Contents
1. Who we are
This platform, "Hioneonly" (the "Platform"), is operated by Hidoly s.r.l., registered office at Via Alessandro Riberi n. 4, 10124 Torino (TO), Italy, VAT no. IT10678120014 (REA TO-1153153) ("we", "us", "our"). We are the data controller for the personal data described in this policy.
You can reach us at areait@hidoly.com.
2. What data we collect
We collect only the data we need to provide the Platform:
- Account data — name, email address and login credentials you use to create and access your account.
- Content you provide — text, images, videos, brand materials and links you upload or create to generate and manage your content.
- Connected-account data — the information described in the "Connected accounts and third-party data" section below, for any channel you choose to connect.
- Usage data — technical logs such as IP address, browser type and actions in the Platform, used to keep the service secure and working.
3. Connected accounts and third-party data
Connecting a third-party channel (such as a social network or business profile) is optional and always started by you. If you connect an account through that platform's official authorization flow, we access a limited set of data strictly to provide the publishing feature:
- Basic profile information — the display name, avatar and account identifier of the account you connect, used only to show which account is connected inside the Platform.
- Publishing permission — used only to publish content you create in the Platform (such as videos, images and posts) to the accounts you connect, with the caption you provide, and only when you choose to publish.
- Access tokens issued by the connected platform, stored securely and used only to perform the actions above on your behalf.
- Content and metrics of the connected account — the posts or videos on that account and their engagement figures, together with aggregate account statistics, shown to you inside the Platform so you can see how your content is performing. What this covers on each channel is described below.
We request only the minimum permissions each platform requires for these features. We do not read your private messages, browse other users' content, collect personal data about the individual people who follow, like or comment on your content, or post anything without your explicit action. Our use and transfer of information received from each platform's APIs adheres to that platform's developer terms and any applicable limited-use requirements.
Facebook and Instagram — if you connect a Facebook Page or an Instagram Business account, we store the name and identifier of that Page or account, the access token that allows us to publish on its behalf, and the app-scoped identifier of the Facebook account that granted the permission, which we use only to act on the removal and deletion requests Meta sends us. So that you can see how your presence is performing without leaving the Platform, we also read the posts published on the connected Page or account — including posts published outside the Platform — with their captions, dates, permalinks and engagement figures (such as likes, comments, shares, reach, impressions and saves), and aggregate account statistics such as follower and post counts and profile views. We do not read your private messages, and we do not collect personal data about the individual people who follow, like or comment. Our use and transfer of information received from the Meta APIs adheres to the Meta Platform Terms and Developer Policies. You can have this data deleted at any time — see Disconnecting accounts and deleting your data below.
TikTok — if you connect a TikTok account, we store its display name, avatar and account identifier, together with the access and refresh tokens needed to publish on your behalf. We use them only to upload and post the videos and images you create in the Platform, with the caption you provide, and only when you ask us to. So that you can see how your content is performing inside the Platform, we also read the videos on the connected account — including videos published outside the Platform — with their captions, dates, links and engagement figures (such as views, likes, comments and shares), and aggregate account statistics such as follower, like and video counts. We do not read your private messages or your drafts. Our use and transfer of information received from the TikTok APIs adheres to the TikTok Developer Terms of Service.
Google reviews — if you connect your Google Business Profile, we read the public reviews left for your business (such as the rating, review text and date) so you can view them inside the Platform, and so we can summarise overall sentiment and recurring themes to help you decide what to highlight in the content you create. We do not modify, delete or reply to your reviews without your explicit action, and we do not access reviews of other businesses. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
4. How and why we use your data
- To create your account and provide the Platform's features.
- To generate content based on the materials and instructions you provide.
- To publish content to the channels you have connected, when you ask us to.
- To read and summarise the public reviews of a Google Business Profile you connect, so you can view them and improve the content you create.
- To keep the service secure, prevent abuse and troubleshoot problems.
- To comply with our legal obligations.
We do not sell your personal data, and we do not use data from your connected accounts for advertising or profiling.
5. Legal basis
Under the EU General Data Protection Regulation (GDPR), we process your data on the basis of:
- Performance of a contract — to deliver the service you signed up for.
- Consent — for connecting third-party accounts such as TikTok; you can withdraw consent at any time by disconnecting the account.
- Legitimate interests — to keep the Platform secure and functioning.
- Legal obligation — where the law requires us to keep certain records.
6. Sharing and third parties
We share data only as needed to run the Platform:
- Channels you connect (e.g. TikTok, Meta, Google Business Profile) — content you choose to publish is sent to those platforms and governed by their own terms and privacy policies.
- AI and infrastructure providers — used to generate content and host the service, acting as our processors under appropriate agreements.
- Authorities — where required by law.
7. Data retention
We keep your data for as long as your account is active. Access tokens for connected channels are kept only while that account is connected and are deleted when you disconnect it or close your account. Logs are kept for a limited period for security and legal purposes.
8. Your rights
Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You can also lodge a complaint with your local data protection authority (in Italy, the Garante per la protezione dei dati personali). To exercise your rights, contact us at areait@hidoly.com.
9. Disconnecting accounts and deleting your data
You are always in control of the accounts you connect:
- Disconnect any connected account at any time from within the Platform; this immediately stops any future publishing and deletes the stored access tokens for that account.
- You can also revoke access from that platform's account settings, under connected apps.
- If you connected Facebook or Instagram, you can request deletion from Facebook itself, under Settings & privacy → Settings → Apps and Websites: remove our app and request deletion of your data. We act on that request automatically and Facebook gives you a link with a confirmation code showing what was removed. The same page, https://dev.hioneonly.com/cancellazione-dati, also explains how to ask at any time.
- To delete your account and associated data entirely, contact us at areait@hidoly.com and we will process your request without undue delay.
10. Security
We use appropriate technical and organisational measures — including encryption in transit, access controls and secure storage of credentials and tokens — to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to address any incidents promptly.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you within the Platform.
12. Contact
For any question about this policy or your data, contact Hidoly s.r.l. at areait@hidoly.com.