Privacy policy

Data controller

Hypepen, a French sole proprietorship (EI), SIRET 940 859 457 00019. Contact for any question about your data: contact@hypepen.com.

Hypepen has not appointed a data protection officer: requests are handled directly at this address.

The data processed

Your account: email, name, language, time zone, notification preferences, hashed password or Google login, two-factor authentication settings.

Your X Account: handle, name, photo, bio, X subscription type, follower count, encrypted access tokens, your posts and their statistics (including clicks to your profile and on your links, read through X’s official access), the mentions addressed to you.

What you create in Hypepen: editorial line (your brand), voice, pillars, notebook, projects and their website address, drafts, versions, images, articles, slot settings.

Capture of your projects’ page: when you add a project with its website address, then whenever that address changes and once a month, Hypepen’s server visits its home page and captures it (the top of the page), without going through any third party service. It stays on our servers, shows in My brand and is only used as a visual reference for the illustrations of posts about that project. It is deleted if you remove the address or the project.

Your subscription: plan, period, currency, payment history and invoices. Card data stays with Stripe and is never seen by Hypepen.

Audience measurement: pages viewed and actions on the site (for example a button clicked, a signup step completed, a plan chosen), with the language, country, device and browser type. Never your email, your X handle, text you type or an account identifier. No cookies; the IP address is used to infer the country and is not kept.

Technical data: login logs, IP address (kept as a fingerprint for proof of acceptance and security), browser, logs of tasks and of calls to third party services.

Your exchanges with us: emails sent to support or through the contact form.

Why and on what basis

Providing the Service (analysing your voice, preparing and publishing your posts, sorting your mentions, calculating your statistics and estimates, sending Service emails and notifications): performance of the contract.

Managing the subscription, invoicing and accounting: performance of the contract and legal obligation.

Ensuring security, preventing fraud and abuse, keeping proof of your acceptances: legitimate interest and legal obligation.

Measuring website audience without cookies and improving the Service: legitimate interest.

Sending you Hypepen news, if you ticked the box provided: consent, which you can withdraw at any time with the unsubscribe link or in your settings.

Answering your requests: legitimate interest.

Who receives your data

Only Hypepen and its subprocessors, each for what its role requires: hosting of the app and audience measurement (Contabo, Germany), payment (Stripe), emails (Brevo), the writing providers for drafts and illustrations (depending on the writing model in use), X for reading and publishing on your account, Google if you choose to log in with Google. The full list, with the data sent and where it is processed, is on the Subprocessors page.

If you ask to see a post in Stats (“Show the post”), your browser loads it straight from X, which then receives your IP address and may set its cookies (see the Cookies page).

Your data is never sold, rented or used for advertising.

Hypepen may disclose data to authorities when required by law.

Transfers outside the European Union

Some subprocessors process data in the United States (the writing providers, X, Google, and Stripe for part of its processing). These transfers are covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission’s standard contractual clauses.

Texts sent to the writing providers are not kept by them beyond processing the request, and are never used to train a model.

How long

Account and Content created in Hypepen: as long as your account is active. After the account is deleted, everything is permanently erased within 30 days, except what the law requires us to keep.

Text of posts read from X: 30 days at most, after which only the labels and numbers remain. If you do not subscribe after the free analysis, the text of imported posts is erased 24 hours after the analysis. A post deleted on X is deleted on our side as soon as we detect it.

Text of mentions: 30 days. Successive versions of drafts: 90 days. Text of skipped or failed drafts: emptied after 90 days. Notifications: 180 days. Log of sent emails: 13 months. Login sessions: 30 days at most.

Invoices and accounting records: 10 years (article L123-22 of the French Commercial Code). Proof of acceptance of the Terms: duration of the subscription plus 5 years.

Support access to your account: only if you open it yourself, for 48 hours, revocable at any time.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, to withdraw your consent at any time, and to set instructions for what happens to it after your death.

Much of this is self-service: data export and account deletion in Settings, Data; notification preferences in Settings. For the rest, write to contact@hypepen.com. We answer within one month, which may be extended by two months for a complex request; proof of identity may be requested if in doubt.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr) or the data protection authority of your country.

Automated decisions

Hypepen automatically calculates suggestions (drafts, times, estimates, mention sorting). None of these operations produces legal effects concerning you or significantly affects you: you decide what is published.

Security

Encrypted connections (HTTPS), X tokens encrypted at rest, hashed passwords, two-factor authentication available, limited and logged internal access, images published without metadata.

In case of a data breach presenting a risk to you, the CNIL and, if necessary, you are notified within the time limits set by the GDPR.

Minors

The Service is reserved for people aged 18 or over. Hypepen does not knowingly collect data about minors.

Changes to this policy

This policy may change. The update date is at the top of the page; for any significant change, you are notified by email.