Privacy Policy

1. Introduction

This Privacy Policy explains how Hudhud (hudhd.com) ("we", "us") collects, uses, and protects personal data when you use the Hudhud platform at https://www.hudhd.com. It also explains the rights you have over your data.

2. Data we collect

• Account data: your name, email address, phone number (when provided), password hash (we never store plain passwords), and role.
• Connected-account data: for the Facebook Pages and Instagram (and Threads) accounts YOU connect: page/account names, IDs, and access tokens issued by the platform's official authorization.
• Customer conversations: messages and comments your customers send on your connected accounts, and contact details customers voluntarily share (such as a phone number or email).
• Usage data: records of actions performed through the Service (for example, a message sent or a post published), kept for your operations log and service analytics.

3. How we use data

• To deliver the Service: replying to your customers within the platform messaging rules, organizing leads, publishing content you schedule, and showing performance analytics for your own accounts.
• To secure accounts and prevent abuse.
• We do not sell personal data, and we do not use your data or your customers' data to advertise to third parties.

4. AI processing

Automated replies and content drafts are generated with AI models, including Google's Gemini API. When the AI drafts a reply to one of your customers, the conversation text and the knowledge documents you upload may be processed by the AI provider solely to generate that output. You can pause AI replies per conversation at any time (Human Takeover).

5. Legal bases (EEA/UK visitors)

Where GDPR applies: we process account data to perform our contract with you (Art. 6(1)(b)); service and security logs on the basis of our legitimate interests (Art. 6(1)(f)); and any optional analytics on the basis of your consent (Art. 6(1)(a)), which you can withdraw at any time.

6. Sharing and service providers

We share data only with the providers needed to run the Service: Supabase (database hosting), Vercel (application hosting), Google (Gemini AI and Google Sign-In), and the social platforms themselves (Meta / Threads) to deliver actions on your connected accounts. Each provider processes data under its own terms; we do not share data for their independent marketing.

7. Retention

Account and conversation data are kept while your account is active. When you delete your account (see section 10), we delete the associated personal data, except records we must keep for legal compliance or security audits.

8. Your rights

You may request access, correction, export, or deletion of your personal data, and object to or restrict certain processing. Use the Data Deletion page or email us at support@hudhd.com. We respond within a reasonable timeframe and in any case within the period required by applicable law.

9. Cookies & Product Analytics

We use a small number of strictly necessary cookies: a signed session cookie (to keep you logged in) and a language preference cookie. We may use privacy-respecting internal traffic statistics to understand aggregate usage; when third-party analytics (such as Google Analytics) are enabled, they load only after you consent, where consent is required.

When enabled, we also use PostHog (hosted in the European Union) to understand how the Service is used and to improve the user experience: product analytics, aggregate web traffic, and — in anonymized form — session replays in which input fields are masked. Analytics is disabled by default and only activated by us; it does not include advertising or cross-site tracking, and you can opt out at any time by contacting support@hudhd.com.

10. Data deletion

You can delete your account and associated data at any time via the Data Deletion page. Platform-initiated deletion requests (through Meta's Data Deletion Callback) are honored and confirmed with a reference code.

11. Security

Passwords are stored as PBKDF2-HMAC-SHA256 hashes (never in plain text). Sessions use signed, HTTP-only cookies. Data is stored in PostgreSQL with row-level security, hosted by Supabase. Access to production data is restricted.

12. Children

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect their personal data.

13. Changes to this policy

We may update this policy from time to time and will post the updated version here with a new version date.

14. Contact

Data protection questions: support@hudhd.com.