Privacy Policy
In short
- We collect what Hypora needs to make your posts: your sign-in email, your shop's details and voice, the products you give us and the posts we make.
- AI services write your posts, so your product details and shop voice are sent to them. Free AI providers may keep what we send.
- We don't sell or share your personal information.
- We may share anonymous statistics built from many shops. They can't identify anyone.
- We use no advertising cookies and no analytics trackers.
- To get a copy of your data or have it deleted, email hyporamarketing@protonmail.com.
Who we are
Hypora is a product of Aethar Tech, a business based in Zimbabwe and run by Selby Mashiki. Aethar Tech ("we", "us") runs Hypora. We are reached by email, at hyporamarketing@protonmail.com.
We decide how your personal data is used, so we are its data controller. South African law calls this the "responsible party".
Our Data Protection Officer answers privacy questions and requests. Email hyporamarketing@protonmail.com.
Hypora is made for small shops and online sellers in Zimbabwe and South Africa, and anyone in the world may use it. This policy covers the Hypora website and app.
What we collect
Your account
Your email address. If you sign in with Google, Google gives our sign-in service (Firebase Authentication) your name, email address and profile photo. We use the email to sign you in and to write to you about your account. We don't show or copy your Google name or photo anywhere else.
We also keep how many ora you have, and when you joined.
If you sign up with a referral code, we store who referred you so we can give both of you your ora.
When you pay, Paynow receives your mobile number to send the payment prompt. Hypora keeps only its last 3 digits, the pack, the amount and the date.
Your shop
Your shop's name, tone of voice, audience, colours, logo and the country you sell in. Your shop's personality: how much emoji to use, local words, words to use or avoid, and a sample of how you write.
Campaigns and posts
The product links you paste, the product photos you upload, any description or trend tie-in you add, and the product details we read from the page you link (such as name, price, description and pictures). We keep the hooks, scripts, captions, hashtags, images and videos we make for you, and what each campaign cost us to make.
Planning and reminders
The times you plan posts for, your time zone, and whether you marked a post as posted. If you turn on reminders, we store a push token for that browser and its user-agent, which names the browser and type of device.
Trends
How many trend post ideas you ask for each day, so we can keep within the daily limit.
Before you sign up
If you start a campaign before you sign up, your browser keeps the draft (the link, photo and description) for up to 24 hours so it can carry on after you sign in. It stays on your device until then.
Technical data
When your browser talks to our server, our hosting providers keep standard logs: IP address, time, the address asked for, and errors. We use them to keep Hypora running and secure.
What we don't collect
We don't take card payments in the app, so we hold no payment details. We don't collect voice recordings or face data. If we ever add a feature that needs them, we will ask you first and update this policy.
How we use data, and why we may
We only use your data for the purposes below. The last column gives the legal basis under the EU and UK GDPR. Under South Africa's POPIA and Zimbabwe's Cyber and Data Protection Act, we rely on the same grounds: your consent, our contract with you, a legal duty, or a legitimate interest that does not override your rights.
| Purpose | Data | Legal basis |
|---|---|---|
| Run your account, and make, store and plan your posts | Account, shop, campaigns, planning | Contract: we need it to give you the service you asked for |
| Send push reminders when a planned post is due | Push token, browser user-agent, planned times | Consent: you turn reminders on, and can turn them off |
| Build anonymous reports | Aggregated, de-identified statistics | Legitimate interests: funding and improving Hypora without identifying anyone |
| Keep Hypora secure, stop abuse and fix errors | Logs, account, usage counters | Legitimate interests, and legal duties where the law requires |
| Meet legal duties, such as answering a lawful order | What the duty needs | Legal obligation |
We don't make decisions about you by automated means that have legal or similarly serious effects. AI writes drafts for you to check; you decide what to post.
How AI writes your posts
To write your posts we send AI services your product details, your description or tie-in, and your shop's voice: name, tone, audience, emoji level, local words, words to use or avoid, and your writing sample. Trend post ideas also send your shop's details, recent products and the trend. These services are OpenRouter, the AI model providers it passes requests to, and Groq.
Some of the models we use are free. Free AI model providers may keep prompts and use them to improve their models. Treat anything you type into Hypora as something an AI provider may see.
Please don't put other people's personal data into product descriptions or your writing sample. That means names, phone numbers, addresses or photos of customers, staff or anyone else.
Images and videos are made on our own server from your photos and the text we write. They are not sent to an AI image service.
Anonymous reports
We may share statistics that are built from many shops and cannot identify a person or a shop. For example: which posting times work best for a product category in a city, or which trends shoppers are searching for.
Before any figure leaves Hypora, we keep to these rules:
- Every figure combines at least 10 shops. Smaller groups are left out or merged.
- Reports carry no names, emails, shop names, links, photos, captions or account IDs.
- We don't try to re-identify anyone from a report, and we don't help others to.
- Anyone who receives a report must agree in their contract not to try to re-identify any person or shop, and not to combine the report with other data to do so.
Data that has been de-identified like this is no longer personal data, so sharing it is not a sale or sharing of your personal information. You can still object to it, as described in "Your rights".
We don't sell your personal information
We don't sell or share your personal information. If we ever want to, we will change this policy first and ask for your separate, opt-in consent. It will be off unless you turn it on.
You can record an opt-out now on Do Not Sell or Share My Personal Information. We keep it, so you stay opted out if this ever changes. We treat a Global Privacy Control signal from your browser the same way.
Data sent to other countries
Our service providers are mostly in the United States, so your data leaves the country you are in. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses, the UK addendum to them, and equivalent terms under POPIA and Zimbabwe's Cyber and Data Protection Act. Ask us for a copy of the relevant safeguards.
Cookies and browser storage
We use no advertising cookies and no analytics or tracking tools.
Your browser stores a few things for Hypora to work:
- Your sign-in session, kept by Firebase Authentication in IndexedDB and local storage.
- The email address you asked for a sign-in link with, until you finish signing in.
- A campaign draft started before sign-up, for up to 24 hours.
- If you turn on reminders, the reminder token for that browser, kept by Firebase Cloud Messaging.
These are needed to provide the service, so we don't ask for consent to them. Clearing your browser's site data removes them and signs you out.
How long we keep data
| Data | How long |
|---|---|
| Account, shop and campaign details | While your account is open, and up to 90 days after you ask us to delete it |
| Uploaded photos and the images and videos we make | Until you delete them, ask us to delete them, or your account is deleted |
| Push reminder tokens | Until the token stops working or you sign out on that browser |
| Server logs | About 30 days |
| Your opt-out record and other choices | While your account is open, and after that only as long as we need to show what you chose |
| Drafts saved in your browser before sign-up | Up to 24 hours, on your device only |
We may keep data longer if the law requires it or to settle a dispute, and only for as long as that lasts.
How we protect data
All traffic uses HTTPS. Our database rules let only you read your shop, campaigns and posts, and let you change only what you are meant to. Photos are uploaded through one-time signed links into your own folder. Secret keys stay on our server. Only people who need access to run Hypora have it.
No system is perfectly safe. If you think your account has been misused, email hyporamarketing@protonmail.com straight away.
Your rights
Wherever you live, you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct data that is wrong;
- delete your data or your account;
- stop or limit some uses, or object to them;
- give you your data in a format you can take elsewhere;
- withdraw a consent you gave, such as reminders.
Email hyporamarketing@protonmail.com from the address on your account. We check who you are before we act, for example by replying to that address. We answer within 30 days, or sooner if your local law sets a shorter limit. Requests are free unless they are clearly unfounded or excessive. Withdrawing consent does not affect what we did before.
Zimbabwe
The Cyber and Data Protection Act [Chapter 12:07] and the Data Protection Regulations, SI 155 of 2024, apply to us. The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is the Data Protection Authority. Hypora is applying for a data controller licence from POTRAZ. Our Data Protection Officer is your contact, at hyporamarketing@protonmail.com. You may complain to POTRAZ at any time.
South Africa
The Protection of Personal Information Act (POPIA) protects you, and also protects information about your business itself. We follow its eight conditions:
- Accountability: we are responsible for following the law.
- Processing limitation: we collect only what we need, lawfully and fairly.
- Purpose specification: we collect data for the clear purposes in this policy.
- Further processing limitation: we don't use it for unrelated purposes.
- Information quality: we keep it accurate, and you can correct it.
- Openness: we tell you what we collect and why, in this policy.
- Security safeguards: we protect it, as described above.
- Data subject participation: you can see, correct and delete your data.
You may complain to the Information Regulator of South Africa (inforegulator.org.za).
EU, EEA and UK
The GDPR and the UK GDPR give you the rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent. The legal basis for each use is in "How we use data, and why we may". You may complain to the data protection supervisory authority where you live or work, such as the ICO in the UK.
We are not established in the EU or the UK. Where Article 27 of the GDPR or of the UK GDPR requires it, we will appoint a representative and name them here.
United States
This part is our notice at collection under the California Consumer Privacy Act as amended by the CPRA, and similar laws in other states.
- Categories we collect: identifiers (email, name), customer records, commercial information (your products, campaigns and posts), internet activity (server logs) and approximate location (your country and time zone). We collect no sensitive personal information.
- Sources: you, Google if you sign in with Google, and the product pages you link.
- Purposes: those in "How we use data, and why we may". Retention: as in "How long we keep data".
- Sale and sharing: we don't sell or share personal information, including for cross-context behavioural advertising, and have not done so in the past 12 months.
You have the right to know, delete and correct your personal information, and to opt out of its sale or sharing. We don't sell or share it, but you can record a standing opt-out on the Do Not Sell or Share My Personal Information page. We honour the Global Privacy Control signal as an opt-out. You may use an authorised agent, and we will check their authority. We will never treat you differently, charge you more or give you a worse service for using your rights. If we turn down a request, you can appeal by replying to our answer; if we still say no, you may contact your state attorney general.
Age limit
Hypora is for people aged 18 or over who run a business. It is not for children, and not for anyone under 13. We don't knowingly collect data from children. If you think a child has given us data, email hyporamarketing@protonmail.com and we will delete it.
Marketing messages
We send direct marketing by email or message only if you agree to it, as POPIA section 69 and other laws require. Every marketing message tells you how to stop them, and stopping is free. Reminders about posts you planned, and messages about your account, are not marketing.
If something goes wrong
If a data breach puts your data at risk, we will contain it, tell POTRAZ within the time limits the regulations set, tell the Information Regulator and other authorities where their laws require, and tell you without undue delay if it is likely to affect you.
Changes to this policy
We will update this policy when Hypora changes. The version and date at the top always show the current one. If a change is material, we will tell you in the app or by email before it takes effect. If a change needs your consent, such as a new kind of sharing, we will ask for it.
Contact and complaints
Aethar Tech, Zimbabwe. Website aethar-tech.web.app. Email our Data Protection Officer at hyporamarketing@protonmail.com.
Please contact us first so we can try to put things right. You can also complain to POTRAZ in Zimbabwe, the Information Regulator in South Africa, your local supervisory authority in the EU, EEA or UK, or your state attorney general in the US.