Privacy Policy
- We collect what we need to run : your account details, the content you create, and the Instagram and Facebook accounts you choose to connect.
- We never sell your data, and we don't use advertising trackers.
- We share data only with the services that make the product work (Meta, Google, Razorpay and our hosting provider).
- You can see, correct, export or delete your data at any time. See how to delete your data.
This policy explains how ("we", "us") handles personal data when you use at (the "Service"). We are the Data Fiduciary for this data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). By creating an account you consent to the processing described here.
1. Data we collect
| Data | Where it comes from | Why we need it |
|---|---|---|
| Account details: name, email address, password (stored only as a one-way hash) | You, when you register | To create your account and sign you in |
| Google profile: name, email, profile picture, Google account ID | Google, if you choose "Continue with Google" | To sign you in without a password |
| Instagram account data: account ID, username, profile picture, follower, following and post counts, your posts (captions, links, likes, comments) and post insights (reach, views, saves, shares), and an access token | Instagram (Meta), after you connect your account and approve access | To publish the posts you choose and to show your account statistics and analytics |
| Facebook Page data: the IDs and names of the Pages you share, their pictures and follower counts, their posts and post statistics, the Instagram professional account linked to each Page, Page access tokens, and a Facebook access token for your own account | Facebook (Meta), after you connect and choose Pages | To publish the posts you choose to your Page, show Page analytics, and run Reel research through the Instagram account linked to your Page |
| Reel research results: public posts from other Instagram Business and Creator accounts that you look up by hashtag, topic or username (captions, like, comment and view counts, links, and media files), and the hashtags you searched | Instagram (Meta), through its official Hashtag Search and Business Discovery features | To show you popular Reels, keep results briefly so repeat searches are fast, and stay within Instagram's limit of 30 hashtags a week |
| Your content: brand profile, ideas, scripts, captions, hashtags, competitor notes, uploaded photos and videos, AI-generated images and videos, Reel analyses, account reports, scheduled posts | You, and the AI features you use | To provide the studio, publishing and scheduling |
| AI inputs: the text you ask the AI features to work from, your brand profile, the videos you ask the AI to analyse (a Reel you chose from research, or one you uploaded), and your recent posts' statistics when you ask for an account report | You | To generate ideas, captions, images and videos, analyse Reels and write account reports |
| Payment records: plan, amount, currency, date and payment/order IDs. We never see or store card, UPI or bank details. | Razorpay, when you buy a plan | To activate your plan, keep accounting records and handle refunds |
| Usage records: what you published and whether it succeeded, AI credits used, and daily snapshots of your Instagram and Facebook follower counts | The Service | To apply your plan's credits and limits, and to show your analytics and history |
| Technical data: IP address, browser type, sign-in history (time, IP address, browser and sign-in method) and request logs | Your browser | Security, preventing abuse and fixing problems |
| Consent record: which version of these terms you accepted, and when | You | To prove consent, as the DPDP Act requires |
2. How we use it
- To provide the Service: accounts, the content studio, AI generation, publishing and scheduling to Instagram and Facebook, and analytics.
- To process payments and enforce plan limits.
- To keep the Service secure, detect abuse and fix problems.
- To contact you about your account, security or changes to these terms. We don't send marketing without asking you first.
We only publish to your Instagram or Facebook accounts when you click Publish or schedule a post. We don't read your messages, and we don't use data from Instagram or Facebook for advertising or sell it to anyone.
3. Who we share it with
We share data only with these service providers, and only as needed to run the Service:
- Meta Platforms (Instagram and Facebook): to connect your accounts, read your account data and publish your posts. Meta's own privacy policy applies to your use of Instagram and Facebook.
- Google: Google Sign-In; Google's AI services (Gemini), which receive your AI inputs to generate text, images and videos, analyse Reels and write reports (videos you ask it to analyse are uploaded to Google for the analysis and deleted afterwards); and Google Fonts, which our pages load.
- Razorpay: to take payments. Razorpay handles your card, UPI and bank details under its own privacy policy.
- Cloudflare: which carries all traffic to and from hookvera.com, protects the site from attacks and provides its HTTPS certificate.
- Our hosting provider: which stores the Service's database and files on our behalf.
- Authorities: when the law requires it, or to protect our rights, users or the public.
Some of these providers may process data outside India. When they do, we rely on their contractual safeguards, and we won't transfer data to any country the Government of India restricts.
4. Cookies and local storage
We use a single essential cookie, rf_session, to keep you signed in. It lasts 30 days, or until you log out. We also save a few preferences in your browser (for example, which platforms you last posted to). We don't use advertising or cross-site tracking cookies. Google Sign-In and Google Fonts may set or read their own cookies under Google's policies.
5. How long we keep it
- Account and content: while your account is open. When you delete your account, it's removed within 30 days, and from backups within 90 days.
- Instagram and Facebook tokens: deleted as soon as you disconnect the account, or delete yours.
- Reel research results: cached for up to 24 hours. The record of which hashtags you searched is kept for 7 days, the period Instagram's weekly limit uses. Reel analyses you save stay until you delete them or your account.
- Videos downloaded for analysis: deleted from our servers straight after the analysis, and from Google after it's processed.
- Sign-in history: up to 12 months.
- Payment records: for as long as tax and accounting law requires (usually up to 8 years).
- Server logs: up to 90 days.
6. Security
We use HTTPS everywhere. Passwords and session tokens are stored only as hashes. Instagram and Facebook access tokens are kept on the server and never sent to your browser, and access to production systems is restricted. No system is perfectly secure. If a breach affects your data, we'll notify you and the Data Protection Board of India as the law requires.
7. Your rights
Under the DPDP Act you can:
- Access a summary of your personal data and how it's processed.
- Correct or update inaccurate or incomplete data.
- Erase your data (see below).
- Withdraw consent at any time. Some features stop working without the data they need, and processing already done stays lawful.
- Nominate someone to exercise these rights if you die or become incapacitated.
- Raise a grievance with our Grievance Officer, and if you're not satisfied, complain to the Data Protection Board of India.
Email to use any of these rights. We answer within 30 days.
8. How to delete your data
- Disconnect Instagram or Facebook: in Hookvera, open Settings and click Disconnect. This deletes the stored token straight away.
- Remove Hookvera's access in Meta:
- Instagram: Settings and privacy → Website permissions → Apps and websites, then remove Hookvera.
- Facebook: Settings & privacy → Settings → Business integrations (or Apps and websites), then remove Hookvera.
- Delete your account and all its data: email from your account's email address with the subject "Delete my account". We'll confirm, and then delete your account, content, uploads, connections and analytics within 30 days. We only keep payment records the law requires us to keep.
9. Children
The Service is for people aged 18 and over. We don't knowingly process children's data. If you believe a child has created an account, contact us and we'll delete it.
10. Changes to this policy
If we change this policy materially, we'll update the date above and ask you to review and accept the new version the next time you sign in.
11. Contact and Grievance Officer
Grievance Officer:
Email:
We acknowledge grievances within 48 hours and resolve them within 30 days.