Privacy policy

Who is responsible

Hysa Tech SH.P.K. is the controller for data about our customers (businesses) and visitors to this site.

For data about your business's customers (people who comment or message you), we act on your instructions as a processor. Your business remains the controller.

What we collect

Contact and business details: your name, business name, WhatsApp number, email, address, and the offers and prices you give us.

If you sign in with Google or Apple: your name and email address (and, from Google, your profile picture). We use them only to sign you in and to write to you about your account; we can't see anything else in your Google or Apple account.

The content you send: videos, photos and audio, including the people in them.

Accounts you connect (Instagram, Facebook, TikTok, WhatsApp): access tokens, posts, comments, messages and statistics.

Your Google Business Profile, when you connect it: locations, posts, reviews and replies to them, and statistics (calls, direction requests, website clicks).

What InBoard learns from working with you: the approvals, rejections and changes you make to posts, so future posts are more like you. You can see and change all of it under Business.

Payments are processed by Paddle. We receive your name, email, country and subscription status, never your card number.

This site uses no advertising cookies or trackers. We store one cookie (lang) for the language you picked. Our hosting provider keeps technical logs (IP address, browser) for security.

How we use it

To edit and post your content, draft replies to your customers and send them to you for approval, and for reports, billing, support and security.

Editing uses artificial intelligence. Anthropic's models (Claude) look at frames from your videos, read the transcripts and propose the cuts, captions and replies. Speech recognition and face detection run on our own servers.

We detect faces only to keep text off them. We don't identify anyone and we don't create biometric profiles.

We don't use your content to train AI models, and Anthropic doesn't train models on data sent through its API.

When a photo needs more background or a clean-up, we may send it to Google's image model. The product, food and people are never changed; those parts are put back from the original.

From Google Business Profile we read reviews to draft replies that you approve (the review text is sent to Anthropic for this), and we post updates only with your approval or settings. InBoard's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Messages

InBoard reads Instagram, Facebook Page and TikTok direct messages only after the business owner turns this on under Business. Without that permission we don't read, keep or send any message.

While it is on, we keep a copy of each conversation: the text, links to attachments on the platform, and the name, username and profile picture of the person writing, so the business can read and answer them in InBoard. We send replies only when the business writes or approves them, and only within the time the platform allows.

We don't use customers' messages to train AI models and we don't add them to what InBoard learns about the business. When the business turns messages off or disconnects an account, we delete the copies we kept; the messages stay on Instagram, Facebook and TikTok.

Legal basis

Our contract with you (to provide the service), our legitimate interest (security and improving the service), legal obligations (invoicing), and your consent where it is required.

Who we share it with

Only the providers the service needs, under data protection agreements: Anthropic PBC (AI, USA), Vercel Inc. (website hosting, USA), Paddle.com Market Ltd (payments, UK), Meta Platforms Ireland (WhatsApp, Instagram, Facebook), TikTok (posting and messages), Google LLC (Google Maps, Google Business Profile and image processing) and Supabase Inc. (database and file storage).

When data leaves Albania or the EU, transfers rely on standard contractual clauses or adequacy decisions.

We don't sell data.

How long we keep it

Raw footage: up to 90 days after the Reel is posted or rejected.

Finished Reels and posts: while you're a customer, plus 30 days after you cancel so you can download them.

Tokens for connected accounts: deleted when you disconnect, or within 30 days of cancelling.

Copies of messages: while messages are on; deleted when you turn them off, disconnect the account, or within 30 days of cancelling.

Billing records: as long as tax law requires.

Your rights

You can ask to access, correct, delete, restrict or move your data, object to processing, and withdraw consent at any time.

You can complain to Albania's Commissioner for the Right to Information and Personal Data Protection or, in the EU, to your country's data protection authority.

Security and children

Data is encrypted in transit and access is limited to the people who run InBoard.

InBoard is not for anyone under 16.

Contact and changes

For any request, write to support@hysa-tech.com or WhatsApp +355 69 260 6546. When we change this policy, we publish it here with a new date.