Privacy Policy
Last updated: June 30, 2026
This Privacy Policy describes how HeyVA ("HeyVA," "we," "us," or "our"), operated by Individual Entrepreneur Denis Valentin Apostu and Individual Entrepreneur Stanga Alexandra, collects, uses, discloses, and protects your personal information when you access or use our website at heyva.ph, our platform, and any related services (collectively, the "Services").
By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our Services.
1. Who We Are
HeyVA is a platform that connects employers with verified Filipino virtual assistants, powered by AI-assisted hiring technology. We are operated by:
- Individual Entrepreneur Denis Valentin Apostu
- Individual Entrepreneur Stanga Alexandra
Registered Address: University Street n17a, Floor 10, Vake, Tbilisi, 0179, Georgia
Contact: contact@heyva.ph
For privacy-related inquiries, the role of Data Protection Contact is handled by the founders, reachable at contact@heyva.ph.
2. Information We Collect
2.1 Information You Provide Directly
When you create an account, use our Services, or communicate with us, we may collect:
- Account Information: Full name, email address, phone number, company name, company details, location, and social media links.
- Profile Information (Virtual Assistants): Professional experience, skills, resume/CV, video introductions, portfolio samples, and work history.
- Job Posting Information (Employers): Job descriptions, role requirements, screening criteria, company information, and hiring preferences.
- Communications: Messages, feedback, support requests, and correspondence you send to us.
2.2 Information Collected Through Third Parties
- Identity Verification: For virtual assistants, we use a third-party identity verification provider, Didit (didit.me), to conduct government ID verification. HeyVA does not store, access, or retain copies of government-issued identity documents. All identity verification data is processed and stored exclusively by Didit in accordance with their own privacy policy.
- Payment Information: We use FanBasis as our third-party payment processor. HeyVA does not directly collect, store, or process credit card numbers or bank account details. All payment data is handled by FanBasis in accordance with their privacy policy and PCI-DSS standards.
- Calendar Data: If you choose to connect your Google Calendar, we access calendar availability data solely to facilitate interview scheduling. We do not access, read, or store the content of your calendar events.
2.3 Information Collected Automatically
When you visit our website or use our Services, we automatically collect certain information, including:
- Device and Browser Information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
- Usage Data: Pages viewed, links clicked, time spent on pages, referring URLs, and navigation patterns.
- Cookies and Tracking Technologies: We use cookies, pixel tags, and similar technologies to collect information about your browsing activity. See Section 9 (Cookies and Tracking Technologies) for more detail.
3. How We Use Your Information
We use the information we collect for the following purposes:
- Providing and Operating the Services: To create and manage your account, facilitate job postings, match employers with virtual assistants, process applications, and enable communication between users.
- AI-Assisted Hiring (Alexandra): To power our AI hiring agent, Alexandra, which screens applicants, scores candidates, generates follow-up questions, and provides hiring recommendations. See Section 7 (Artificial Intelligence and Automated Decision-Making) for details.
- Identity Verification: To verify the identity and qualifications of virtual assistants through our third-party provider, Didit.
- Payment Processing: To facilitate subscription billing and payment processing through FanBasis.
- Communication: To send you service-related notifications, respond to your inquiries, and provide customer support.
- Marketing and Advertising: To send promotional communications (with your consent where required), serve targeted advertisements through Meta (Facebook/Instagram) and Google Ads, and measure the effectiveness of our marketing campaigns.
- Analytics and Improvement: To analyze usage patterns, improve our Services, develop new features, and optimize user experience.
- Legal Compliance and Safety: To comply with applicable laws and regulations, enforce our terms of service, protect against fraud and abuse, and ensure the safety and security of our platform.
4. Legal Bases for Processing (EEA/UK Users)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data based on the following legal grounds under the General Data Protection Regulation (GDPR):
| Purpose | Legal Basis |
|---|---|
| Providing the Services and managing your account | Performance of a contract (Art. 6(1)(b)) |
| AI-assisted candidate screening and scoring | Legitimate interest in providing efficient hiring tools (Art. 6(1)(f)), with human oversight |
| Identity verification of virtual assistants | Legitimate interest in platform safety and trust (Art. 6(1)(f)) |
| Payment processing | Performance of a contract (Art. 6(1)(b)) |
| Service-related communications | Performance of a contract (Art. 6(1)(b)) |
| Marketing emails and promotional communications | Consent (Art. 6(1)(a)) |
| Analytics cookies and tracking pixels (Google Analytics, Meta Pixel) | Consent (Art. 6(1)(a)) |
| Essential/functional cookies | Legitimate interest (Art. 6(1)(f)) |
| Fraud prevention and platform security | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
5. How We Share Your Information
We do not sell your personal information. We may share your information in the following circumstances:
5.1 With Other Users
- Employer profile information is visible to virtual assistants who apply to their job postings.
- Virtual assistant profile information (name, skills, experience, video introduction, portfolio) is visible to employers who post relevant jobs.
5.2 With Service Providers
We share information with third-party service providers who process data on our behalf:
| Provider | Purpose | Data Shared |
|---|---|---|
| Anthropic | AI processing (Alexandra hiring agent) | Job details, company details provided by employers, VA profile information (name, skills, experience, resume content, video intro content). No government IDs or payment data are shared with Anthropic. |
| Didit | Identity verification for VAs | Government ID data (processed and stored exclusively by Didit) |
| FanBasis | Payment processing | Billing and payment information |
| Google (Analytics, Ads, Tag Manager) | Website analytics and advertising | Device data, usage data, conversion events, IP address (anonymized where required) |
| Meta (Facebook Pixel) | Advertising measurement and optimization | Device data, usage data, conversion events, hashed identifiers |
| GoHighLevel | Email marketing and communications | Name, email address, marketing preferences |
| Google Calendar API | Interview scheduling | Calendar availability data |
| Supabase | Data storage and infrastructure | Account data, platform data, AI conversation logs |
5.3 For Legal Reasons
We may disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
5.4 Business Transfers
In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.
6. Data Retention
We retain your personal information for as long as necessary to provide our Services and fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 12 months after deletion request |
| AI conversation logs and hiring interaction data | 90–120 days, stored in Supabase |
| Identity verification records | Managed by Didit per their retention policy |
| Payment records | As required by applicable tax and accounting laws |
| Marketing communication records | Until consent is withdrawn |
| Analytics data | Up to 26 months (Google Analytics default) |
| Cookie data | See Section 9 |
When your data is no longer needed, we will securely delete or anonymize it.
7. Artificial Intelligence and Automated Decision-Making
7.1 How We Use AI
HeyVA uses an AI hiring agent called Alexandra to assist employers in the hiring process. Alexandra is powered by Anthropic's large language models and performs the following functions:
- Application Screening: Reads and analyzes VA applications, including resume content and video introduction summaries.
- Candidate Scoring: Scores candidates against employer-defined criteria and role requirements.
- Follow-Up Questions: Generates and sends follow-up questions to candidates to clarify experience gaps or availability.
- Candidate Ranking and Shortlisting: Ranks applicants and presents a shortlist of top candidates to employers.
- Interview Scheduling: Facilitates automatic interview booking with shortlisted candidates.
7.2 What Data Is Processed by AI
The following data is sent to Anthropic for AI processing:
- Job posting details and role requirements (provided by employers)
- Company details (provided by employers)
- VA profile information: name, skills, professional experience, resume content, and video introduction content
The following data is never sent to Anthropic:
- Government-issued identity documents
- Payment or financial information
- Passwords or authentication credentials
7.3 Human Oversight
While Alexandra generates candidate scores, rankings, and hiring recommendations using AI, all AI-generated outputs are subject to human review and verification. No candidate is automatically rejected or hired solely based on an AI decision without the opportunity for human review. Employers retain full control over final hiring decisions.
7.4 Your Rights Regarding AI Decisions
Under the GDPR (Article 22), you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Because our AI-assisted process includes human oversight and the final hiring decision rests with the employer, it does not constitute solely automated decision-making under Article 22. However, if you believe an AI-generated assessment about you is inaccurate, you may:
- Request an explanation of how your profile was assessed
- Contest the outcome and request human review
- Contact us at contact@heyva.ph to exercise these rights
8. International Data Transfers
HeyVA is operated from Georgia. Your data may be transferred to and processed in countries outside your country of residence, including:
- United States (Anthropic, Google, Meta, Supabase)
- Other countries where our service providers operate
For transfers of personal data from the EEA/UK, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
- Your explicit consent where no other safeguard applies
You may request a copy of the relevant transfer safeguards by contacting us at contact@heyva.ph.
9. Cookies and Tracking Technologies
9.1 What Are Cookies
Cookies are small text files stored on your device when you visit a website. They help us recognize your device, remember your preferences, and understand how you use our Services.
9.2 Types of Cookies We Use
| Cookie Type | Purpose | Requires Consent |
|---|---|---|
| Strictly Necessary | Essential for the website to function (authentication, security, load balancing) | No |
| Analytics (Google Analytics) | Measure website traffic, page views, user behavior, and performance | Yes |
| Advertising (Meta Pixel) | Track conversions from Facebook/Instagram ads, build advertising audiences, and measure ad effectiveness | Yes |
| Advertising (Google Ads/GTM) | Track conversions from Google Ads, remarketing, and ad optimization | Yes |
9.3 Consent
We will implement a cookie consent mechanism on our website. Non-essential cookies (analytics and advertising) will only be activated after you provide your consent. You can withdraw your consent or change your cookie preferences at any time through the cookie settings on our website.
9.4 Managing Cookies
You can also manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our Services. For more information on managing cookies, visit:
9.5 Meta (Facebook) Pixel Disclosure
We use the Meta Pixel and Conversions API to:
- Measure the effectiveness of our advertising campaigns on Facebook and Instagram
- Create custom audiences for targeted advertising
- Optimize ad delivery to people most likely to take action
The Meta Pixel may collect data such as: HTTP headers, pixel-specific data (Pixel ID, Facebook cookie), button click data, form field names, and page metadata. This data is sent to Meta and processed in accordance with Meta's Data Policy.
9.6 Google Analytics Disclosure
We use Google Analytics 4 to understand how visitors interact with our website. Google Analytics collects data such as pages visited, session duration, traffic sources, device information, and approximate location (based on IP address). IP anonymization is enabled. This data is processed by Google in accordance with Google's Privacy Policy.
10. Your Privacy Rights
10.1 Rights for All Users
Regardless of your location, you may:
- Access your personal information by logging into your account or contacting us
- Update or correct your personal information through your account settings
- Delete your account and associated data by contacting us at contact@heyva.ph
- Opt out of marketing emails by using the unsubscribe link in any marketing email
10.2 Additional Rights for EEA/UK Residents (GDPR)
If you are located in the EEA or UK, you have the following additional rights under the GDPR:
- Right of Access (Art. 15): Request a copy of the personal data we hold about you.
- Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
- Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
- Right to Restriction of Processing (Art. 18): Request that we limit how we use your data in certain circumstances.
- Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
- Right to Object (Art. 21): Object to processing based on legitimate interests, including profiling and direct marketing.
- Right to Withdraw Consent: Where processing is based on consent, withdraw your consent at any time without affecting the lawfulness of prior processing.
- Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority.
To exercise any of these rights, contact us at contact@heyva.ph. We will respond within 30 days.
10.3 Additional Rights for California Residents (CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
- Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we share your information.
- Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Opt Out of Sale/Sharing: We do not sell your personal information. We may share personal information with advertising partners (Meta, Google) for targeted advertising purposes, which may constitute "sharing" under the CPRA. You may opt out of this sharing by adjusting your cookie preferences or contacting us.
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
Categories of Personal Information Collected (past 12 months):
| CCPA Category | Examples | Collected |
|---|---|---|
| Identifiers | Name, email, phone, IP address | Yes |
| Customer records | Company name, billing information | Yes |
| Internet/electronic activity | Browsing history, interactions with the website | Yes |
| Geolocation data | Approximate location based on IP | Yes |
| Professional/employment info | Resume, skills, work history (VAs) | Yes |
| Audio/visual information | Video introductions (VAs) | Yes |
| Inferences | AI-generated candidate scores and assessments | Yes |
To submit a request, contact us at contact@heyva.ph. We will verify your identity before processing your request and respond within 45 days.
11. Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit (TLS/SSL)
- Encryption of data at rest
- Access controls and authentication mechanisms
- Regular security assessments
- Third-party service provider security requirements
While we take reasonable steps to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
12. Children's Privacy
Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a child, please contact us at contact@heyva.ph.
13. Third-Party Links
Our Services may contain links to third-party websites, services, or applications that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party service you access through our platform.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last updated" date at the top of this policy
- Notify you by email or through a prominent notice on our website
- Where required by law, obtain your consent to material changes
We encourage you to review this Privacy Policy periodically.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
HeyVA Individual Entrepreneur Denis Valentin Apostu & Individual Entrepreneur Stanga Alexandra University Street n17a, Floor 10, Vake, Tbilisi, 0179, Georgia
Email: contact@heyva.ph
For GDPR-related inquiries, you may also contact your local data protection supervisory authority.
16. Additional Disclosures
16.1 Google API Services
If you connect your Google Calendar to HeyVA, our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only access Google Calendar availability data for the purpose of scheduling interviews and do not use this data for any other purpose, including advertising or profiling. We do not sell, share, or use Google user data for advertising, profiling, or any purpose other than scheduling interviews as described above. Google user data is not shared with any third party except as necessary to provide the scheduling feature.
16.2 Meta Platform Terms
Our use of Meta technologies (Facebook Pixel, Conversions API) complies with the Meta Business Tools Terms and Meta Platform Terms. We provide clear notice to users about our use of these technologies and obtain consent where required by law before activating Meta tracking tools.
16.3 Do Not Track
Some browsers transmit "Do Not Track" (DNT) signals. We currently do not respond to DNT signals, as there is no industry-standard protocol for compliance. However, you can manage tracking through your cookie preferences on our website.