Privacy Policy

Effective date: 1 October 2026 · Last updated: 14 October 2026

This Privacy Policy explains how Horizon Lab, the company that operates HypeDuo ("HypeDuo", "we", "us" or "our"), collects, uses, shares and protects information when you visit www.hypeduo.app, use the HypeDuo web app at www.hypeduo.app/dashboard, use the HypeDuo app inside Shopify admin, or connect third-party platforms such as Google, Shopify, Meta (Facebook, Instagram, Threads and WhatsApp), X (Twitter), LinkedIn, TikTok, Snapchat, YouTube, Google Business Profile, Pinterest, Telegram, Bluesky, Mastodon or Tumblr to HypeDuo (together, the "Service").

HypeDuo uses YouTube API Services to upload videos to, and read results and comments from, YouTube channels you connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your information is described in the Google Privacy Policy. See YouTube API Services below.

HypeDuo is an AI marketing assistant for businesses. It helps a business decide which products to promote, drafts branded social media posts with AI, lets the business's team review and approve them, publishes approved posts to the social accounts the business has connected, and reports how those posts perform.

The short version

We collect only what we need to run the Service: your login details, your business's catalog and brand information, the content you create, and the social accounts you choose to connect.
We publish to a connected account only content that a member of your workspace has created or approved, or scheduled, in HypeDuo.
We do not sell personal information, do not use it for advertising, and do not use data from connected platforms to train AI models.
Access tokens for connected accounts are encrypted, and you can disconnect any platform or delete your data at any time.

1. Information we collect

Account information

Sign in with Google: your name, email address, whether your email is verified, and profile picture, plus Google sign-in tokens (stored encrypted) needed to keep you signed in. We request only basic profile and email access; we do not access your Gmail, Google Drive, contacts or other Google data.
Shopify staff sign-in: when you open HypeDuo inside Shopify admin, Shopify tells us your store, your staff account identifier, name and email address so we can link you to the right workspace.
Login sessions: a session identifier, the time it was created and expires, and the IP address and browser (user agent) used, to keep your account secure.

Workspace and team information

Your workspace (business) name and settings, the members you invite, their roles (for example owner, approver or editor) and when they were last active.
An activity (audit) log of important actions, such as who created, edited, approved, scheduled, published or deleted a post, and who connected or disconnected an account.
Usage records, such as how many AI generations and posts your workspace has used, to apply plan limits and billing.

Store and catalog information

From Shopify (with your permission when you install the app): products, variants, prices, inventory levels, product images and descriptions; your store's name, description and brand settings (logo, colours, slogan); theme settings; and online store pages such as your About page. We use the permissions read_products, read_inventory, unauthenticated_read_product_listings, read_themes and read_online_store_pages.
We do not collect your Shopify customers' or orders' personal information. If a future feature needs order or customer data, we will update this policy and ask for that permission first.
Other sources you give us: product feed URLs (for example a Google Shopping or Meta catalog feed), catalog items you add by hand, and websites you ask us to read to fill in your brand kit. For brand details we may also look up your brand's public information on Wikidata/Wikipedia or a brand-logo service, using only your business name or website domain.

Content you create

Prompts and instructions you give the AI, AI-generated drafts, captions, hashtags, images and other media, your edits, comments, approvals, schedules and the history of each post's versions.
Your brand kit: tone of voice, preferred and banned words, hashtags, audience description, colours and logo.

Connected social media accounts

When you connect a social media account, we receive the information described in Section 3.

Your customers' WhatsApp details

If you connect a WhatsApp Business number, HypeDuo keeps the details of the people who message it or join your broadcasts — on your behalf, as described in WhatsApp below.

Billing information

For Shopify merchants, subscriptions are billed through Shopify; we receive the plan and subscription status, never your card details. If we offer direct billing on the web, payments will be handled by a payment processor and we will not store full card numbers.

Information from visiting our website

Like most websites, our hosting provider automatically processes technical information such as your IP address, browser type, pages requested and the date and time of the request, to deliver the site and protect it from abuse. Our website does not use advertising or third-party analytics trackers.

Communications

If you email us or contact support, we keep your message and contact details to respond and to improve the Service.

2. How we use information

We use information to:

Provide the Service: sign you in, run your workspace, sync your catalog, suggest what to promote, generate drafts, route posts for approval, publish approved posts and show results.
Keep AI output grounded: check that drafts only state facts supported by your product and brand data (for example, the current price and stock) before they are published.
Keep the Service safe and reliable: authenticate requests, prevent fraud and abuse, debug errors and keep records of important actions.
Apply plan limits, manage subscriptions and trials, and meet accounting obligations.
Communicate with you about your account, security, changes to the Service and support requests.
Comply with law and enforce our terms.

We do not sell or rent personal information, use it to show you advertising, build advertising profiles, or share it with data brokers.

Legal bases (for users in the EEA, UK and similar regions): we process information to perform our contract with you, for our legitimate interests in running and securing the Service, to comply with legal obligations, and with your consent where required (for example, when you connect a social media account). You can withdraw consent at any time by disconnecting the account.

3. Data from connected platforms

Connecting a platform is always your choice. You sign in on the platform's own page and approve the permissions; we never see your password for that platform. We use platform data only to provide the features you use in HypeDuo, in line with each platform's developer terms and policies.

Platform	What we receive	What we use it for
Meta — Facebook Pages	Your Facebook user ID (the person who granted access), the list of Pages you manage and chose to share, each Page's ID, name, category, profile picture and follower count, and a Page access token (stored encrypted). For posts published through HypeDuo: the post ID and link, engagement counts such as reactions (by type), comments, shares and clicks, aggregated statistics Facebook provides such as how many people saw the post and how many times it was shown (no information about who they are), and the comments people leave on those posts (comment text, the commenter's display name, time and like count). For the Page itself: aggregated daily statistics such as views, viewers, post engagements, actions and follows/unfollows (no information about who they are). Permissions: pages_show_list, pages_read_engagement, pages_read_user_content, read_insights, pages_manage_posts, pages_manage_engagement, business_management. We use read_insights only for the statistics of posts HypeDuo published and your Page's aggregated statistics. We use pages_manage_engagement only to post the optional first comment your team writes for a post, under that post, as your Page. We use business_management only so Pages your business portfolio owns can be chosen when you connect — we don't read or change anything else in your business portfolio. We use pages_read_user_content only for comments on posts HypeDuo published — never your Page's other posts, messages or reviews.	Letting you pick which Page to post to, publishing posts your team approved (text, photo, multi-photo, video and Reels posts) and their optional first comment, confirming that a post went out, avoiding duplicate posts, and showing post results. We read engagement for posts HypeDuo published, not your other Page content, and show your Page's aggregated statistics in Analytics. Comments are shown to your team with an AI label (positive, negative, question) and a summary of what people like, dislike and ask, so you can follow up. Comments deleted on Facebook are deleted from HypeDuo the next time we check.
Meta — Instagram	Your Instagram professional account ID, username, profile picture and follower count, and an access token (stored encrypted) — either the token of the Facebook Page the account is linked to, or, if you connect with “Continue with Instagram”, an Instagram access token. For media HypeDuo published: its ID and link, like, comment, share and save counts, aggregated insights such as accounts reached and views (no information about who they are), and the comments people leave (comment text, the commenter's username, time and like count). For the account itself: aggregated statistics such as daily reach, new followers, profile views, accounts engaged, website clicks and follower demographics (age, gender, country — no information about who they are). Permissions through Facebook Login: instagram_basic, instagram_content_publish, instagram_manage_comments, instagram_manage_insights. Through Instagram Login: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments, instagram_business_manage_insights.	Publishing approved posts to your Instagram account (photos are converted to the JPEG size and shape Instagram requires and stored with your other media), posting the optional first comment your team writes under a post, showing their results and your account's aggregated statistics in Analytics, and showing and sorting comments as described for Facebook. We only read media and comments for posts HypeDuo published.
X (Twitter)	Your X user ID, username, display name, profile image and whether the account has X Premium (which allows longer posts), and an access token and refresh token (stored encrypted). For posts HypeDuo published: the post ID and link, and the counts X reports (views, likes, reposts, quotes, replies and engagements). We do not read the replies themselves. Permissions: tweet.read, tweet.write, users.read, media.write, offline.access.	Publishing approved posts (text, photos or a video) to your X account, making sure a post is never published twice, and showing each post's results.
LinkedIn	Your LinkedIn member ID, name and profile picture; if you connect Company Pages, the Pages you administer and choose to connect; and an access token (stored encrypted). For posts HypeDuo published: the post ID and link; for Company Page posts, the statistics LinkedIn reports (impressions, unique viewers, clicks, reactions, comments) and the comments people leave (comment text, the commenter's name and time). LinkedIn shares no statistics or comments for personal posts. Permissions: openid, profile, w_member_social; for Company Pages also r_organization_social, w_organization_social, rw_organization_admin.	Publishing approved posts to your LinkedIn profile or Company Page, showing their results, and showing and sorting Page comments as described for Facebook, and posting a reply only when someone in your workspace writes it in HypeDuo.
YouTube (YouTube API Services)	Your YouTube channel ID, title, handle, profile picture, subscriber count and whether the channel may upload videos longer than 15 minutes, plus a Google access token and refresh token for the channel (stored encrypted). For videos HypeDuo uploaded: the video ID and link, the upload status YouTube reports, view, like and comment counts, and the comments people leave on those videos (comment text, the commenter's display name, time and like count). With YouTube Analytics: the channel's daily views, watch time, likes, comments, shares and subscribers gained and lost, and viewer age, gender and country as YouTube reports them. Permissions: youtube.upload (upload videos), youtube.force-ssl (read comments on videos HypeDuo uploaded and post the replies your team writes) and yt-analytics.readonly (read the channel's YouTube Analytics). We do not use these permissions to edit, delete or download your videos, read your other videos, playlists, subscriptions or watch history, or access your Google account's other data.	Letting you confirm which channel to post to; uploading videos your team approved as a Short or a regular video, with the title, description, visibility, audience ("made for kids") and disclosures (paid promotion, altered or synthetic content) you chose; confirming the upload finished and making sure a video is never uploaded twice; showing each video's and the channel's numbers exactly as YouTube reports them (they are never added to other platforms' numbers or used to calculate rates or scores); listing comments, and posting a reply only when someone in your workspace writes it in HypeDuo. YouTube comments are not sent to AI or sorted. Comments deleted on YouTube are deleted from HypeDuo the next time we check.
Pinterest	Your Pinterest account ID, username, business name, profile picture, follower count and whether it is a business account; the names, IDs and privacy setting of your boards; and a Pinterest access token and refresh token (stored encrypted). For Pins HypeDuo created: the Pin ID and link, and the Pin's impressions, saves, Pin clicks, outbound clicks, reactions and comment counts that Pinterest reports. Permissions: user_accounts:read (see your profile), boards:read and boards:write (list your boards and save Pins to the board you choose), pins:read and pins:write (create Pins your team approved and read their results). We do not use these permissions to edit or delete your boards or other Pins, save or read other people's Pins, follow accounts, or access your Pinterest messages.	Letting you confirm which account to post to and choose a board for each post; creating the photo, carousel or video Pins your team approved, with the title, description, link, alt text and AI disclosure you chose; making sure a Pin is never created twice; and showing each Pin's results.
Bluesky	Your Bluesky account identifier (DID), handle, display name, profile picture and follower count; the address of your account's server; and a Bluesky access token and refresh token, bound to a signing key kept for your account (all stored encrypted). For posts HypeDuo created: the post ID and link, the like, repost, quote and reply counts, and the replies people leave on those posts (reply text, the replier's display name or handle, time and like count), read from Bluesky's public data. Permissions: Bluesky's atproto and transition:generic scopes. HypeDuo uses them only to create the posts your team approved (and the photos or video attached to them) and to post the replies your team writes. We do not use them to delete or edit your other posts, follow or block accounts, change your profile, or read your direct messages.	Letting you confirm which account to post to; creating the text, photo or video posts your team approved, with links, hashtags and alt text; making sure a post is never created twice; showing each post's results; and showing and sorting replies as described for Facebook, and posting a reply only when someone in your workspace writes it in HypeDuo.
Mastodon	The address of your Mastodon server and its posting limits; your account ID, username, display name, profile picture and follower count on that server; and an access token for the account (stored encrypted). HypeDuo registers itself as an app on your server the first time someone from it connects. For posts HypeDuo created: the post ID and link, the favourite, boost and reply counts, and the replies people leave on those posts (reply text, the replier's display name or handle, time and favourite count). Permissions: read:accounts (see your profile), read:statuses (read your posts and their replies), write:statuses and write:media (publish the posts and replies your team approved, with their photos or video). We do not use them to delete or edit your other posts, follow, mute or block accounts, change your profile, or read your direct messages or notifications.	Letting you confirm which account to post to; creating the text, photo or video posts your team approved, with alt text; making sure a post is never created twice; showing each post's results; and showing and sorting replies as described for Facebook, and posting a reply only when someone in your workspace writes it in HypeDuo.
Tumblr	Your Tumblr username; for each blog you connect, its ID, name, title, address, avatar, follower count and whether it is your main blog; and a Tumblr access token and refresh token (stored encrypted, shared by the blogs you connected in one sign-in). For posts HypeDuo created: the post ID and link, the like, reblog and note counts, and the replies people leave on those posts (reply text, the replier's blog name and time). Permissions: basic (see your account and blogs), write (publish the posts your team approved, with their photos or video and tags) and offline_access (stay connected so scheduled posts go out). We do not use these permissions to edit or delete your other posts, follow or block blogs, like or reblog posts, or read your messages.	Letting you choose which blogs to post to; creating the text, photo or video posts your team approved, with alt text and tags; making sure a post is never created twice; showing each post's results; and showing and sorting replies as described for Facebook.
Telegram	The ID, title, public username (if any) and subscriber count of the channel you connect, and whether HypeDuo's bot may post there. No Telegram login or token of yours is stored: HypeDuo posts through its own bot, which you add to the channel as an admin. For posts HypeDuo sent: the message ID and link, view counts of public channels' posts, and the total reactions Telegram reports.	Letting you confirm which channel to post to; sending the text, photo, album or video posts your team approved; and showing each post's results.
Meta — Threads	Your Threads profile ID, username, name and profile picture, and an access token (stored encrypted). For posts HypeDuo published: the post ID and link, views, likes, reposts, quotes, replies and poll results, and the replies people leave (reply text, the replier's username and time, and whether it is hidden). For the profile itself: follower count and aggregated statistics such as profile views, likes, replies, reposts, quotes, link clicks and follower demographics (no information about who they are). Permissions: threads_basic, threads_content_publish, threads_manage_insights, threads_read_replies, threads_manage_replies.	Publishing the posts your team approved (including threads, polls and reply settings), showing their results and your profile's aggregated statistics in Analytics, showing and sorting replies as described for Facebook, and replying to or hiding a reply only when someone in your workspace does so in HypeDuo.
TikTok	Your TikTok account's open ID, username, display name, profile picture and follower count, what TikTok currently lets the account post (privacy options, maximum video length), and an access token and refresh token (stored encrypted). For posts HypeDuo published: the publish and video IDs, the link, and the views, likes, comments and shares TikTok reports for public posts. Permissions: user.info.basic, user.info.profile, user.info.stats, video.publish, video.list.	Publishing the videos and photo posts your team approved with the privacy and interaction settings you chose, and showing their results.
Snapchat	The ID, name, username, picture and subscriber count of the Snapchat Public Profiles you can post to, and an access token and refresh token (stored encrypted). For Stories and Spotlights HypeDuo published: their IDs and the views, viewers, shares, screenshots and completions Snapchat reports. Permission: snapchat-profile-api.	Letting you choose the Public Profile to post to, publishing the Stories, Spotlights and Saved Stories your team approved, and showing their results.
Meta — WhatsApp Business	Your WhatsApp Business Account's ID and name, your business phone number (its ID, display number, verified name, quality rating and messaging limit), and a business access token (stored encrypted). The message templates HypeDuo creates from your approved posts and WhatsApp's review of them. The details of your customers who message the number or join your broadcasts — see WhatsApp below. Permissions: whatsapp_business_management, whatsapp_business_messaging, through Meta's Embedded Signup.	Sending the broadcasts your team approved to people who opted in, receiving their replies in your HypeDuo inbox so your team can answer, handling opt-ins (JOIN) and opt-outs (STOP) automatically, sending the automatic replies you set up, and showing delivery and read results.
Google Business Profile	The Business Profiles (locations) your Google account owns or manages: each profile's ID, name, address, website, Google Maps link and whether it is verified; and a Google access token and refresh token (stored encrypted, shared by the profiles you connected in one sign-in). For updates HypeDuo published: the post ID and link, whether Google accepted or rejected it, and the views on Google Search and button clicks Google reports. Permission: business.manage. We use it only to list your profiles, publish the updates your team approved and read their results — we do not edit your profile details, hours or photos, read or reply to reviews, or read your Business Profile messages.	Letting you choose which profiles to post to; publishing the updates your team approved, with a photo and a button to your link; making sure an update is never published twice; and showing each update's results.
Google	Name, email address and profile picture (sign-in only).	Creating your HypeDuo account and signing you in.
Shopify	Described in Section 1.	Building your catalog, grounding AI drafts in product facts, and suggesting what to promote.

Our commitments for platform data:

We only publish content that someone in your workspace created or approved in HypeDuo, to the account that was approved for that post. We do not post, like, follow, comment or send messages on your behalf otherwise.
We do not read your private messages, your followers' personal data or content you did not publish through HypeDuo. The one exception is WhatsApp: messages customers send to the business number you connect are received so your team can answer them in HypeDuo.
We do not sell platform data, use it for advertising, share it with data brokers, or use it to train AI models.
Access tokens are encrypted, kept on our servers and never sent to your browser.
If you disconnect an account, remove HypeDuo in the platform's settings, or the platform tells us access was revoked, we stop using that access and delete the token.
Posts that were already published remain on the social platform and are controlled by that platform; you can delete them there.

Google API Services: HypeDuo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services

HypeDuo is an API client of YouTube API Services. By connecting a YouTube channel, you agree to the YouTube Terms of Service. Google's use of your information is governed by the Google Privacy Policy.
What we access, use, store and share from YouTube is listed in the table above. YouTube data is shown only to members of your workspace and is processed only by our hosting and database providers (Vercel and Supabase) to run the Service. It is never sent to AI providers, sold, used for advertising, used to train AI models, or combined with data from other sources about the people who commented.
HypeDuo shows YouTube's numbers exactly as YouTube reports them. It does not add them to other platforms' numbers or calculate new metrics (such as engagement rates or scores) from them.
Titles, descriptions and settings you choose are sent to YouTube exactly as you wrote them. HypeDuo never adds text to them (your link is added to the description only if you turn on "Add my link").
Keeping YouTube data current: we read each connected channel once a day, which also confirms HypeDuo is still authorized. Each video's numbers and comments are read again at least every 7 days, and channel details (name, picture, subscriber count) every day. A video deleted on YouTube has its stored numbers and comments removed at the next check. YouTube comments not refreshed within 30 days are deleted.
You can stop HypeDuo's access at any time: disconnect the channel in HypeDuo (Social media › Integrations › YouTube › Disconnect), which deletes the stored tokens and also revokes HypeDuo's access with Google, or revoke it yourself on Google's security settings page at security.google.com/settings/security/permissions.
Deleting YouTube data: disconnecting the channel in HypeDuo immediately deletes the YouTube data we stored for it: video numbers, comments, channel analytics and channel details. If Google tells us HypeDuo's access was revoked, we delete the same data at once. HypeDuo keeps only its own record that a post was published, with the video's link. You can also ask us to delete all YouTube data related to you by writing to the address in Section 13; we do it as soon as possible and within 7 days. Deleting data stored by HypeDuo does not affect anything on YouTube. To delete videos, comments or other data on YouTube itself, use YouTube or YouTube Studio.

By connecting a Pinterest account, you agree to Pinterest's Terms of Service; Pinterest's handling of your information is described in the Pinterest Privacy Policy. HypeDuo follows Pinterest's Developer Guidelines.
HypeDuo only acts on the Pinterest account you connect, and creates a Pin only when someone in your workspace has created or approved it in HypeDuo. What we access and store is listed in the table above. Pinterest data is shared only with members of your workspace and with our hosting and database providers (Vercel and Supabase) to run the Service. We do not sell it, use it for advertising, or use it to train AI models.
You can stop HypeDuo's access at any time: disconnect the account in HypeDuo (Social media › Integrations › Pinterest › Disconnect), which deletes the stored tokens, or remove HypeDuo in Pinterest under Settings › Security and logins › Apps. To have the Pinterest data we stored (Pin IDs and results) deleted, contact us at the address in Section 13; we delete it within 30 days. Pins already published stay on Pinterest until you delete them there.

When you connect a WhatsApp Business number, you are responsible for the people you message, and HypeDuo processes their details on your behalf, only to run your WhatsApp features. By connecting, you agree to WhatsApp's Business Terms and Business Messaging Policy.
For each person who messages your number or is added to your broadcast list, HypeDuo keeps: their WhatsApp phone number (or WhatsApp's user ID and username, when they don't share a number), the profile name they set, whether they joined your broadcasts, how and when they opted in (the message they sent, or where an imported list was collected), when they opted out, and when they last messaged you.
HypeDuo also keeps the conversation with your number: the text of messages in both directions, what kind of message it was (photo, video, document, location, button, form answers), its delivery and read status, and reactions. Photos, videos and documents customers send stay with WhatsApp and are fetched only when your team opens them (WhatsApp keeps them for 30 days).
Promotional broadcasts go only to people who opted in. Anyone can reply STOP (or tap “Stop promotions”) to stop them; we keep the opt-out so they are never messaged again. WhatsApp messages are not sent to AI models.
These details are kept until you delete the contact, disconnect the number or delete your workspace. People whose details you hold should contact your business to access or delete them; we help you respond.

Your use of each platform remains subject to that platform's own privacy policy, for example those of Meta (Facebook, Instagram, Threads), WhatsApp, X, LinkedIn, TikTok, Snapchat, Google and YouTube, Pinterest, Telegram, Bluesky, Tumblr, your Mastodon server (each server publishes its own) and Shopify.

4. How AI is used

To generate suggestions, captions, images and brand details, we send the information needed for that task — such as product details, your brand kit, your prompt and text from your website — to AI model providers (for example Google, OpenAI and Anthropic), mostly through the Vercel AI Gateway.
To sort comments on your published posts into positive, negative and questions and summarise them, we send the comment text (not the commenter's name) and your post's text to an AI provider through the Vercel AI Gateway, under terms that don't allow training on it. Comments on YouTube are never sent to AI.
We do not send your login credentials, access tokens or payment details to AI providers, and we avoid sending personal information that isn't needed for the task.
We use these providers under business/API terms that do not permit them to use our customers' data to train their models. We do not use your data to train AI models of our own.
We keep a record of each AI run (the task, the model and prompt version used, and the result) so you can see your content history and so we can measure quality and cost.
AI output can be wrong. HypeDuo checks drafts against your product facts and requires human approval before publishing, but you remain responsible for what you approve.

We share information only as described here:

Within your workspace: members of a workspace can see that workspace's catalog, posts, approvals, connected accounts (but never their tokens) and activity log, according to their role.
With platforms you connect: when you publish, we send the approved post (text, images, video, links) to the platform you chose. For Mastodon, that is the server you named, which is run by its own operator; for Telegram, posts are sent through HypeDuo's bot.
With service providers who process data on our behalf under contract and only to provide the Service:
- Vercel Inc. — website and app hosting, AI Gateway
- Supabase Inc. — database hosting
- AI model providers (such as Google, OpenAI and Anthropic) — AI generation, as described in Section 4
- Google — sign-in, YouTube (when you connect a channel), and web fonts on our website
- Shopify — app hosting inside Shopify admin and billing for Shopify merchants
- Brand data sources (Wikidata/Wikipedia, a brand-logo service) — receive only your business name or domain
For legal reasons: if required by law, court order or government request, or to protect the rights, safety and security of HypeDuo, our users or the public.
Business transfers: if HypeDuo is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction, subject to this policy.
With your consent: in any other case, only if you ask us to.

6. Cookies and similar technologies

We use only cookies that are necessary for the Service to work:

Login cookies that keep you signed in to the web app.
A workspace cookie that remembers which workspace you selected.
Short-lived security cookies used while you connect a social media account, to make sure the sign-in returns to the same browser that started it.

Inside Shopify admin, Shopify's session tokens are used instead of login cookies. We do not use advertising cookies or cross-site tracking. Our website loads fonts from Google Fonts, which means Google receives your IP address when the page loads.

7. Storage, location and security

Our servers and database are hosted by Vercel and Supabase, currently in Tokyo, Japan. Our service providers may process data in other countries, including the United States. Where the law requires, we rely on appropriate safeguards such as standard contractual clauses for these transfers.
All traffic is encrypted in transit with HTTPS/TLS. Access tokens for Shopify and social platforms are encrypted at rest with AES-256-GCM, and Google tokens are encrypted as well.
Each workspace's data is isolated at the database level (row-level security), so one business cannot read another's data, and actions inside a workspace are limited by role.
Access to production systems is limited to people who need it to run the Service.

No system is perfectly secure. If we become aware of a breach that affects your personal information, we will notify you and the relevant authorities as required by law.

8. How long we keep information

Account and workspace data: for as long as your account or workspace is active, and deleted within 30 days after you ask us to delete it, except where we must keep some records longer by law (for example, billing records).
WhatsApp contacts and conversations: until you delete the contact, disconnect the number or delete your workspace. Opt-outs are kept for as long as the number is connected, so people who said STOP are never messaged again.
YouTube data: refreshed at least every 7 days (daily for channel details), and deleted immediately when you disconnect the channel or Google tells us access was revoked. Deletion requests are completed within 7 days. Details are in YouTube API Services.
Social account tokens: until you disconnect the account, revoke access on the platform, or the platform tells us the access was removed. An unfinished connection attempt expires after 15 minutes.
Shopify store data: when you uninstall HypeDuo, we stop syncing. When Shopify sends its store-deletion request (normally 48 hours after uninstall), we erase that store's connection, tokens and catalog data.
Login sessions expire automatically; technical logs are kept for a limited period for security and debugging.
Deleted data may remain in encrypted backups for a limited time until those backups expire.

9. Your rights and choices

Depending on where you live (for example under the EU/UK GDPR, India's Digital Personal Data Protection Act 2023, or California privacy law), you may have the right to:

access the personal information we hold about you and get a copy of it;
correct inaccurate information;
delete your information;
object to or restrict certain processing, and withdraw consent;
receive your information in a portable format;
nominate someone to exercise your rights if you are unable to (India);
complain to your data protection authority.

To exercise these rights, email us at the address in Section 13. We will respond within 30 days (or sooner where the law requires) and may need to verify your identity. We will not discriminate against you for exercising your rights.

Business customers' end users: HypeDuo does not collect personal information about the shoppers or followers of the businesses that use it. If you are a customer of a business that uses HypeDuo, please contact that business directly.

10. How to delete your data

You can remove your data in any of these ways:

Disconnect a social account

In HypeDuo, go to Social media › Integrations, choose the account and click Disconnect. We delete the access token immediately.
Facebook / Instagram: go to Facebook Settings & privacy › Settings › Business integrations (or Apps and websites), find HypeDuo and click Remove. Meta notifies us and we automatically delete the Page access tokens and Page details we hold for your Facebook account, and give you a confirmation code to check the status of your request.
X: go to Settings and privacy › Security and account access › Apps and sessions › Connected apps, select HypeDuo and revoke access.
LinkedIn: go to Settings › Data privacy › Other applications › Permitted services and remove HypeDuo.
Google Business Profile: disconnect the profile in HypeDuo, or remove HypeDuo's access at myaccount.google.com/connections (this also disconnects the other profiles you connected with the same Google account).
Google: visit myaccount.google.com/connections and remove HypeDuo's access.
Threads: in Threads, go to Settings › Account › Website permissions › Apps and websites and remove HypeDuo.
WhatsApp: disconnect the number in HypeDuo, or remove HypeDuo from your WhatsApp Business Account in Meta Business Suite (Settings › Integrations › Connected apps).
TikTok: go to Settings and privacy › Security › Apps and services permissions in the TikTok app and remove HypeDuo.
Snapchat: go to Settings › Privacy controls › Connected apps in Snapchat and remove HypeDuo.
Pinterest: disconnect the account in HypeDuo, or go to Settings › Security and logins › Apps on Pinterest and remove HypeDuo.
Bluesky: disconnect the account in HypeDuo (this also revokes our access with Bluesky), or remove HypeDuo under Settings › Privacy and security › Apps on Bluesky.
Mastodon: disconnect the account in HypeDuo (this also revokes our access on your server), or remove HypeDuo under Preferences › Account › Authorized apps on your Mastodon server.
Tumblr: disconnect the blog in HypeDuo, or go to Settings › Account › Connected apps on Tumblr and remove HypeDuo.
Telegram: disconnect the channel in HypeDuo, or remove HypeDuo's bot from the channel's administrators in Telegram.
YouTube: disconnect the channel in HypeDuo (this also revokes our access with Google), or revoke HypeDuo's access at security.google.com/settings/security/permissions.

Uninstall from Shopify

Uninstall HypeDuo from your Shopify admin (Settings › Apps). Your store's data is erased when Shopify sends its store-deletion request, as described in Section 8.

Delete your account or workspace

Email us at help@hypeduo.app from the email address on your account with the subject "Data deletion request". We will confirm and delete your account, your workspace data (if you are its owner) and any connected-platform data within 30 days.

Deleting data from HypeDuo does not delete posts already published on social platforms; remove those on the platform itself.

11. Children

HypeDuo is a business tool and is not directed to children. You must be at least 18 years old (or the age of majority where you live) to use it. We do not knowingly collect personal information from children; if you believe a child has given us information, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the Service changes, for example when we add support for new platforms. We will post the new version on this page and update the "Last updated" date. If a change materially affects how we use your information, we will notify you by email or in the app before it takes effect.

13. Contact us

For any privacy question, request or complaint, including requests under data protection law, contact us (this address also reaches our grievance officer for India):

Email: help@hypeduo.app
Website: www.hypeduo.app