Privacy Policy / プライバシーポリシー

HishoAI ("the Service") integrates with third-party platforms including Google (including YouTube API Services), TikTok, Meta (Facebook and Instagram), and X (Twitter) via their official APIs. We may collect the following information:

• Account Information: Email address, name, and authentication identifiers used for login.
• External Service Integration Data: Access tokens, profile information, page/account identifiers, post and video metadata obtained via APIs when linking with TikTok, Google, Meta (Facebook Pages / Instagram Business), and X.
• Messaging Data: When the operator connects Meta or X messaging permissions, direct messages, message attachments, sender identifiers (PSID / IGSID / user IDs), and message timestamps sent to the operator's Facebook Page or Instagram Business account are received and stored for internal communication management.
• Usage Data: Log information and access statistics for service improvement.
• Cookies and local storage: The Service uses only strictly necessary cookies and browser storage to keep you signed in (authentication session tokens) and to remember interface preferences. The Service does not use advertising or third-party tracking cookies.

Collected information will be used for the following purposes:

• Providing SNS post scheduling, publishing, and management functions (including uploading videos to, and managing metadata of, the operator's own YouTube channel).
• Aggregating direct messages received via Meta and X messaging APIs into a single internal management view for the operator.
• User verification and customer support.
• Service improvement, bug fixes, and new feature development.

Collected information will not be used for advertising, profiling of message senders, or any purpose other than those listed above.

Data obtained via TikTok API is limited to the scope explicitly authorized by the user. This data is used solely to execute video uploads and publishing as instructed by the user and will not be sold or shared with third parties. Temporary data obtained through the TikTok API (such as access tokens) is kept only for the period for which the individual has consented or the minimum period necessary to provide the app's functions, and will be promptly deleted if the user disconnects the integration.

Data obtained from Meta's platforms (Facebook Pages and Instagram Business accounts) via the Graph API and Messenger Platform is limited to the scope explicitly authorized by the operator who connects the integration. Specifically:

• Direct messages and attachments received by the operator's Facebook Page and Instagram Business account are stored solely for the operator's internal communication management.
• Meta data is never sold, transferred, or shared with third parties for advertising, profiling, or any other secondary purpose.
• Page-scoped user identifiers (PSID) and Instagram-scoped IDs (IGSID) are stored only to associate incoming messages with the corresponding conversation thread.
• Access tokens are stored encrypted at rest and are revoked immediately upon disconnection of the integration.
• Message content is retained as described in Section 7 (Data Retention) and is deleted upon request as described in Section 8 (User Rights and Data Deletion).

The Service complies with Meta's Platform Terms and Developer Policies. Any future expansion of Meta data usage will be reflected in this Privacy Policy before activation.

The Service uses YouTube API Services to let the operator manage the operator's own YouTube channel from a single dashboard. By connecting a YouTube account to the Service, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

Through YouTube API Services, the Service accesses and stores the following Authorized Data, limited to the scope explicitly granted on the Google consent screen:

• Channel and video metadata of the connected channel (channel ID, video IDs, titles, descriptions, tags, localizations, privacy status, publish times, thumbnails) — used to display the channel's videos in the dashboard and to let the operator edit and schedule that metadata.
• Comments and comment threads on the connected channel's videos — used to display, reply to, moderate, and organize viewer comments.
• Video uploads — video files, titles, descriptions, and privacy/scheduling settings that the operator explicitly submits are transmitted to YouTube to publish videos on the operator's own channel.
• OAuth access and refresh tokens — used solely to call YouTube API Services on the operator's behalf.

YouTube API data is used only to provide the functions above to the operator who connected the channel. It is not sold, shared with third parties, used for advertising, or used to build user profiles. The Service does not display YouTube data alongside third-party advertising, and does not use YouTube API data to train or improve artificial intelligence or machine learning models.

Storage and refresh: Cached YouTube metadata and comments are refreshed from YouTube API Services or deleted within 30 days. Access tokens are stored encrypted at rest and are retained only while the integration is connected (see Section 7).

Revoking access: You can disconnect the YouTube integration at any time from the Service's YouTube settings page, which deletes the stored tokens. You can also revoke the Service's access to your Google account at the Google security settings page. Data deletion requests are handled as described in Section 8.

The Service complies with the YouTube API Services Developer Policies.

Personal information will not be sold, rented, or provided to third parties without the user's consent, except as required by law. No third party serves advertisements or content within the Service.

The Service uses the following infrastructure providers ("sub-processors") solely to host, store, and operate the Service. These providers process data on our behalf under their respective data processing terms:

• Vercel Inc. — application hosting
• Supabase Inc. — database and authentication
• Cloudflare, Inc. — CDN, edge runtime, and object storage (R2)
• Google LLC — Google Drive storage for archived media (when explicitly enabled by the operator), and YouTube API Services for managing the operator's own YouTube channel (see Section 5)

The Service retains data for the following periods:

• Account data: Retained for as long as the account is active. Deleted within 30 days after account closure.
• External service access tokens: Retained only while the integration is connected. Revoked and deleted immediately upon disconnection.
• Message content and metadata (Meta / X DMs): Retained while operationally necessary for the operator's internal communication management. Deleted within 30 days of a verified deletion request (see Section 8).
• YouTube API data (cached metadata and comments): Refreshed from YouTube API Services or deleted within 30 days.
• Server logs: Retained for up to 90 days for security and debugging purposes, then deleted automatically.

Users and individuals whose personal data is processed by the Service have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right of correction: Request correction of inaccurate or incomplete data.
• Right of deletion: Request deletion of your personal data.
• Right to withdraw consent: Disconnect any external integration at any time through the Service's settings or by contacting us.

To request deletion of your data, please send an email to [email protected] with the subject line "Data Deletion Request" and include:

• The platform (Facebook Page, Instagram Business, X, YouTube, etc.) on which you contacted us.
• Your identifier on that platform (page name, Instagram handle, X handle, etc.).
• An approximate date range of the messages you wish deleted, or "all messages" if applicable.

We will verify the request and complete deletion within 30 days. Confirmation will be sent to the email address from which the request was made.

The Service implements appropriate technical and organizational security measures to prevent unauthorized access, leakage, loss, or alteration of information. These include encryption of access tokens at rest, transport encryption (TLS) for all API traffic, and access controls on administrative interfaces.

The Service is intended for use by business operators and is not directed to children under 13 (or under 16 in jurisdictions where that age applies). We do not knowingly collect personal data from children. If you believe a child has provided personal data to the Service, please contact us so we can delete it.

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last Updated" date at the top of this page. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

For inquiries regarding this Privacy Policy, data subject rights requests, or data deletion requests, please contact:
Email: [email protected]