Privacy Policy

Data About Our Customers

When someone signs up we store their email address and password hash for sign-in, the name of their workspace, who else they invited to it, their campaign settings, and, once billing is live, the subscription record and customer id held by our payment provider. We never store card numbers.

Data About Connected Accounts

For each connected Instagram account or Facebook Page we store the platform id, the handle or Page name, and an access token issued by Meta. Tokens are encrypted at rest with AES-256-GCM and are used only to do what the connected account has authorised: read comments on its own posts, and send messages from it. We never ask for, and cannot use, an Instagram or Facebook password.

For a connected TikTok account we store the open id, the display name and avatar url TikTok returns, and the access and refresh tokens, encrypted the same way. They are used only to show which account is connected, to publish the videos that account’s owner scheduled in our editor, with the visibility and settings the owner chose for each video, and to read the view, like, comment and share counts of videos published through AttentionHub so the owner can see how they did. Disconnecting the account deletes the tokens and the profile data straight away.

YouTube API Services

AttentionHub uses YouTube API Services to publish videos to YouTube channels that their owners connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.

When you connect a channel we ask Google for two permissions: uploading videos (youtube.upload) and reading your own channel (youtube.readonly). We store the channel id, the channel title and handle, and the access and refresh tokens Google issues, encrypted with AES-256-GCM. They are used only to show which channel is connected, to upload the videos you scheduled in our editor with the title, visibility and made-for-kids setting you chose for each one, and to read the view, like and comment counts of videos published through AttentionHub so you can see how they did. We do not read, change or delete any other video, comment or setting on your channel, and we do not share YouTube data with anyone except the providers listed below that run the service.

AttentionHub does not place cookies or collect device information on YouTube or through YouTube API Services. The only cookies we set are the ones that keep you signed in to AttentionHub itself.

You can remove AttentionHub’s access at any time in two ways: remove the channel on the Accounts page, which deletes the stored tokens and channel data straight away, or revoke access in your Google account security settings. Stored YouTube data is also deleted within 30 days of a request through the Data Deletion page, and refreshed or deleted at least every 30 days as YouTube’s policies require.

Data About People Who Interact

When somebody comments on a connected post or sends the account a message, we store what is needed to answer them and to show the account owner what happened:

• their platform-scoped id and public display name, the comment or message id, and the text of a comment that matched a keyword
• a record that they sent the account a message, with the time. This is what lets a campaign follow up differently depending on whether somebody wrote back. The text of an ordinary direct message is not stored.
• whether they opened a tracked link, and which person the click belonged to, so a follow-up can be sent only to those who did or did not open it. Clicks also record a one-way hash of the IP address, the browser user agent, and the referring page.
• whether they follow the account, when Instagram discloses it. This is read at the moment they tap a button and is not stored.
• the delivery log of every message we sent them, and its outcome
• an email address or phone number, only when a campaign asked for one and the person chose to reply with it. It is stored as a contact for the account owner and, if the owner set one up, sent to the owner’s own tool (for example a spreadsheet or email service) through a webhook address the owner provided.

This data belongs to the account owner who runs the campaign. They decide what is collected and for how long; we process it on their instructions to run the service.

What We Do Not Do

AttentionHub does not scrape Instagram, Facebook, TikTok or YouTube, does not use browser automation, and does not log in as anybody. Every action goes through the official APIs of Meta, TikTok and YouTube, under the permissions the account owner granted. We never post for an account whose owner has not signed in, and we do not repost other people’s content. We do not sell data, and we do not use it to train anything.

Who Else Processes It

Running the service means the following providers handle data on our behalf: Vercel (hosting, file storage and scheduled jobs), Supabase (database), and Meta, TikTok and Google (YouTube) (the platforms the messages and posts are sent through). Each processes data only as needed to run the service. When an account owner connects their own webhook, contact details are also sent to the service behind that webhook, which the owner chose and is responsible for.

Requests From Public Authorities

If a government body, court or other public authority asks us for user data, we review whether the request is lawful before we answer it, and we challenge it where we believe it is not. We disclose only the minimum information the request actually requires, never more. We keep a written record of each request, what we disclosed, the legal reasoning and who was involved.

Keeping And Deleting

Disconnecting an account from Settings removes its stored tokens and stops its campaigns immediately. Deleting a campaign deletes its scheduled messages, tracked links and click records with it. To have an entire account and everything in it deleted, use the Data Deletion page linked in the footer; we action those requests within 30 days.

Your Rights

If you are in the EU or the UK you have the right to ask what we hold about you, to have it corrected or deleted, to receive a copy, and to object to how it is used. If you commented on or messaged a business that uses AttentionHub, that business decides what happens to your data, so the fastest route is to contact them directly. Contact us and we will pass the request on and help.

Who Is Responsible For Your Data

AttentionHub is operated by Nameless s. r. o., a company registered in Slovakia, and that company is the data controller for everything described on this page.

Nameless s. r. o.
Pribinova 21/11, 901 01 Malacky, Slovakia
Company registration number (IČO): 56 597 568

Contact

For anything about privacy, or to make a request about your data, write to attentionacademy.sk@gmail.com.