Draft. This describes accurately what the software does, because it was written alongside the code. It has not been checked by a solicitor, and the company details below are placeholders. Both need fixing before this is relied on.
Hephus is operated by [COMPANY NAME], a company registered in England and Wales ([COMPANY NUMBER]), at [REGISTERED ADDRESS]. For anything about your data, write to privacy@hephus.com.
This matters, because Hephus sits in the middle of other people's businesses.
When you sign up as a seller, we are the data controller for your account.
When you buy something from a seller's store, that seller is the controller of your data and Hephus is their processor. We hold it on their behalf, under their instructions. Requests about a purchase go to the seller in the first instance, though we will help.
Card details are handled entirely by Stripe and never reach Hephus.
When a seller connects their Instagram professional account, Meta sends us the comments and messages on that account so the seller's keyword automations can work. We read the text to look for the seller's keywords, send the reply the seller wrote, and record what happened so the seller has a log. We do not use this content to train anything, and we do not share it with other sellers or with anyone else.
If you remove Hephus from your Instagram settings, Meta tells us and we delete the stored token immediately. See data deletion for removing the rest.
When a seller asks an agent to draft something, or asks for a page to be written, the relevant context is sent to Anthropic's API to produce the text. Anthropic does not train on data sent through their API. Sellers choose what material an agent is given.
Supabase (database and file storage, hosted in the EU), Vercel (hosting), Stripe (payments), Brevo (email), Anthropic (AI features), and Meta (only for the Instagram features a seller has connected). Each holds only what it needs to do its job.
Seller accounts and their business records are kept while the account is open, and for six years after closure where tax law requires it. Instagram event logs are kept for 12 months. Anything else is deleted on request.
Under UK GDPR you can ask for a copy of your data, ask for it to be corrected or deleted, object to processing, or complain to the Information Commissioner's Office at ico.org.uk. Email privacy@hephus.com and we will answer within a month.
If this changes in a way that affects you, we will email you rather than quietly editing the page.
Last updated: [DATE]