Privacy policy

1. Who we are and how to reach us

High On Innovation operates HOI Social Media Hub at sma.highoninnovation.com. For any privacy question, request or complaint, email info@highoninnovation.com or highoninnovation.india@gmail.com. We reply within 2 business days.

The Service is a business tool: your organisation (the "Customer") invites you as a user. Where the Customer decides what content to publish and which accounts to connect, the Customer is the controller of that data and we process it on their instructions.

2. What we collect

We do not collect payment card details in the Service, and we never ask for or store your Google, Meta or LinkedIn passwords — connection always happens on those companies' own sign-in pages.

3. How we use it

• To provide the Service: show your accounts, import your posts and their statistics, publish the content you approve at the time you choose, bring comments into your inbox, and build the reports and audience pages.
• To help you write and decide: AI features draft captions, suggest replies to comments, predict how a post may perform, and explain results. These act only on the content and metrics of your own accounts.
• To keep the Service secure and reliable: authentication, permission checks, audit logs, abuse and error monitoring.
• To support you: answer requests you send us.

We do not sell personal data, do not use your data for advertising, and do not use content or data from your connected accounts to train machine-learning models. We do not build profiles of your followers or viewers — audience data is only ever the aggregate breakdowns the platforms themselves provide.

4. YouTube API Services — specific disclosures

HOI Social Media Hub uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

What we access and why (each is a Google permission you see and approve on the consent screen):

• View your YouTube account — read the channel, its videos and their statistics for reports.
• Manage your YouTube videos — upload the Shorts you approve, on your schedule, to your channel. We upload nothing you have not approved and never delete videos.
• See, edit and permanently delete your videos, ratings, comments and captions — this is Google's label for the permission that lets us read comments on your videos and post the replies you approve. We do not delete videos, ratings or captions, and we do not edit captions.
• View your YouTube Analytics reports — show your viewer demographics (age group, gender, country) on the Audience page.

What we store from YouTube: the channel's identity and encrypted tokens; your videos' titles, descriptions, thumbnails, publish dates and statistics; comments on your videos and replies sent through the Service; aggregate viewer demographics. This data is shown only to users of your workspace.

Refresh and deletion: while a channel is connected we refresh its data automatically (typically every 6–12 hours) so nothing stored is older than 30 days. When you disconnect a channel, its tokens and the videos, statistics, comments and audience data we imported from YouTube are deleted immediately. Posts you created inside the Service remain your content in your workspace until you delete them.

Revoking access: at any time, from the Service (Connect Accounts → the channel → Disconnect) or from Google directly at myaccount.google.com/permissions. Revoking at Google stops all access instantly; the Service then marks the channel as disconnected on its next check.

Limited Use: HOI Social Media Hub's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the user-facing features described here; we do not transfer it to others except as necessary to provide those features, to comply with law, or as part of a merger or acquisition with prior notice; we do not use it for advertising; and humans do not read it except with your permission, for security purposes, to comply with law, or in aggregated/anonymised form for internal operations.

5. Instagram, Facebook, Threads and LinkedIn

The same principles apply to accounts you connect from Meta (Instagram, Facebook, Threads) and LinkedIn: we access only what their permissions allow, only for your own accounts, and only to provide the features you use. Their handling of your data is governed by their own policies. Engagement features are suggest-only — the Service never likes, follows or comments on your behalf without an explicit action by a user of your workspace.

6. Who we share data with (sub-processors)

We share data only with providers that help us run the Service, under contracts that limit them to processing on our instructions:

• Hosting and database — cloud infrastructure and a managed PostgreSQL database where the Service and its data run.
• AI model providers (for example Groq, Google Gemini, OpenRouter) — receive the specific text you ask the AI to work on (a caption to draft, a comment to suggest a reply for, metrics to summarise) for the duration of the request. We do not send them your credentials or tokens, and we do not use their services to train models on your data.
• Email delivery — for password resets and notifications you enable.
• The social platforms themselves — when you publish, reply or schedule, that content is sent to the platform you chose.

We may disclose data if required by law or to protect the rights, safety and security of users and the Service. If High On Innovation is involved in a merger or acquisition, we will notify you before your data becomes subject to a different privacy policy.

7. How long we keep data

• Connected-account tokens — until you disconnect the account or revoke access, then deleted immediately.
• Data imported from connected platforms — refreshed while connected; deleted when the account is disconnected (YouTube) or on request; deleted with your workspace.
• Content you create — until you delete it or your organisation's workspace is closed.
• Account information — until you delete your account (Settings → Privacy & data → Delete my account) or your organisation removes you.
• Audit logs — kept for security and accountability; append-only and tamper-evident, they record actions (and the acting user's email), not content, and are retained after account deletion for that purpose only.

8. Security

Platform tokens are encrypted at rest (AES-256), passwords are hashed, all traffic uses HTTPS, access is role-based per organisation and workspace, and an append-only audit log records sensitive actions. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as the law requires.

9. Your rights and choices

• Export everything we hold about you: Settings → Privacy & data → Export my data (JSON).
• Delete your account and personal data: Settings → Privacy & data → Delete my account, or see Data deletion.
• Disconnect any social account at any time, or revoke access at the platform.
• Analytics consent can be withdrawn at any time; analytics is off unless you accept.
• Depending on where you live you may also have rights to access, correct, restrict or object to processing, and to complain to a supervisory authority. Email us and we will help.

10. Children

The Service is for businesses and creators and is not directed at children under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We will post any changes on this page and update the date at the top. For material changes we will also notify you in the Service or by email. Continued use after a change means you accept the updated policy.