Privacy Policy

1. Information we collect

• Account and enquiries: email address, name, password hash, preferences, and information you send when asking for support. Passwords are stored as bcrypt hashes, not readable passwords.
• Content and uploads: brand and product information, research inputs, documents, reference images, logos, photos, spokesperson profiles and likeness references, generated copy, images and videos, email drafts, schedules, and saved versions. Photos of real people and identifying details in uploads can be personal data.
• Connected Meta accounts: app-scoped user IDs; Facebook Page IDs, names and tasks; Instagram professional account IDs, usernames, names, account types and profile picture URLs; and access tokens. Permissions may include pages_show_list, pages_manage_posts, pages_read_engagement, business_management, instagram_business_basic and instagram_business_content_publish. Performance features may also request read_insights, pages_read_user_content and instagram_business_manage_insights when enabled for your connection.
• Publishing records: approved content snapshots, target accounts, provider post/media IDs, permalinks, job states and sanitised errors.
• Performance: post views, reach, reactions/likes, comments, shares, saves, clicks, profile visits and follows; daily account figures such as followers, reach, views and interactions; and, for external posts you choose to import, post text and a thumbnail. We do not read private messages.
• Page comments: when you choose to read comments on a connected Facebook Page post, we retrieve comment text, ID and creation time. We do not request commenter names or profile IDs. Comment content is not stored in our database, included in performance reports or sent to AI providers.
• Agent access: API key names, permissions, limits and one-way hashes; OAuth connection records; request time, operation, result, credits used, IP address and client name. API request logs do not store full request bodies or generated content.
• Billing and activation: chosen plan and billing interval, billing/contact information returned by Stripe, customer/subscription/payment identifiers, payment status, invoices, credit transactions and activation records. Stripe collects payment card details in its hosted payment flow; we do not store full card numbers or card security codes.
• Website security: IP address, browser/device information, verification results and interaction signals used by our infrastructure and hCaptcha to prevent fraud, bots and abuse. This can occur on pages where verification is enabled, before a form is submitted.

2. Why we use information

Some information is necessary for the feature you request: for example, an email for an account, a valid authorisation for publishing, or payment information for a paid subscription. You can decline optional uploads, connections and research inputs, but the corresponding feature may then be unavailable.

• To provide accounts, respond to enquiries, research markets, create/edit content, save history, and deliver the functions you request.
• To list and manage connected accounts, keep authorised tokens working, and publish content you approve or through automation you explicitly configure and can pause. Agent actions follow the permissions and approval settings you choose.
• To display performance, compare your posts with your own earlier posts, and generate analysis or suggestions when requested. AI analysis is guidance and does not guarantee results.
• To process subscriptions and credits, verify payment, activate accounts, issue service notices, and prevent fraud and abuse.
• To secure and debug the Service. Request logs let you review agent activity; administrators may review them for support/security, and such reviews are recorded.

3. Providers and information sharing

We do not sell personal data or use Meta-derived account data to build advertising profiles or target ads. We share information as needed to provide and protect the Service:

• Meta Platforms: account authorisation, publishing and the social/performance features you enable.
• AI providers: our LiteLLM gateway and the model/tool providers behind it process the prompts, relevant text, documents, images and reference assets needed for a requested task. Some image features, including spokesperson generation/editing, send reference photos and prompts directly to fal.ai. Vision and quality checks can also process images. Social access tokens are never sent to AI providers.
• Performance analysis sends relevant post text, image descriptions and performance figures to AI providers. Facebook Page comment content is excluded.
• DataForSEO and web search providers: research queries and relevant brand/topic/region information. Web-search queries do not include social account data or tokens.
• Stripe: hosted payments, billing, subscriptions and payment reconciliation, where online payment is available.
• Intuition Machines, Inc. (hCaptcha): bot and abuse checks, including IP address, browser/device and interaction information on pages where hCaptcha is enabled.
• Infrastructure providers, including Amazon Web Services and Cloudflare: application hosting, media, private files, backups and delivery. Email service providers process account/support messages; Amazon SES/SQS and Cloudflare support email marketing as described below.
• Recipients and platforms you select receive content you publish or send. Your own agents and authorised integrations receive data within their granted permissions. We may also disclose information where required by law or necessary to investigate abuse and protect legal rights.

4. Storage, security and international processing

Social tokens are stored on our servers using AES-256-GCM encryption with a per-record nonce and authenticated data binding the ciphertext to its owner/record. Tokens are not returned to your browser, written to logs or shared with AI providers.

Content intended for publishing or email delivery may be served through public media URLs. Private files and backups use separate protected storage. A public media URL can be accessible to anyone who has it; do not upload material you are not authorised to share with the feature's recipients or providers.

Our infrastructure and service providers may process information in Hong Kong and other countries. Their processing locations and applicable protections can differ from yours. We use access restrictions, encryption where implemented and contractual or other safeguards appropriate to the processing; no system is risk-free.

5. Cookies and similar technology

We use session/security cookies and preference storage for settings such as theme and language. hCaptcha and hosted payment services may use cookies or similar technology for verification, fraud prevention and their functionality. We do not use third-party advertising cookies. Email open pixels and tracked links are described in section 8; they are separate from website sign-in cookies.

6. Disconnecting, revoking and deleting

• Disconnect in Social media settings: disables the selected account's connection and clears its stored Page token, where present. This does not erase the shared grant/user token, related account/history records, or content already published on Meta.
• Revoke the grant or remove our app in Meta settings: stops the related authorisation. A Meta deauthorisation callback disables the connection. Revocation and disconnection are different from a request to erase data.
• A verified Meta data-deletion request removes the related grant/tokens, account records, pending OAuth data, brand links, publishing jobs and linked performance data/analyses. It does not automatically delete your HeyMarketer account, authored content or email contacts.
• For account-wide deletion, content removal or recipient data requests, use the controls available in the Service or contact [email protected]. We confirm the scope, verify identity/authority as reasonably necessary, and explain any information that must be retained.

7. Retention and backups

• Accounts, authored content, uploads and saved versions remain while needed to provide your workspace and history, until deleted through the supported process or otherwise no longer needed. Regenerating or editing content preserves earlier versions; it is not a deletion request.
• Publish asset snapshots are normally kept 7 days after success and 30 days after failure. OAuth candidate data expires after 15 minutes. Disconnecting does not delete the shared grant token; grant/token deletion follows the processes in section 6.
• Post performance data is normally retained for up to 2 years and deleted with the connected account on a verified deletion request. Generated reports retain summary figures after an account is removed.
• API request logs normally remain for 90 days and security audit events for one year, subject to configured retention and investigation/legal needs. Social audit events contain no access tokens or content and are kept for security review.
• Billing, activation, support and security records remain as needed for the relevant service, accounting, dispute, security or legal purpose. Where a single fixed period does not apply, these purposes determine retention.
• Database backups normally rotate over 30 days. Removal from active systems does not immediately rewrite existing backups. Backups remain access-restricted and expire on rotation; where a restore is needed, recorded deletions must be reapplied. Media already downloaded, published or cached by recipients/third-party platforms may remain outside our control.

8. Email marketing and recipients

When a customer uses email marketing, we process recipient addresses, names, contact details, group membership and consent records on that customer's behalf, together with sender details, immutable email versions and sending records. The customer is responsible for their audience and permitted use; we also process limited suppression/security data to protect recipients and the platform.

Amazon SES delivers email, Amazon SQS carries delivery and unsubscribe events, and Cloudflare hosts media and tracking endpoints. Data may be processed outside your location. Open pixels record requests when enabled; tracked links record clicks, including possible privacy-proxy or scanner activity. Open tracking can be disabled per send. Delivery, bounce, complaint and unsubscribe events update recipient protection. Tracking and unsubscribe links continue to work if the Dashboard is unavailable or a detailed report has expired.

Detailed email events, recipient snapshots and activity logs are normally retained for 30 days, configurable between 7 and 30 days. Unfinished, paused or unresolved sends retain details until safely reconciled. Imports and exports expire after one day. Aggregate counts and link statistics remain for reporting. Suppression records retain address hashes to prevent re-importing opted-out, complained or invalid addresses; a hash does not guarantee anonymity.

Deleting a contact removes group membership and immediately hides linked addresses in the Dashboard; background cleanup removes remaining snapshot addresses and diagnostics in batches. Account deletion requires cleanup of owned provider resources before database removal, and provider failures delay deletion. Platform invalid-address suppression may remain to protect other senders.

Recipients can use an email's unsubscribe link to stop marketing from that sender. For access, correction or deletion, contact the sender identified in the message, or [email protected] for help locating the responsible customer. We may need to verify the request and coordinate with that customer.

9. Your rights and contact

You can request access to or correction of your personal data by writing to the Privacy Contact, Area2 (HK) Limited, at [email protected]. Describe the information or feature concerned; do not email your password, access tokens or full payment card details. We may request information reasonably necessary to verify identity and authority.

We handle access and correction requests within applicable statutory time limits, subject to lawful exemptions and any permitted fee. Other privacy or deletion requests are assessed according to their scope, required verification, legal obligations and technical/provider dependencies. We explain the outcome and any justified retention. You may also raise a complaint with Hong Kong's Privacy Commissioner for Personal Data.

10. Children, law and changes

The Service is for business users aged 18 or over. We do not knowingly collect personal data from children. Area2 (HK) Limited is incorporated in Hong Kong and handles personal data in accordance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486), without excluding other laws that apply to a particular processing activity.

We update this policy when our data practices change. The date above identifies this revision. English and Traditional Chinese versions are provided; if their wording differs, the English version prevails to the extent permitted by applicable law.