Privacy Policy

Quads Lab LLC ("we," "us," "the company") operates the Hey Quad platform ("the Service") — a multi-tenant business phone system. This policy describes the data we handle on behalf of organizations that subscribe to the Service and the individuals whose calls or messages flow through it.

We process the categories of data necessary to deliver telephony, messaging, and account services:

• Account data — name, email, role, organization membership.
• Communications metadata — phone numbers, call start/end times, durations, message timestamps, routing decisions.
• Communications content — call recordings (when enabled by the customer), SMS/MMS message bodies, voicemail audio.
• Billing data — usage counts, invoice line items. Payment instruments are held by Stripe; we do not store card numbers.
• Operational logs — request logs, error traces, security events, retained for incident response.

• To route calls and messages to their intended destinations.
• To bill our customers and reconcile usage with our carriers.
• To detect abuse, fraud, and policy violations (e.g., spam SMS campaigns).
• To comply with lawful regulatory and law-enforcement requests.

We do not sell personal information. We do not use customer communications content to train models.

We rely on a small set of subprocessors to operate the platform. The current list is published on our security page. Notable entries:

• Telnyx — carrier and number management
• Stripe — payment processing
• AWS — primary cloud hosting

Account and billing data is retained for the life of the subscription plus seven years for accounting purposes. Communications content (recordings, messages) is retained per the customer's plan: 30 days on Starter, 1 year on Growth, configurable on Reseller. Operational logs are retained for 90 days.

If you are an end user whose data is processed by Quads Lab LLC (via the Hey Quad Service) on behalf of one of our customers, please contact that customer directly to exercise access, deletion, or correction rights — they are the data controller for their account.

For all other inquiries, including DPA execution and EU/UK representative contact, email legal@heyquad.com.

We will post material changes to this policy on this page and email notice to administrators of every active organization at least 30 days before they take effect.