Privacy Policy

This Policy explains what personal data Hookye handles, what for, who it is shared with and how you exercise your rights, under Brazil’s General Data Protection Law (Law 13,709/2018, "LGPD"). Controller: [RAZÃO SOCIAL A PREENCHER], CNPJ [CNPJ A PREENCHER], [ENDEREÇO A PREENCHER]. Data protection officer (DPO): contact@usehookye.com.

1. Who is responsible for which data

• Your account data (you, the Hookye user): we are the controller.
• Your contacts’/leads’ data (businesses, profiles and channels you find or add): you are the controller and we are the processor, handling that data only to provide the Service, following your instructions.

2. Data we collect

• Account: name, email, password (stored only as a bcrypt hash, never as text), company name, date and version of your acceptance of the Terms.
• Settings: sales profile, preferences, language and API keys. Keys are encrypted (AES-256-GCM) and never sent to the browser. We don’t ask for or store your email password.
• Welcome questionnaire: what you sell, how you work (alone, agency or studio), prices, offers, goals and costs, and, if you choose to answer, how many clients you have, where you find clients and how you heard about Hookye. The first ones tailor the Service to you; the optional ones help us improve the product and are never shared.
• CRM content: leads, notes, the messages you mark as sent, the replies you paste, projects and financial amounts you record.
• Technical data: session cookie and IP address, used only for security (for example, limiting login attempts).
• Public lead data, fetched when you run a search, only from what is already public:
  • YouTube (YouTube API Services): channel name and link, description, statistics, video titles and contacts published by the creator;
  • Google Maps (Google Maps Platform): the business’s name, address, phone, website, rating and number of reviews;
  • the business’s own website: the email, phone, WhatsApp and social accounts it publishes, and whether the site has video;
  • Instagram and TikTok, fetched by Apify with the User’s own account: name, handle, bio, bio link, number of followers and posts;

3. What we use it for and on what legal basis

• Providing the Service you signed up for: performance of a contract (LGPD art. 7, V).
• Security, fraud and abuse prevention: legitimate interest (art. 7, IX).
• Complying with legal and tax obligations, and keeping access logs for the period required by Brazil’s Internet Civil Framework (Marco Civil da Internet): legal obligation (art. 7, II).
• Optional questionnaire and product improvement: legitimate interest (art. 7, IX), with data you choose to give.
• Public lead data: the User handles this data based on legitimate interest (business-to-business and professional prospecting), limited to what the person or business made public for professional contact, for the purpose of offering a service and always with an opt-out. Data made public by its owner is still protected by the LGPD (art. 7, §§ 3, 4 and 7).

Why legitimate interest applies here (summary of our assessment): the purpose is legitimate and specific (offering a professional service to someone who may need it); we only use data the person or business published to be contacted, with no sensitive data; being contacted is something a business with a public presence reasonably expects; and the impact is low, because Hookye sends nothing by itself, every message is reviewed and sent by a person, the sequence stops after a few follow-ups, anyone who opts out is blocked immediately and the data of people never contacted is deleted within 30 days. The full assessment can be requested from the DPO’s email.

We don’t sell personal data, don’t use your data for advertising and don’t train AI models on it.

4. Who we share it with

• Hosting and database providers, to run the Service.
• Google / YouTube (YouTube API Services), for searches. See the Google Privacy Policy.
• Google Maps Platform, for local business searches, with your key. Same Google Privacy Policy.
• Apify, for Instagram and TikTok searches, with your account. See the Apify Privacy Policy.
• The AI provider you choose (Google Gemini, OpenAI or Anthropic), which receives the lead data needed to write the message, using your key.
• Authorities, when required by law or court order.

Some of these providers are outside Brazil. In those cases, the international transfer follows LGPD art. 33, with providers that offer compatible data protection guarantees.

5. Cookies

We only use essential cookies: one that keeps you logged in, one that remembers your language and one that remembers you saw the cookie notice. We don’t use analytics or advertising cookies, or social media pixels. Details are in the Cookie Policy.

6. How long we keep it

We keep each piece of data only while it is useful, and delete the rest automatically:

• Your account and your CRM: while the account exists. When you delete the account, everything is deleted right away from the main database and disappears from backups within 30 days.
• A lead you never contacted: deleted 30 days after entering the CRM, unless you mark it as a favorite.
• Data from YouTube and Google Maps (subscribers, views, videos, rating, reviews, address): kept for at most 30 days, as those APIs’ terms require. After that it is deleted and only the channel or place ID, the name and the contact remain. You can fetch the data again on the lead, with your key.
• A lead marked as lost: deleted 180 days after the last contact.
• People who asked not to be contacted: the data is deleted within 30 days and only an irreversible hash of the email or profile is kept, so they are never contacted again.
• Search results: deleted within 7 days.
• Clients and ongoing conversations (leads you are talking to, on trial, won or with a project in Finances): kept while you use the Service, because they are your business history. You can delete any lead whenever you want.
• Access logs: 6 months (art. 15 of the Marco Civil da Internet). Tax records: for the period required by law.

7. Security

We use encrypted connections (HTTPS/TLS), encryption of API keys in the database, bcrypt password hashes, login attempt limits, isolation between accounts, browser security headers and minimal internal access to data. No system is 100% secure, but we have an incident response plan. If an incident may bring relevant risk or harm, we notify Brazil’s data protection authority (ANPD) and the affected people within 3 business days (ANPD Resolution CD/ANPD No. 15/2024), saying what happened and what to do.

8. Your rights (LGPD art. 18)

You can confirm whether we handle your data, access it, correct it, take it to another service (portability), ask for anonymization or deletion, find out who we share it with and withdraw consent. In the app itself, under Settings → Your account and your data, you can download everything as JSON and delete the account. For anything else, write to contact@usehookye.com: we reply within 15 days. You can also complain to Brazil’s National Data Protection Authority (ANPD).

9. If you received a message from a Hookye user

The user found you or your business through public data (see section 2), wrote and sent the message from their own accounts and is responsible for it: Hookye doesn’t send messages. Replying "stop" to the email opts you out; if the email has an unsubscribe link, it also lets you opt out or delete your data. If the message came by WhatsApp or social media, or if you want to know where your data came from, write to contact@usehookye.com with your email, phone or profile: we find the record and forward the request to the responsible user, who must fulfil it.

10. Minors

The Service is not intended for people under 18.

11. Changes

If this Policy changes in a relevant way, we tell you by email or in the app before the change takes effect.