Privacypolicy

• Your account: your email, your name, and a password if you set one (stored as a hash, never in plain text). If you sign in with Google or a social network, we get your name, email and profile picture from them.
• Your page: everything you add to it, like links, text, images, videos, themes and settings.
• Connected accounts: when you connect Instagram, TikTok, YouTube or another network, the access it grants us (encrypted at rest) and the public profile details we use to build and update your page.
• Billing: your plan and invoices. Stripe handles your card, and we never see the full number.
• Talking to us: emails you send us and anything you tell Hiya, our assistant, while it sets up your page.

When you open a Hiyaly page, we count the visit so its owner can see how it's doing. We keep:

• which page you saw and which links you tapped;
• your country and city, worked out from your IP address by our host;
• your kind of device, browser and operating system;
• the site that sent you (just its name, like instagram.com) and any campaign tags in the link.

We don't store your IP address with your visit. To tell new visitors from returning ones, we turn it into a scrambled code that changes every day and can't be turned back into your IP. Visits from bots aren't counted.

If you send a message, join a mailing list or book a time on a page, we keep what you entered (usually your name and email) and share it with that page's owner. To remove it, ask the owner, or email us and we'll help.

Owners' own tracking

Some owners on Pro add their own Meta Pixel or Google Analytics to their page. When they do, those services get data about your visit under their own privacy policies, and the owner is responsible for it. We may also tell Meta about the visit from our servers, so it isn't counted twice.

We use your data to:

• run your account, your page and its stats;
• set up and refresh your page from your socials, if you ask us to;
• take payments and send receipts and renewal reminders;
• send the emails you need, like sign-in codes and notices about your page;
• keep Hiyaly safe, stop spam and abuse, and fix bugs;
• meet our legal obligations.

Under laws like the GDPR, we rely on our contract with you to run the service, our legitimate interest in keeping it safe and making it better, your consent where we ask for it, and legal obligations where they apply.

We don't use your content or your visitors' data to train AI models.

We use a small number of trusted services to run Hiyaly. They only get what they need for their job, and they're not allowed to use it for anything else.

• Vercel hosts the site and tells us a visitor's rough location.
• Our database and storage providers hold your account, your page and its images (Cloudflare R2 for files).
• Stripe takes payments.
• Resend sends our emails.
• OpenRouter and the AI models it connects to power Hiya, our assistant, when you use it.
• ScrapeCreators reads public social profiles when Hiya builds a page from them.
• Upstash helps us limit spam and abuse.
• Google, Meta, TikTok, YouTube, Twitch, Snapchat and Canva, only when you choose to sign in with or connect one of them.

Beyond that, we only share data if the law makes us, to protect someone's safety, or as part of a sale or merger of Hiyaly, in which case this policy keeps applying to your data.

Some of these services are in the United States or elsewhere outside your country. Where the law asks for it, we use safeguards like the European Commission's standard contractual clauses.

• Your account and pages: for as long as you have them. When you delete them, they're gone from our live systems straight away and from backups within 30 days.
• Visit stats: for as long as the page exists.
• Messages, sign-ups and bookings: until the owner deletes them or their page.
• Invoices and payment records: as long as tax law requires, which is usually several years.

Wherever you live, you can ask us to show you the data we hold about you, correct it, delete it, or send you a copy. Where laws like the GDPR or CCPA apply, you can also object to how we use it or ask us to stop. You can delete your account yourself, any time, from your settings.

Email privacy@hiyaly.com and we'll reply within 30 days. If you're not happy with our answer, you can complain to your local data protection authority.

Everything travels over HTTPS, sign-in cookies can't be read by scripts, social account access is encrypted, and only the few people who need to see your data to help you can. No system is perfect, but if something ever goes wrong that affects your data, we'll tell you quickly and plainly.

Hiyaly isn't for children under 13, and we don't knowingly collect their data. If you think a child has given us their details, email privacy@hiyaly.com and we'll delete them.

If we change this policy, we'll update the date at the top. If the change matters, we'll email account holders before it takes effect.

Questions about privacy go to privacy@hiyaly.com. For anything else, write to hi@hiyaly.com. The cookies we use are listed in our cookie policy, and the rules for using Hiyaly are in our terms of service.