Privacy Policy

1. Introduction

Hylios, Inc. ("Hylios," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website hylios.com, use our services, or interact with us.

By accessing or using our services, you agree to this Privacy Policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when you:

• Create an account or register for our beta program (name, email, company, role)
• Request a demo or contact us (contact information)
• Subscribe to our newsletter (email address)
• Use our platform (supply chain data you choose to upload)
• Communicate with us (any information in your correspondence)

2.2 Information Collected Automatically

When you visit our website, we automatically collect:

• Device Information: Browser type, operating system, device type
• Log Data: IP address, access times, pages viewed, referring URL
• Usage Data: How you interact with our platform and features

2.3 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your browsing activities. You can control cookies through your browser settings and our cookie consent banner. We use:

• Essential Cookies: Necessary for the website to function
• Analytics Cookies: Help us understand how visitors use our site (Google Analytics, Microsoft Clarity)
• Marketing Cookies: Used to deliver relevant advertisements

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process your beta application or demo request
• Send you updates about our products and services
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities on our website
• Detect, investigate, and prevent fraudulent or unauthorized activities
• Personalize and improve your experience on our platform
• Comply with legal obligations

4. Information Sharing

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With third-party vendors who help us operate our business (e.g., hosting, analytics, email services)
• Legal Requirements: When required by law or to respond to legal process
• Protection of Rights: To protect our rights, privacy, safety, or property
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Consent: With your consent or at your direction

Specific third-party processors we use today include:

• Stripe for subscription billing and payment processing. Your card details are submitted directly to Stripe and never touch Hylios servers. Stripe is a PCI-DSS Level 1 service provider; their privacy policy is at stripe.com/privacy.
• Amazon Web Services (AWS) for hosting, database storage, and transactional email delivery (via Amazon SES).
• HubSpot as the bridge between our LinkedIn outreach tooling and our internal sales CRM. If you accept a LinkedIn connection from us, an event flows Waalaxy → HubSpot → Hylios CRM so we can follow up with relevant content. See section 4a below.
• OpenAI, AWS Bedrock, and Google Vertex AI as LLM providers used to generate the company briefs and newsletter content displayed at hylios.com/intelligence. We do not include personal information in prompts.

4a. LinkedIn Outreach & Lead Records

If you appear in a curated outreach list (for example, you are a director or above at a company we serve), we may create a Lead record in our internal CRM containing your publicly available LinkedIn profile information (name, title, employer, headline, profile URL). This record is used to personalize outbound messages and to track our own outreach state. It is never sold, never used for advertising targeting, and is deleted on request.

When you submit your email address on a public company brief page (hylios.com/intelligence/{company}), we associate that email with the Lead record so we can send the requested daily digest and tier-relevant content. We use single-use, time-limited magic links to authenticate you into the portal. Once authenticated you can set a password to skip the email round-trip on future logins.

You can request deletion of your Lead record and any associated brief subscription at any time by emailing privacy@hylios.com. Deletion is completed within 30 days and we will confirm in writing.

5. Your Rights and Choices

5.1 GDPR Rights (European Users)

If you are in the European Economic Area, you have the right to:

• Access your personal data
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to processing of your personal data
• Request restriction of processing
• Data portability
• Withdraw consent at any time

5.2 CCPA Rights (California Users)

If you are a California resident, you have the right to:

• Know what personal information is collected about you
• Know whether your personal information is sold or disclosed
• Say no to the sale of personal information
• Access your personal information
• Request deletion of your personal information
• Not be discriminated against for exercising your privacy rights

5.3 Cookie Preferences

You can manage your cookie preferences at any time by clicking "Cookie Settings" in the footer of our website.

5.4 Marketing Communications

You can opt out of marketing emails by clicking the "unsubscribe" link in any marketing email we send.

6. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. When we no longer need your information, we will securely delete or anonymize it.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, and regular security assessments. However, no method of transmission over the Internet is 100% secure.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws than your country. When we transfer data internationally, we implement appropriate safeguards to protect your information.

9. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

11. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at: