your sign-up, taken from the hm_herkomst cookie. We use this only to learn which channels bring customers, never to build a profile of you. The legal basis is our legitimate interest in knowing which of our channels work.
• Email we send: if a message to you bounces or is marked as spam, our email supplier tells us. We keep a keyed hash (HMAC) of the address involved, not the address itself, so we stop sending to an address that does not work or does not want our mail. We keep it for 90 days. The legal basis is our legitimate interest in delivering email reliably and not sending mail that is unwanted.

The legal basis is our contract with you: without this data we cannot give you an account.

Company details and verification

Whoever calls through Hypamoon calls on our account with our telephony supplier, and phone numbers come with rules that differ per country and type of number. Where the number requires it, for example a Dutch 085 number, we ask you to verify your business. Depending on what you want to use, we therefore ask for:

• Company: Chamber of Commerce number, company name and registered address (we check these in the Dutch Business Register), name and phone number of a contact person, and, if you enter them, your VAT number and billing details.
• Number documents for a regional number: a copy of an identity document, proof of address and a Chamber of Commerce extract. We pass these on to our telephony supplier, because the registration of the number requires it.
• Full verification for outbound calls and a higher spending cap: name and role of the director or authorised person, and your confirmation that the details of the ultimate beneficial owners are correct. We review this ourselves and record who approved or rejected what and when, with the reason.

The legal basis is our contract with you and the legal rules for phone numbers. We also use this data to prevent misuse and call fraud; that is our legitimate interest, and that of everyone who would otherwise be called.

Fraud checks. To keep fraud and abuse off the platform we also run a few checks of our own:

• When you sign up, we look at the category of the network you sign up from, such as a VPN or a data centre. We keep the category, not a profile of your connection.
• At your first payment, we compare the country of your card or bank account (IBAN) with the country of your IP address.
• Phone verification: before you use something that reaches people or moves money, such as a phone number, text messages, email from your own domain or real payments, and in some cases before a site goes public or you connect your own domain, we may ask you to confirm a phone number by calling or texting our verification number. We never answer that call, so it costs you nothing. We do not store the number itself, only a keyed hash of it and its last two digits, with the method, the time and the outcome. Each attempt also stores a keyed hash of your IP address.
• We check the addresses of the sites you publish through Hypamoon, and the links on them, against lists of unsafe sites kept by a specialised supplier. Only the address goes to that supplier, never the content of your site or data about you.

A check can lead us to ask for more information, to hold a step until we have looked at it, or to stop a site. A person at Hypamoon reviews any decision that blocks your account, and you can always ask us to explain or reconsider it. The legal basis is our legitimate interest in preventing fraud and misuse.

Payments and invoices

• Payments run through a payment provider. You enter your card or account details there, not with us. We only keep what we need to know how you pay: the type of payment method, for a card the brand, the last four digits and the expiry date, and the status of your mandate and of each payment.
• Balance and usage: every top-up and every deduction (calls, texts, chat, numbers, AI, agent runs), with amount and date. From that we work out what is left of each top-up and when it expires, and we email the account owner before balance expires. When a call or run starts, we record the amount we hold for it and what was charged in the end.
• Where you are: EU VAT rules require two pieces of evidence for where a customer is, and we use the same evidence to apply the countries where we offer paid use. For each top-up we record the country of your billing address, the country of your payment method and the country of your IP address, and which country we determined. We keep only country codes: never your card or account number for this, and never the IP address itself.
• Your request to start right away: if you are a consumer, we record when you asked us to start right away at your first top-up, which version of the terms applied, and the text you agreed to. That is how we can show it if you later withdraw.
• Invoices are made in our accounting software, with your company name, address, VAT number, contact person, email address and the invoice lines. We email them and they are in the portal.

The legal basis is our contract and, for the accounts and the evidence of where you are, the statutory obligations for VAT and retention.

Use of the API and the MCP server

• API keys: we store a key only as a hash, with the name you gave it, its permissions, and when it was last used.
• Connected apps (through OAuth, such as an AI assistant you connect to your project): which app, when it was connected and revoked. Codes and tokens only as a hash.
• Webhooks: your endpoints and a log of every delivery, with status, error code and retries, so you can see what went wrong.
• An error log: for each failed request the tool or route, the error code and a masked description, without the values you sent.
• The assistant in the portal: your questions, its answers and what it proposed.
• Idempotency keys you send, with our response, so a repeated request does not do something twice.
• Counters per IP address and per key, to slow down misuse and overload.
• A log of actions in your project, such as issuing and revoking keys, connections, changes to the spending cap and verification. Email addresses are stored there only as a hash.

We do not keep a full copy of every API request. Our hosting provider keeps short technical logs to run the service and trace faults.

Reports of misuse

Anyone can report a site, number or message on Hypamoon that they think is misused. We use the report to investigate and, where needed, to stop the misuse. We do not store the email address or IP address of the person who reports in readable form: we keep a keyed hash (HMAC) of each, so we can recognise repeated or automated reports without knowing who sent them. We keep that hash for 30 days. The legal basis is our legitimate interest, and that of everyone affected, in stopping misuse of our service.

Waitlist

If a paid plan, phone numbers, calls or SMS aren't available in your country yet, you can join our waitlist in the dashboard or at app.hypamoon.com/waitlist. We keep your country, what you'd like to use, where and when you signed up, and in the dashboard the project you were in. We only keep your email address if you tick the box that asks us to email you, and then encrypted; without it we only count the interest per country. We send one email to confirm your address; the link works for 7 days, and if you don't confirm we delete your address and keep only the anonymous count. Once confirmed, we use your address to email you once when it's available in your country. If it doesn't open within 24 months, we delete your address; a month before that we ask once if you'd like to stay on the list for another 24 months. Every waitlist email has an unsubscribe link, and unsubscribing deletes your address right away. Questions: hello@hypamoon.com.

Data in your project

What comes in or goes out through your numbers, your assistant, your texts and your chat widget, we process on your behalf. You are the controller, which includes informing your callers and website visitors. This covers:

• Calls: phone numbers, time, duration and cost, and for an AI call the transcript, the summary and what the caller passed on. A recording only if recording is switched on.
• Texts: the recipient's number, the text and the delivery status.
• Email: for each email your project sends, the recipient, the subject, the time and the delivery status. We never keep the body or attachments.
• Sites and apps: the accounts of the people who sign in to your apps, the data they and your app store in it, the files they upload, and the forms on your sites.
• Orders of your customers: when you sell through Hypamoon, your customers' names, email and delivery addresses, what they ordered, the status of their payment, and the invoices and confirmation emails we make in your name. You are the seller and the controller; the payment itself runs through your own payment account.
• Chat and the chat widget: your visitors' messages and your assistant's answers, the name, email address or phone number your visitor or your code provides, and the summary. To slow down misuse we count requests per IP address. If you switch on the bot check, a specialised party runs a short check in your visitor's browser.

The data processing agreement between you and us applies to this. You can get it at hello@hypamoon.com. For customers in the United States, the U.S. data processing addendum applies as well. If a caller or visitor asks us for access or deletion, we forward the request to you.

We do not use the calls and chats in your project to train AI models.

How long we keep data

A daily job carries out the periods below automatically, except those for invoices, the action log and the contact form.

What is not in the table, such as your account, your company details and the settings of your project, we keep for as long as you are a customer. There is no automatic period yet for after you leave: email us and we delete what we no longer need for the invoice or the law.

If you are the last user and delete your account, we immediately delete the content of your calls, voicemails, texts and contacts. We release your numbers after 7 days. Chats follow the period in the table. Invoices and the data behind them stay, because the law requires it. Something we deleted can remain in a backup for a while, until that backup expires.

Suppliers we use

We work with specialised suppliers, who only receive what they need for their part. These are suppliers for:

• telephony, numbers, texts and speech recognition, and the voice and language model of the assistant on the phone;
• the language model behind the chat and the summaries;
• hosting, database and storage;
• payments, tax calculation and accounting;
• sending email;
• bot checks for the chat widget, if you switch them on;
• checking site addresses and links against lists of unsafe sites.

We have a data processing agreement with each of these suppliers; usually it is part of the terms we agreed with them. Want the list with names and locations? Email us and we will send it.

Where your data is

We keep your data in the European Union. For some parts, such as telephony, the language model and the security of our website, we work with suppliers that also process in the United States. That only happens as far as needed to deliver the service, and under the safeguards the GDPR requires, such as the standard contractual clauses of the European Commission.

Security

All connections are encrypted. Each project only sees its own data; we decide that on the server, not from what a browser or app sends along. Secrets such as keys, codes and tokens are stored only as a hash. Recordings and documents can only be fetched with a temporary link, after we have checked that you are allowed to see them. When someone sets or changes a password for an app on Hypamoon, we check it against the list of passwords known from data breaches at Have I Been Pwned. Only the first 5 characters of a hash of the password go there: never the password itself, and no personal data such as a name or email address.

Your rights

Under the GDPR you have the right to access, correct, delete, restrict and port your data, and you can object to processing. You can change much of it yourself in the portal. For the rest, or for a question about this statement, email hello@hypamoon.com. We reply within a month. If you disagree with us, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

Are you a caller or website visitor of one of our customers? Then that customer is responsible and is the quickest place to go. If you email us, we forward your question.

U.S. residents

This part is for people who live in the United States. It adds to the rest of this statement, under the California Consumer Privacy Act as amended by the CPRA, and comparable privacy laws in other states.

• We do not sell or share your personal information. We do not sell it, and we do not share it for cross-context behavioral advertising, in the meaning those laws give these words. We have not done so in the past 12 months. We do not use it for targeted advertising or profiling either. Sensitive personal information, such as the copy of an identity document for a phone number, we only use to provide the service and keep it secure.
• What we collect and why. The categories of personal information, where they come from, why we use them and how long we keep them are described above in this statement. We disclose personal information only to the suppliers listed under Suppliers we use, who act as our service providers, and to authorities where the law requires it.
• Global Privacy Control. We honor the Global Privacy Control signal from your browser as a request to opt out of the sale and sharing of your personal information, for that browser and, if you are signed in, for your account. Because we do not sell or share, there is nothing for us to switch off, but you do not need to do anything more.
• Your rights. You have the right to know what personal information we have about you and to get a copy, to have it corrected, to have it deleted, and to opt out of its sale or sharing and of targeted advertising. Depending on your state you may have other rights too, such as limiting the use of sensitive personal information.
• How to make a request. Email hello@hypamoon.com, or, if you have an account, use the portal at app.hypamoon.com, where you can see and change your details and delete your account. We check that the request comes from you, usually by replying to the email address of your account. Someone else can make a request for you with your written permission; we may then ask you to confirm. We reply within 45 days; if we need more time, we tell you why, and we take at most 45 more days.
• Appeal. If we turn down your request, you can appeal by replying to our answer. We decide within 60 days and explain why. If you still disagree, you can contact the attorney general of your state.
• No discrimination. Using your rights never costs you anything: we will not refuse you the service, charge you a different price or give you a different quality because of it.
• Data in the projects of our customers. For the data our customers process through their sites, apps, numbers and chats, we are their service provider and processor, and the customer decides what happens with it. Send your request to that business; if you send it to us, we forward it. Our commitments to those customers are in the U.S. data processing addendum.

Changes

If anything changes in what we process or how long we keep it, we update this statement, its version number and the date at the top. If it matters for your project, we email you. Earlier versions stay available, such as the version of 15 October 2026, the version of 14 October 2026 and the version of 6 October 2026.