Hyzl Privacy Policy

Effective date: September 10, 2026

This policy explains what Atllas, Inc., a Delaware corporation ("Hyzl", "we", "us") does with personal information in connection with Hyzl, our paywall recovery service for iOS and web subscription apps.

Two different groups of people show up in this policy, and the rules differ for each:

• Merchants — the businesses that sign up for Hyzl and connect their apps. If that is you, we collect your information directly and we decide how to use it.
• End users — the customers of those businesses. If you got a text message from an app's AI rep "powered by Hyzl", you are an end user. You are not our customer. The app you used gave us your phone number, and we send messages on that app's behalf. The app decides who gets contacted; we run the machinery. That distinction matters for your rights, and section 10 tells you exactly what to do.

1. If you received a text from us

Start here.

To stop the messages, reply STOP. It works immediately, it is permanent, and it applies to every message from that number. You do not need an account, an email, or a reason. You will get one confirmation and then nothing.

To reach a human, reply asking for one. The app's team can see the conversation and take over.

The replies you receive are written by an AI, and if you call the number, an AI answers. It will tell you so if you ask. It is not a person.

To have your data deleted, email support@hyzl.app from anywhere with the phone number in question. We will handle it and pass the request to the app that sent it. See sections 10, 11, and 12.

We keep one thing after a deletion: a one-way hash of your phone number on a do-not-contact list. That is the only way to guarantee you are never texted again if the app re-uploads your number. It cannot be reversed into your number and it is used for nothing else.

2. Information we collect from merchants

When you sign up and run Hyzl, we collect:

• Account information — name, work email, company name, and credentials handled by our authentication provider.
• Business information for messaging registration — legal entity name, address, tax ID, website, and sample message content. Carriers require this before a number can send.
• Billing information — billing contact, address, and a payment method token. Card numbers go to Stripe; we never see or store them.
• Configuration — message templates, AI instructions, sequence timing, spending cap, and team members.
• Usage data — logins, dashboard activity, API calls, IP address, browser and device information, error logs.
• Support communications — what you write to us and what we write back.

3. Information we receive about end users

We do not collect this from end users. We receive it from the merchant, in the paywall event the merchant's app or server sends us:

• Phone number
• A stable user identifier the merchant assigns
• Email address and first name, when the merchant chooses to send them
• A consent flag stating the merchant obtained consent to text this person
• Context about the paywall event — which app, which plan, when the user left

Then, as the service runs, we create and store:

• Message content — every text sent and received in the conversation, including messages a merchant's human agent writes.
• Call metadata and recordings — when a user calls the number, we log the number, time, and duration, and we process the audio and a transcript so the AI can answer. [Confirm recording practice and one-party/two-party consent handling with counsel before launch.]
• Billing status — whether the user has an active subscription, read from the merchant's billing provider, so we know when to stop.
• Delivery data — whether a message was delivered, failed, or was filtered by a carrier, and whether the user opted out.

We do not need or want sensitive data. Do not send us health information, government identifiers, precise location, or payment card numbers. If a merchant sends it anyway, that is a violation of our Terms.

4. Information from connected billing providers

When you connect RevenueCat or Stripe, you grant Hyzl read-only OAuth access. We read customers, subscriptions, transaction records, and revenue metrics.

We use that data for exactly two things: confirming whether a specific user has paid, and showing you what recovery produced. We never charge, refund, cancel, or change anything in your billing account. You can revoke the connection at any time.

5. How we use information

We use merchant information to provide and bill for the service, to authenticate you, to support you, to send transactional email about your account, to detect abuse and fraud, to improve the product, and to meet our legal obligations.

We use end user information only to deliver the service the merchant asked for: to send the recovery messages, to generate AI replies and answer calls, to check payment status so sequences stop, to honor opt-outs, to show the merchant their conversations, and to count billable people. We also use it for security, abuse prevention, and legal compliance.

Our AI processing. Message content and call audio go to xAI so its models can generate replies and speech. We send the minimum context needed for the conversation. Under our agreement with xAI, data we send through the API is not used to train its general-purpose models.

We do not use end user personal information to train our own models, to build profiles for anyone other than the merchant who sent the data, or for any purpose unrelated to that merchant's recovery sequence.

6. We do not sell personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding 12 months. We do not sell or rent end users' phone numbers to anyone, ever.

7. Who we share information with

Merchants. A merchant sees the full conversation for their own end users, and only theirs. Merchants never see another merchant's data.

Service providers (subprocessors). We use these companies to run Hyzl. Each is contractually limited to processing data on our instructions:

We will keep this list current. Merchants can ask for advance notice of new subprocessors as part of a signed DPA.

Legal and safety. We may disclose information to comply with law, a subpoena, or a court order, to enforce our Terms, or to protect the rights and safety of any person. Where we can lawfully do so, we will tell the affected merchant first.

Business transfers. If Hyzl is acquired or merged, information may transfer with the business. It stays subject to this policy, or you get notice of a new one.

8. How long we keep it

End user data: 12 months by default, measured from the last message in the conversation. After that we delete it or de-identify it.

We delete it sooner when a merchant asks us to, or when an end user asks us directly.

Two exceptions:

• Hashed phone numbers on the do-not-contact list are kept indefinitely, so an opt-out cannot be undone.
• Aggregate, de-identified statistics (message counts, recovery rates) are kept for reporting. They cannot be tied back to a person.

Merchant account data is kept while the account is active and for up to 12 months after closure, except billing and tax records, which we keep as long as the law requires.

When a merchant terminates, we delete or de-identify their end user data within 90 days.

9. Security

In plain language, here is what we do:

• Data is encrypted in transit (TLS) and encrypted at rest by our infrastructure providers.
• Access to production data is limited to the people who need it, protected by single sign-on and multi-factor authentication, and logged.
• Each merchant's data is isolated at the database level, so one merchant's queries cannot reach another's records.
• API keys and OAuth tokens are stored encrypted. Billing provider access is scoped read-only.
• We keep audit logs of administrative access and of every message sent.
• We review dependencies and patch known vulnerabilities.
• We will notify affected merchants without undue delay if a breach affects their data, and we will help them meet their own notification obligations.

No system is perfectly secure. We do not promise that ours is.

10. Choices and rights for end users

If you received a message from Hyzl on behalf of an app:

• Stop the messages. Reply STOP. Immediate, permanent, no account needed.
• Get help. Reply HELP for the app's identity and opt-out instructions.
• Ask for a human. Reply asking for one; the merchant can take over the conversation.
• Access or delete your data. Email support@hyzl.app with the phone number involved. We will act on your request and forward it to the merchant who sent your number to us. Because the merchant decides what happens to the underlying relationship, you may also want to contact the app directly.

We will not charge you, require an account, or make you explain yourself to exercise any of these.

11. California privacy rights

If you are a California resident, the CCPA as amended by the CPRA gives you rights over your personal information.

Categories we handle. For end users: identifiers (phone number, email, user ID), commercial information (subscription and payment status), electronic communications content (messages and calls), and internet or network activity. For merchants: identifiers, commercial information, professional information, and internet activity. We do not collect the categories the statute treats as sensitive personal information for end users.

Your rights. You can request to know what we collect and why; to access a copy; to delete; to correct inaccuracies; and to opt out of sale or sharing — though as section 6 says, we do neither. We will not discriminate against you for exercising any of these.

How to exercise them. Email support@hyzl.app. We verify by confirming control of the phone number or email in question. An authorized agent may act for you with written permission. We respond within 45 days and may extend once, with notice.

Where end users should direct requests. For end user personal information, the merchant is the "business" and Hyzl is a "service provider". You can send your request to either of us. If you send it to us, we will act on it for the data we hold and pass it to the merchant.

12. EU and UK privacy rights

If you are in the European Economic Area, the United Kingdom, or Switzerland:

Roles. For merchant account data, we are the controller. For end user data, the merchant is the controller and Hyzl is a processor acting on their instructions.

Legal bases. We rely on: contract performance, for providing the service to merchants; legitimate interests, for security, fraud prevention, and product improvement, balanced against the rights of the people involved; legal obligation, where a law requires us to act; and consent, where it is required — which, for marketing text messages to end users, it generally is. That consent is collected by the merchant, not by us. Merchants must have a valid legal basis before sending us a phone number.

Your rights. Access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and the right to withdraw consent at any time. Withdrawing consent does not affect processing that already happened.

How to exercise them. End users should contact the app that texted them; they hold the relationship and make the decisions. You can also write to us at support@hyzl.app and we will act on what we hold and route the rest. You have the right to complain to your local supervisory authority.

International transfers. Hyzl operates from the United States, and our subprocessors process data in the United States and elsewhere. Where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, plus additional safeguards where needed.

DPA. A data processing addendum, including the SCCs, is available to merchants on request at support@hyzl.app.

13. Children

Hyzl is not designed for or directed at children. Merchants must not use Hyzl to message anyone they know or reasonably should know is under 18, and must not send us data about such a person. We do not knowingly collect information from anyone under 18. If we learn that we have, we delete it and notify the merchant. If you believe we hold a minor's information, write to support@hyzl.app.

14. AI and automated processing

The replies Hyzl sends and the calls it answers are generated by an AI model. Messages identify themselves as coming from the app's AI representative, powered by Hyzl, and the AI will confirm it is not a person if asked.

The AI does not make decisions that produce legal effects or similarly significant effects about you. It does not set prices, approve or deny anything, or determine eligibility. It answers questions about the app and offers to help you subscribe. A human at the merchant can step in at any time, and you can ask for one.

15. Cookies

Our marketing site and dashboard use cookies and similar technologies that are strictly necessary for authentication and security, plus basic first-party analytics to understand how the dashboard is used. We do not use advertising or cross-site tracking cookies. You can block cookies in your browser, but the dashboard will not work without the necessary ones.

16. Changes to this policy

We can update this policy. We will change the effective date at the top, and for material changes we will email merchants at their account address and post a notice in the dashboard at least 30 days before the change takes effect. Past versions are available on request.

17. Contact us

Atllas, Inc. 9800 Wilshire Blvd, Beverly Hills, CA 90212 support@hyzl.app

Privacy questions, access requests, and deletion requests all go to support@hyzl.app. If you are an end user, include the phone number the messages went to so we can find your records.