HopIn Publisher Privacy Policy
Applies to: our internal publishing tool HopIn Publisher (Meta App ID 1392013026434534, and the same tool's Pinterest, YouTube, TikTok and X apps).
Last updated: 18 October 2026
Public address: https://hopin.it/publisher/privacy
Who we are
HopIn Publisher is an internal tool run by HOPIN.IT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (HopIn.IT sp. z o.o.), ul. Marsz. Józefa Piłsudskiego 74/320, 50-529 Wrocław, Poland, KRS 0001117479, NIP 8971940626, REGON 529197668. We are the controller. Contact: [email protected].
It is not a public app. Only our staff use it, and you cannot sign in to it. It posts for our apps Mai (formerly Grace), Risora, Snap Translator and OnKey.
What it does and what it reads
HopIn Publisher uses the Instagram, Threads and Facebook APIs, and outside Meta the Pinterest, YouTube, TikTok, X and Bluesky APIs, through login tokens that our staff keep on our own systems. It does the following.
| What | Data | Why |
|---|---|---|
| Publishes posts | Our own post text, images and videos, to our own Instagram, Threads, Facebook, Pinterest, YouTube, TikTok, X and Bluesky accounts. | To promote our apps. |
| Reads comments and replies on our posts | The comment or reply text, its time, its like count and the post it belongs to. The commenter's username is read only to skip our own comments and is never stored. | To read and answer people who respond to us. |
| Sends one private reply when you ask for it | If you comment the keyword a post asks for (for example GRACE), we send you one private message with the image the post promised. We send only one message per comment, within 7 days of it, and keep the comment id, the time and the message id. | To deliver what you asked for. |
| Reads our own account statistics | Insights on our own posts and accounts (reach, views, likes, comments, saves, shares). | To see what works. |
| Reads public data of other business accounts (Instagram Business Discovery, public Threads posts) | Public profile details and public posts, with their public like and comment counts. | Market research on how similar accounts perform. |
| Refreshes our login tokens | Our own access tokens. | To keep the tool working. |
It does not read your private messages, private accounts or friends list, it does not profile individuals, and it does not use platform data for advertising or sell it to anyone.
Legal basis
For public business data and for comments and replies on our posts we rely on our legitimate interest (Art. 6(1)(f) GDPR) in promoting our apps, answering the people who talk to us and understanding our market. This reads only what is public or what you chose to post in reply to us, which is the least data that serves the purpose. The private reply is sent because you asked for it in your comment (Art. 6(1)(b) GDPR, steps at your request). You can object at any time (see Deletion and your rights).
Where it is stored
- On our own systems: an encrypted staff computer and our server in the European Union, both accessible only to the company's management. This holds comments, replies, the private-reply log, saved public account data and login tokens.
- On Cloudflare R2 and our own server, only the images and videos of our own posts, which the platforms must fetch from a public address. These contain no personal data about you.
We do not copy this data to any other service and we do not sell it or share it with anyone, except that the platforms (Meta, Pinterest, Google YouTube, TikTok, X, Bluesky) receive what we post. To draft replies, the text of a comment (never a username) may be sent to an AI model provider through OpenRouter, which processes it only to return the draft.
How long we keep it
Comments, replies, the private-reply log, questions taken from comments and saved data about other accounts: 90 days, then an automatic daily job deletes them. Login tokens are replaced when refreshed and deleted when access is revoked. Images and videos of our own posts stay online while the post is live.
Deletion and your rights
To have data about you removed, email [email protected] with the subject "Delete my data (HopIn Publisher)" and a link to your comment, or its text and the post it was under. We store no usernames, so this is how we find your data. We delete it within 30 days and confirm by email. You can also ask us for a copy, ask us to correct it, or object to our use of it. Details are on our data deletion page: https://hopin.it/data-deletion
If you are in the EU, EEA or UK you can complain to a data protection authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl. In the UK it is the Information Commissioner's Office, https://ico.org.uk.
You can also delete your comment on the platform at any time; we then cannot read it again. Data held by the platforms themselves is managed in their own settings: Meta https://www.facebook.com/privacy/policy, Pinterest https://policy.pinterest.com/privacy-policy, Google https://policies.google.com/privacy, TikTok https://www.tiktok.com/legal/privacy-policy-eea, X https://x.com/en/privacy.
Platform terms
We use Meta Platform Data under the Meta Platform Terms (https://developers.facebook.com/terms) and the Developer Policies (https://developers.facebook.com/devpolicy), Pinterest data under the Pinterest Developer Guidelines, X data under the X Developer Agreement and Policy (https://developer.x.com/en/developer-terms), and the YouTube API under the YouTube API Services Terms of Service (https://developers.google.com/youtube/terms/api-services-terms-of-service) and Google's Privacy Policy (https://policies.google.com/privacy), and the TikTok API under the TikTok Developer Terms of Service (https://www.tiktok.com/legal/page/global/tik-tok-developer-terms-of-service/en). We only request the permissions we need, we do not transfer platform data to third parties, and we delete it on request as described above. This policy is public and not geo-blocked.
YouTube. HopIn Publisher uses YouTube API Services only with YouTube channels our company owns. It uploads our own videos, reads the public top-level comments on videos we uploaded so we can answer them, posts a reply only after a person on our team approves it, and reads the statistics of our own channel and videos (subscriber, view and video counts, and per-video views, likes and comment counts, with titles and publish dates) to measure how our posts perform. For each comment we store its ID, the ID of our video, the comment text, its publish time, its like count, and our own triage status and draft reply. We do not store commenters' names, channel IDs, profile images or any other account data; the commenter's channel ID is compared in memory only, to skip our own channel's comments. Comment data is deleted after 90 days as described above, or sooner on request. Anyone who uses the tool agrees to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google's Privacy Policy (https://policies.google.com/privacy) applies. A channel owner can revoke the tool's access at any time in the Google security settings page (https://myaccount.google.com/permissions); we then delete the stored tokens and stop reading that channel.
TikTok. HopIn Publisher uses the TikTok Login Kit and Content Posting API only to send our own videos and photos to our own TikTok accounts, as drafts or as posts. It reads only our own account's basic profile (its id and name) to know which account it posts to. It does not read, store or share data about TikTok viewers. An account owner can remove the tool's access at any time in TikTok under Settings and privacy, Security, Manage app permissions.
Changes
We will update this page and its date when the tool changes what it reads or stores.