Privacy Policy / プライバシーポリシー

HishoAI ("the Service") integrates with third-party platforms including Google, TikTok, Meta (Facebook and Instagram), and X (Twitter) via their official APIs. We may collect the following information:

• Account Information: Email address, name, and authentication identifiers used for login.
• External Service Integration Data: Access tokens, profile information, page/account identifiers, post and video metadata obtained via APIs when linking with TikTok, Google, Meta (Facebook Pages / Instagram Business), and X.
• Messaging Data: When the operator connects Meta or X messaging permissions, direct messages, message attachments, sender identifiers (PSID / IGSID / user IDs), and message timestamps sent to the operator's Facebook Page or Instagram Business account are received and stored for internal communication management.
• Usage Data: Log information and access statistics for service improvement.

Collected information will be used for the following purposes:

• Providing SNS post scheduling, publishing, and management functions.
• Aggregating direct messages received via Meta and X messaging APIs into a single internal management view for the operator.
• User verification and customer support.
• Service improvement, bug fixes, and new feature development.

Collected information will not be used for advertising, profiling of message senders, or any purpose other than those listed above.

Data obtained via TikTok API is limited to the scope explicitly authorized by the user. This data is used solely to execute video uploads and publishing as instructed by the user and will not be sold or shared with third parties. Temporary data obtained through the TikTok API (such as access tokens) is kept only for the period for which the individual has consented or the minimum period necessary to provide the app's functions, and will be promptly deleted if the user disconnects the integration.

Data obtained from Meta's platforms (Facebook Pages and Instagram Business accounts) via the Graph API and Messenger Platform is limited to the scope explicitly authorized by the operator who connects the integration. Specifically:

• Direct messages and attachments received by the operator's Facebook Page and Instagram Business account are stored solely for the operator's internal communication management.
• Meta data is never sold, transferred, or shared with third parties for advertising, profiling, or any other secondary purpose.
• Page-scoped user identifiers (PSID) and Instagram-scoped IDs (IGSID) are stored only to associate incoming messages with the corresponding conversation thread.
• Access tokens are stored encrypted at rest and are revoked immediately upon disconnection of the integration.
• Message content is retained as described in Section 6 (Data Retention) and is deleted upon request as described in Section 7 (User Rights and Data Deletion).

The Service complies with Meta's Platform Terms and Developer Policies. Any future expansion of Meta data usage will be reflected in this Privacy Policy before activation.

Personal information will not be sold, rented, or provided to third parties without the user's consent, except as required by law.

The Service uses the following infrastructure providers ("sub-processors") solely to host, store, and operate the Service. These providers process data on our behalf under their respective data processing terms:

• Vercel Inc. — application hosting
• Supabase Inc. — database and authentication
• Cloudflare, Inc. — CDN, edge runtime, and object storage (R2)
• Google LLC — Google Drive storage for archived media (when explicitly enabled by the operator)

The Service retains data for the following periods:

• Account data: Retained for as long as the account is active. Deleted within 30 days after account closure.
• External service access tokens: Retained only while the integration is connected. Revoked and deleted immediately upon disconnection.
• Message content and metadata (Meta / X DMs): Retained while operationally necessary for the operator's internal communication management. Deleted within 30 days of a verified deletion request (see Section 7).
• Server logs: Retained for up to 90 days for security and debugging purposes, then deleted automatically.

Users and individuals whose personal data is processed by the Service have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right of correction: Request correction of inaccurate or incomplete data.
• Right of deletion: Request deletion of your personal data.
• Right to withdraw consent: Disconnect any external integration at any time through the Service's settings or by contacting us.

To request deletion of your data, please send an email to [email protected] with the subject line "Data Deletion Request" and include:

• The platform (Facebook Page, Instagram Business, X, etc.) on which you contacted us.
• Your identifier on that platform (page name, Instagram handle, X handle, etc.).
• An approximate date range of the messages you wish deleted, or "all messages" if applicable.

We will verify the request and complete deletion within 30 days. Confirmation will be sent to the email address from which the request was made.

The Service implements appropriate technical and organizational security measures to prevent unauthorized access, leakage, loss, or alteration of information. These include encryption of access tokens at rest, transport encryption (TLS) for all API traffic, and access controls on administrative interfaces.

The Service is intended for use by business operators and is not directed to children under 13 (or under 16 in jurisdictions where that age applies). We do not knowingly collect personal data from children. If you believe a child has provided personal data to the Service, please contact us so we can delete it.

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last Updated" date at the top of this page. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

For inquiries regarding this Privacy Policy, data subject rights requests, or data deletion requests, please contact:
Email: [email protected]