Privacy Policy
Last updated:
This Privacy Policy explains how TRIPLE A SOLUTIONS S.R.L. (IDNO: 1026605000406), a company registered in the Republic of Moldova with its registered office at s. Ciuciuleni, rn. Hîncești ("Company," "we," "us," or "our"), collects, uses, stores, and protects your personal information when you use the HookBandit website and services at hookbandit.com (the "Service").
By using the Service, you acknowledge that you have read and understood this Privacy Policy. This policy should be read alongside our Terms and Conditions.
If you have any questions about this Privacy Policy or our data practices, please contact us at contact@hookbandit.com.
1. Information We Collect
We collect the following categories of information when you use HookBandit:
Account Information (via Google OAuth)
When you sign up using Google OAuth, we receive and store your name, email address, and profile picture from your Google account. We do not receive or store your Google password.
User-Provided Information
- Brand information: Brand name and brand description you provide to personalize your reports
- Instagram usernames: The Instagram profile usernames you add for tracking and analysis
- Instagram post URLs: Individual post links you submit for single-post analysis
- Report email: The email address where you want to receive report notifications (defaults to your Google email)
Payment Information
When you subscribe to a paid plan, payment is processed by MAIB e-commerce. We receive confirmation of payment status and basic billing details needed for invoicing. Your full credit card or bank details are handled directly by MAIB and are never stored on our servers.
Automatically Collected Information
We collect minimal automatic data necessary to operate the Service:
- Authentication session data: Cookies strictly necessary to keep you logged in
- Server logs: Basic request logs (IP address, timestamp, request URL) generated by our infrastructure providers as part of standard operations
We do not use analytics tools, tracking pixels, advertising cookies, or any form of behavioral tracking beyond what is strictly necessary to provide the Service.
Information We Do Not Collect
We do not collect or process any special categories of personal data, including health data, biometric data, racial or ethnic origin, political opinions, religious beliefs, or genetic data.
2. How We Collect Information
We collect information through the following methods:
- Directly from you: When you sign up via Google OAuth, configure your brand profile, add Instagram usernames, submit post URLs for analysis, or update your account settings
- From Google: When you authenticate, we receive your name, email, and profile picture from Google's OAuth service
- Automatically: Essential session cookies are set when you log in to maintain your authenticated session
- From public sources: When you request an analysis, we collect publicly available content from the Instagram profiles or posts you specify. This data is about third-party Instagram accounts, not about you personally
3. How We Use Information
We use the information we collect for the following specific purposes:
- Providing the Service: To create and manage your account, process your tracked profiles, scrape publicly available Instagram content, generate AI-powered analysis reports, and deliver them to you
- AI-powered analysis: To send scraped Instagram content to Google Gemini for content analysis, hook analysis, and report generation. Your brand name and description are included in the analysis to personalize insights
- Transactional communications: To send you email notifications when your reports are ready, and to communicate important account-related information via Resend SMTP
- Payment processing: To process subscription payments through MAIB e-commerce and manage your billing status
- Security and fraud prevention: To protect the Service, detect unauthorized access, and prevent abuse
- Legal compliance: To comply with applicable laws, regulations, and legal processes
We do not use your information for:
- Marketing or promotional emails (unless you opt in)
- Behavioral profiling or targeted advertising
- Training or improving AI models — your data is used exclusively to deliver the Service to you
- Selling or renting to third parties for any purpose
4. Legal Basis for Processing
We process your personal data based on the following legal grounds, in compliance with applicable data protection laws including the GDPR:
| Purpose | Legal Basis |
|---|---|
| Providing the Service (account, reports, analysis) | Contract — necessary to perform our agreement with you |
| Google OAuth authentication | Consent — you choose to sign in via Google |
| Transactional emails | Contract — necessary to deliver the service you requested |
| Payment processing | Contract — necessary to fulfill your subscription |
| Security and fraud prevention | Legitimate interest — protecting the Service and its users |
| Legal compliance | Legal obligation — complying with applicable laws |
Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interests at any time by contacting us.
5. Data Sharing & Third Parties
We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.
We share data only with the following service providers ("processors") who assist us in delivering the Service. Each processes data solely on our behalf and in accordance with our instructions:
| Provider | Purpose | Data Processed |
|---|---|---|
| Google Gemini | AI content analysis | Scraped Instagram content, brand context |
| Apify | Instagram data collection | Instagram usernames and post URLs |
| MAIB | Payment processing | Billing and payment details |
| Supabase | Database, authentication, storage | Account data, reports, all stored data |
| Vercel | Website hosting and CDN | Server logs, request data |
| Resend | Email delivery | Email address, notification content |
We may also disclose your information if required to do so by law, in response to a valid legal request (such as a court order or subpoena), or to protect the rights, property, or safety of the Company, our users, or the public.
6. International Data Transfers
As a company registered in the Republic of Moldova, we process data across multiple geographic regions through our service providers:
- Germany: Our reporter microservice runs on Hetzner infrastructure in Germany
- European Union / United States: Supabase, Vercel, and Apify operate infrastructure in both the EU and the US
- United States: Google Gemini and Resend process data in the US
Where your data is transferred outside your country of residence, we ensure that appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
- Our service providers' compliance with recognized data protection frameworks
- Contractual obligations requiring processors to protect your data to standards equivalent to those in the Republic of Moldova and the EU
7. Data Retention
We retain your personal data only for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy:
| Data Type | Retention Period |
|---|---|
| Account data (name, email, profile) | Until you delete your account |
| Brand information, tracked profiles | Until you delete your account |
| Generated reports and analysis | Until you delete your account |
| Raw scraped Instagram data | Automatically deleted immediately after processing |
| Payment records | As required by tax and financial regulations |
| Server logs | As determined by infrastructure providers |
Account deletion. When you delete your account, all your personal data — including reports, tracked profiles, favorites, brand information, and account details — is immediately and permanently deleted. This action is irreversible and data cannot be recovered.
8. Your Rights
Depending on your location and applicable law, you may have the following rights regarding your personal data:
For All Users
- Access: Request a copy of the personal data we hold about you
- Correction: Request that we correct inaccurate or incomplete personal data
- Deletion: Request deletion of your personal data (you can also delete your account directly through account settings)
- Opt-out of communications: Unsubscribe from non-essential emails at any time
For EEA / UK Users (GDPR)
In addition to the rights above, you have the right to:
- Restrict processing: Request that we limit how we use your data in certain circumstances
- Data portability: Receive your personal data in a structured, commonly used, machine-readable format
- Object to processing: Object to processing based on legitimate interests
- Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
- Lodge a complaint: File a complaint with your local Data Protection Authority if you believe your data protection rights have been violated
For California Residents (CCPA/CPRA)
California residents have additional rights under the California Consumer Privacy Act:
- Right to know: Request information about what personal data we collect, use, and disclose
- Right to delete: Request deletion of your personal data
- Right to opt-out of sale: We do not sell your personal data, so this right does not currently apply
- Non-discrimination: We will not discriminate against you for exercising any of your privacy rights
To exercise any of these rights, please contact us at contact@hookbandit.com. We will respond to your request within 30 days, or as required by applicable law. We may ask you to verify your identity before processing your request.
10. Security
We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it:
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
- Authentication security: We use Google OAuth for authentication — we never store your passwords. Session tokens are securely managed
- Database security: Row Level Security (RLS) is enabled on all database tables, ensuring users can only access their own data
- Access controls: Administrative access to systems and data is restricted and protected
- Payment security: Card and banking details are handled directly by MAIB and are never stored on our servers
- Data minimization: We collect only the data necessary to provide the Service. Raw scraped data is automatically deleted after processing
While we implement these safeguards, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data to the best of our ability and promptly addressing any security incidents.
11. Children\u2019s Privacy
The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you are under 16, please do not use the Service or submit any personal data.
If we become aware that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete that information as soon as possible. If you believe a child under 16 has provided us with personal data, please contact us at contact@hookbandit.com.
12. Contact & Rights Requests
For any privacy-related questions, concerns, or to exercise your data rights, please contact us:
TRIPLE A SOLUTIONS S.R.L.
s. Ciuciuleni, rn. Hîncești, Republic of Moldova
IDNO: 1026605000406
Email: contact@hookbandit.com
We aim to respond to all privacy requests within 30 days. If we need additional time, we will notify you of the extension and the reasons for the delay. If you are in the EEA and believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority.
13. Policy Changes
We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the Service itself. When we make changes:
- We will update the "Last updated" date at the top of this page
- For material changes (e.g., new categories of data collection, new third-party sharing, or changes to your rights), we will provide additional notice through the application interface or via email
- Your continued use of the Service after changes are posted constitutes acceptance of the revised Privacy Policy
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.
14. Additional Provisions
No Sale of Personal Data
We do not sell your personal data to any third party. We do not share your personal data with third parties for their own marketing purposes. This applies to all users, regardless of location.
Third-Party Links
The Service may contain links to third-party websites or services (including Instagram, Google, and our payment processor). We are not responsible for the privacy practices, content, or security of these external sites. We encourage you to review the privacy policies of any third-party services you visit.
AI Processing Disclosure
As described in Section 3, we use Google Gemini to analyze Instagram content and generate reports. Content submitted for analysis is processed by Google in accordance with the Google Gemini API Terms of Service. We do not use your data to train, fine-tune, or improve any AI models.
Governing Law
This Privacy Policy is governed by the laws of the Republic of Moldova. For users in the European Economic Area, the provisions of the General Data Protection Regulation (GDPR) apply to the extent they provide greater protection.