HeyGen — privacy & data policy

Provider: HeyGen. PromptPrivacy score: 67/100. Last verified October 18, 2026.

What happens to your data?

HeyGen processes your uploaded media, text, and account details to generate synthetic videos and manage your account. By default, inputs may also be used to improve and train HeyGen's AI avatar models unless you opt out. Your information is shared with infrastructure and service vendors under data protection terms, but it is not sold for monetary consideration.

Does it train on your data?

HeyGen uses customer inputs—including text, scripts, audio recordings, images, and video—to train and improve the AI models powering its products (such as its avatar generation models). Users can opt out of this AI model training by contacting HeyGen at their support email address.

Can you opt out?

Yes. Users can opt out of AI model training by sending an email request to [email protected]. Users can also opt out of promotional emails via unsubscribe links and manage tracking cookies through their web browser.

Data retention

HeyGen retains personal information for as long as needed to administer accounts, provide services, retain generated output, or meet legal requirements. When a user requests data deletion, HeyGen strives to complete the deletion within 72 hours. Backup archives kept for disaster recovery retain the deleted data for up to 60 days before permanent erasure.

Encryption & security

The policy notes that suitable physical, electronic, and managerial procedures are used to secure collected data, and that third-party credentials (such as Google API access tokens) are stored encrypted. However, the policy does not specify standard technical protocols like TLS in transit, AES at rest, or certifications like SOC 2 or ISO 27001.

Is it safe for work?

Standard consumer accounts carry privacy risks because user inputs and media are used for AI model training by default unless an opt-out email is submitted. However, HeyGen offers dedicated business and enterprise agreements with custom Data Processing Agreements (DPAs) that exclude customer data from this general policy, making enterprise tiers suitable for corporate use.

Source policy: https://www.heygen.com/privacy-policy