Privacy Policy

Last Updated: October 2, 2026  ·  Effective Date: May 10, 2025

1. Introduction

Welcome to Hypee ("we," "our," or "us"). Hypee is a creator business platform that helps Indian Instagram creators build media kits, connect with brands, and automate replies to their Instagram comments and DMs (Instagram automation is in limited testing and becomes available to all creators once Meta approves the required permissions). We are committed to protecting your personal information and being transparent about how we use it.

This Privacy Policy explains what data we collect, how we use it, who we share it with, and what rights you have over your data. By using Hypee, you agree to the practices described in this policy.

2. Information We Collect

2.1 Account Information

• Full name
• Email address
• Password (stored encrypted, never in plain text)
• Account type (Creator or Brand)
• Profile picture (optional)

2.2 Instagram Data (via Meta Graph API)

When you connect your Instagram account to Hypee using the "Connect with Instagram" button, we access the Instagram Business Login API on your behalf. You must have a Business or Creator Instagram account to connect. We access the following data:

Profile Information:

• Instagram username and User ID
• Profile picture URL
• Follower count and following count
• Account type (Business or Creator)

For Instagram Automation (only if you turn it on):

Instagram automation lets you reply automatically when people interact with your account. Nothing is processed for automation until you create and activate an automation. When you do, Meta sends us these events for your account in real time (via Meta Webhooks):

• Comments on your posts and reels: the comment, the commenter's Instagram ID and username, and which post it is on
• Messages sent to your account: DMs, replies to your stories, and posts shared with you — the sender's Instagram ID and username and the message text
• Button taps on automated messages we sent for you (for example, "I followed ✅")

We use these events only to run the automations you set up, and to honour opt-outs:

• Comment reply: if a comment on the post you chose (or on any of your posts, if you chose that) contains your keyword, we post your public reply under it and send the commenter one private reply
• DM keyword, story reply and share: if someone DMs you your keyword, replies to your story, or shares your post with you, we reply with the message you wrote, inside Instagram's 24-hour messaging window
• Ask to follow (optional): if you turn it on, we first ask the person to follow you and check with Instagram whether they do, before sending your link. We only check people who messaged you first, and we do not store your follower list
• Opt-out: if someone replies STOP, UNSUBSCRIBE or similar, we record that and never send them an automated message again
• Email and phone, if you ask for them: the answer to the one follow-up question described below, stored against that person's contact record. These belong to the person who gave them to you. You are responsible for how you use them, including under India's Digital Personal Data Protection Act and any other law that applies to you; Hypee stores them on your behalf
• Contacts: when an automation replies to someone, we save a contact record for you — their Instagram username and ID, which automation replied, the keyword they used, when you last reached them and how many times. This is the same information from the events above, kept so you can see who your automations have talked to

You can download your contacts as a spreadsheet. Anyone who opted out is left out of that file entirely, not merely marked in it, so a list you export can never be used to contact someone who asked you to stop. You remain responsible for how you use an exported list, including under applicable data-protection law.

Every automated reply is a response to something the person did first — we never send unsolicited or bulk messages. Each person receives at most one automated reply per 24 hours from your account, plus the one follow-up needed to finish it (such as sending the link after they follow). Every automated DM says it is automated and that replying STOP opts out. You can pause or delete any automation at any time.

If you do not connect Instagram via OAuth, you may optionally enter your username and follower count manually — this self-reported data is not verified by Meta and will be shown with a "Self-reported" label.

2.3 Data You Provide

• Automation messages you write
• Media kit content (bio, rates, past collaborations)
• Notes you add to leads
• Campaign briefs (for brand accounts)

2.4 Usage Data

• Pages you visit on Hypee
• Features you use and how often
• Error logs (for debugging)
• Device type, browser type, operating system
• IP address (used for security, not for tracking)

2.5 Payment Information

When you upgrade to a paid plan, payments are processed by Razorpay. We do not store your payment card details. Razorpay handles all payment data under their own privacy policy and PCI DSS compliance.

3. How We Use Your Information

3.1 To Provide Core Features

Instagram Automation: When you create an active automation, we use your Instagram access token and the comment and message events described in section 2.2 to match your keywords, post your public comment replies, and send the automated DMs you wrote. This is why we request the instagram_business_manage_comments and instagram_business_manage_messages permissions. Automation is in limited testing and becomes available to all creators once Meta approves these permissions; until then, no automated messages are sent from accounts that are not part of the test.

Media Kit Generation: We use your Instagram profile data (followers, bio, profile picture) to auto-populate your media kit.

Opt-out records: When someone replies STOP to an automated message, we keep their Instagram ID and the time they opted out, so that no automation on your account messages them again.

Brand Marketplace: If you opt into the marketplace (default: on), we display your public Instagram stats to brand accounts. You can opt out at any time in Settings.

3.2 To Improve the Platform

• Analyze usage patterns to improve features
• Fix bugs and technical issues
• Develop new features based on usage

3.3 To Communicate with You

• Send transactional emails (account confirmation, password reset)
• Send notification emails (new lead captured, brand inquiry)
• Send weekly performance summary emails (you can opt out)
• Respond to your support requests

3.4 Platform Safety and Dispute Resolution

Hypee is a marketplace, and deals between brands and creators are negotiated in the messages sent on it. So that we can keep that marketplace safe, a small number of authorised Hypee staff can review messages exchanged between users on the platform. We do this only for specific reasons: to investigate a report or complaint, to resolve a dispute about an agreed collaboration or payment, to detect fraud (such as a "brand" demanding a registration fee from a creator), and to act on abuse or harassment.

This is not routine monitoring, and it is not automated profiling. Access is limited to staff who need it, and every time a member of staff opens a conversation, that access is recorded — who opened it, which conversation, and when. Staff cannot send, edit or delete messages in your conversations; messages on Hypee are technically immutable once sent, for us as much as for you.

We use automated signals to decide which conversations a human should look at first — for example, messages that appear to move a payment off the platform or to request an advance fee. Those signals only prioritise a queue; they do not by themselves restrict your account or make any decision about you.

3.5 Legal Compliance

• Comply with Indian law (IT Act 2000, DPDP Act 2023)
• Respond to lawful requests from authorities
• Enforce our Terms of Service
• Protect against fraud and abuse

4. Meta Platform Data — Specific Disclosures

Hypee uses Meta's Instagram Business Login API (Graph API v22.0) to power Instagram connectivity for creators. Below is a full disclosure of the permissions we request and exactly how each is used. We only request permissions that are actively used in the product.

Data Retention

• Instagram access tokens: Stored encrypted using AES-256-GCM. Valid for 60 days. Deleted immediately on disconnect or account deletion.
• Comment and incoming message text: Checked in real time via webhook and NOT saved to our database — only the comment ID is kept, to avoid replying twice.
• Automated message logs: Recipient Instagram ID and username, the message we sent for you, status and timestamp — stored for 12 months, then permanently deleted.
• Opt-out records: Instagram ID and opt-out time — kept for as long as your account exists, so the person is never messaged again.
• Profile data (name, email, avatar, bio, rates): Retained for the life of your account. Deleted within 30 days of account deletion.
• Media kit data (niche, rates, past collabs, template): Retained for the life of your account. Deleted within 30 days of account deletion.
• Campaign data (applications, briefs, brand messages): Retained for 24 months to support dispute resolution, then permanently deleted.
• Analytics data (kit views, lead counts): Aggregated and retained for 12 months, then deleted.
• Payment invoices: Retained for 7 years as required by Indian GST law.

5. Data Sharing

5.1 Service Providers

5.2 Brand Marketplace

If you are a creator and opt into our marketplace, brand accounts can see your Instagram username, follower count, engagement rate, niche categories, collaboration rates, and past brand collaborations. This data is only visible to registered brand accounts, not to the general public.

5.3 Legal Requirements

We may disclose your information if required by Indian law, court order, or government authority. We will notify you where legally permitted.

6. Data Security

• Encryption in transit: All data transmitted over HTTPS/TLS
• Encryption at rest: Database encryption via Supabase
• Token encryption: Instagram access tokens encrypted using AES-256
• Access controls: Row Level Security — users can only access their own data
• No plain-text passwords: Passwords hashed using bcrypt via Supabase Auth

If we discover a data breach that affects your personal information, we will notify you within 72 hours as required by applicable law.

7. Your Rights

7.1 Access Your Data

Request a copy of all personal data we hold about you. Email support@hypee.co.in with subject "Data Access Request."

7.2 Correct Your Data

Update incorrect information directly in your Hypee account settings, or email us.

7.3 Delete Your Data

Go to Settings → Account → Delete Account. When you delete your account, we permanently delete within 30 days: your account and profile, all automations and DM logs, all leads, all media kits, your Instagram connection and stored access token, and all campaign data. We retain invoices for 7 years as required by Indian tax law.

7.4 Revoke Instagram Access

Disconnect anytime from: Hypee Settings → Instagram → Disconnect, or via Instagram: Settings → Apps and Websites → Remove Hypee. When disconnected, we immediately delete your stored access token and stop all automations.

7.5 Meta Data Deletion Request

Email support@hypee.co.in with subject: "Meta Data Deletion Request". We will delete all Instagram data within 30 days and confirm via email.

8. Cookies

We use essential cookies only: a session cookie to keep you logged in, and a theme preference cookie for dark/light mode. We do NOT use advertising cookies, third-party tracking cookies, or analytics cookies.

9. Children's Privacy

Hypee is not intended for users under 18 years of age. We do not knowingly collect data from minors. Contact support@hypee.co.in if you believe a minor has created an account.

10. Changes to This Policy

When we make significant changes, we update the "Last Updated" date, notify you by email if you have an account, and show a notice on the Hypee dashboard. Continued use of Hypee after changes means you accept the updated policy.

11. Contact Us