Privacy Policy

Last updated: 14 November 2026

Heyhora (“we”) provides software that lets businesses schedule social media posts and automate replies to comments and messages on Facebook, Instagram and similar channels. This policy explains what personal data we handle and why.

Who is responsible for the data

For the account details of people who sign in to Heyhora, we are the data controller. For the contacts and conversations that a business manages through Heyhora (their followers, commenters and message senders), the business is the controller and we act as its processor, handling that data only on its instructions.

Data we handle

• Account data: name, email address, hashed password or Google sign-in identifier, and the businesses you belong to and your role in each.
• Connected channel data: when you connect a Facebook Page or Instagram account, the access token Meta gives us, the account’s name and ID, and the permissions you granted.
• Contact and conversation data: for people who comment on or message a connected account: their platform ID and display name, the content of the comment or message, timestamps, opt-in and opt-out records, and the replies sent.
• Content you create: posts, drafts, approvals and automation settings.
• Technical data: logs of requests and security events, used to keep the service running and safe.

How we use it

• To provide the service: publish scheduled posts, detect keywords in comments, send replies, and show conversations to your team.
• To secure accounts, prevent abuse and fix problems.
• To send service emails such as verification, password reset and invitations.
• To meet legal obligations.

We do not sell personal data. We do not use data from Meta platforms to build advertising profiles or for any purpose other than providing the features you use.

Data from Meta platforms

We access Facebook and Instagram data only through the permissions you approve when connecting an account, and only to run the features you set up. You can revoke access at any time in your Facebook or Instagram settings, or by disconnecting the channel in Heyhora. Access tokens are encrypted at rest and are not shown in the interface or written to logs.

Who we share it with

We use service providers to run Heyhora: cloud hosting and database providers, an email delivery provider, and the social platforms you connect (Meta). They process data only to provide their services to us. We may disclose data if the law requires it.

Where it is stored and how long

Data is stored in cloud infrastructure in Singapore. We keep account and business data while the account is active. When a business or account is deleted, or when you ask us to delete data, we remove it as described on our data deletion page. Raw webhook events received from Meta are deleted after 7 days. When data is deleted, records of consent and opt-out and our security log are kept for 12 months with personal identifiers removed, then deleted. Billing records may be kept for as long as the law requires.

Security

Each business’s data is separated from every other business’s at the database level. Connections use encryption in transit, passwords are hashed, and access to production systems is restricted. No system is perfectly secure, and we will notify affected customers of a breach as the law requires.

Your rights

You can ask to access, correct or delete your personal data, or object to how it is handled. If your data is in Heyhora because you commented on or messaged a business, contact that business first, or contact us and we will pass the request on or act on it. Email [email protected].

Children

Heyhora is not intended for people under 18, and we do not knowingly collect their data for our own purposes.

Changes

If we change this policy in a material way we will update the date above and, for account holders, notify you by email.

Contact

Questions about this policy: [email protected].