Privacy Policy

As a controller — for our own site visitors and account holders (merchant users), we decide how and why we process that data (e.g. account, billing, support, security).

As a processor — when the Service reads and replies to a merchant’s direct messages, we process end-customers’ message content and identifiers on the merchant’s instructions. The merchant is the controller of that data; our processing is governed by our Data Processing Agreement. If you are an end-customer with a request about your data, please contact the merchant you messaged; we will assist them as their processor.

Merchant account data (we are controller)

• Identity & contact: name, email, password hash.
• Workspace & connection data: connected Instagram/WhatsApp/TikTok and Shopify accounts, access tokens (encrypted at rest), catalog and knowledge you ingest.
• Billing: plan, subscription status, and payment metadata (card data is handled by Stripe — we never store it).
• Usage & device: log data, IP address, pages viewed, and cookies (see §7).

End-customer DM data (we are processor for the merchant)

• Message content sent to/from the merchant’s connected channels.
• Platform-provided identifiers (e.g. the sender’s platform-scoped ID, username, profile image) and consent/opt-out state.

• Provide the Service (contract): operate accounts, connect channels, generate and send replies, show your inbox and analytics.
• Billing (contract): manage subscriptions and payments.
• Security, fraud prevention, and compliance (legitimate interests / legal obligation): rate-limiting, abuse prevention, honoring messaging-window and consent rules.
• Support and communication (legitimate interests / contract).
• Product improvement (legitimate interests): we do not use end-customer DM content to train third-party foundation models; DM content is sent to our AI sub-processor only to generate that conversation’s reply.

We share data with the vendors below strictly to run the Service. Each is bound by a data-processing agreement. A current list is maintained in our DPA.

We are based in Victoria, Australia and our sub-processors are primarily in the United States. Where we transfer personal data out of the UK/EEA, we rely on appropriate safeguards — the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses — a copy of which is available on request.

Merchant account data is kept while your account is active and for a limited period afterward to meet legal, tax, and security obligations. End-customer DM data is retained for the merchant per their settings and our DPA; on account deletion or a valid erasure instruction, we delete or de-identify the associated data within a commercially reasonable period, except where retention is legally required.

We use strictly-necessary cookies (e.g. session, theme). We do not currently run third-party advertising cookies. If we introduce analytics, we will update this policy and, where required, seek consent.

Depending on where you live, you may have rights to access, correct, delete, port, or restrict your personal data, to object to certain processing, and to withdraw consent. California residents may request access/deletion and to opt out of “sale”/“sharing” — we do not sell personal data. To exercise rights over data we control, contact us at hello@hyperdm.app. You may also complain to your local supervisory authority. For DM data a merchant controls, contact that merchant.

We apply technical and organizational measures including encryption in transit, encryption of stored channel access tokens, strict tenant isolation (row-level security), signed-webhook verification, and least-privilege access. No method of transmission or storage is perfectly secure.

The Service is not directed to children under 16, and we do not knowingly collect their data.

We may update this policy; we will post the new effective date here and, for material changes, notify account holders. Questions or requests: Anthony Casauria (sole trader), St Helena, Victoria 3088 (full registered address available on request), Victoria, Australia — hello@hyperdm.app.