Privacy policy

We collect information you provide directly, information generated while you use the service, and information from third parties you choose to connect.

If you use tracked links in the buttons of your automated Instagram messages, every tap on one of those links goes through a Hazmeviral redirect before reaching the destination. We record the date and time of the click, the browser (user agent), the referring page (referrer) and an irreversible keyed hash of the IP address. We never store the plain IP address.

This data is only used to show you how many sends and clicks each link has, and it is deleted automatically after 180 days. Deleting a brand or an account also deletes its links and the associated clicks.

If you create an automation triggered by replies to your Instagram stories, we read the text of each reply only to compare it with your keywords and decide whether to send the message. That text is not stored.

We also read the identifier of the story someone replied to, only to choose the matching automation (for example, when an automation replies only to certain stories). That identifier is not stored either. We do not show or keep in your dashboard the story that was replied to or the identifier of the person who replied. We only record the outcome of the send (sent, pending, failed or cancelled) for your statistics.

Brands that use Hazmeviral can publish downloadable resources (guides, templates, files) on their own page. To download one, we ask for your email, your WhatsApp or both, depending on what the brand chose.

We store that contact together with the campaign parameters of the link you arrived from (utm), the date and the number of downloads, and show it to the brand that published the resource, which can export it. We use your IP address only to limit abuse and, when enabled, for the Cloudflare Turnstile security check.

Neither Hazmeviral nor the brand sends you anything automatically for leaving your contact. If the brand decides to write to you later, it does so on its own and under its own responsibility. To ask for your data to be deleted, write to us at the address at the end of this page.

We process the data above for the following purposes:

We do not sell your personal data. We share it only with the providers that make the service possible, and only to the extent needed for them to do their job.

Hazmeviral uses a Bring Your Own Key model for AI. When you save an API key, your prompts and the context we attach (project brief, prior reels, hooks, metrics, pillars) are sent to the provider you chose under their terms and privacy policy. We do not use your content to train Hazmeviral models or any third party's general-purpose model.

Each provider has its own data handling policy. Review the policies of the AI providers and social networks you connect, since their handling of your content is outside our control.

We keep your account data while your account is active. If you delete your account or a specific brand, we remove the associated personal data from our active systems within 30 days. Limited records may be retained longer when required to comply with law, resolve disputes, or enforce our agreements.

Backups containing your data are rotated and overwritten regularly and are not restored except in disaster recovery scenarios.

Depending on where you live (EU, UK, California, and other jurisdictions), you may have the right to:

We use industry-standard measures to protect your data: encrypted transport (HTTPS), encrypted storage of secrets, scoped access controls, and regular review of dependencies. No system is completely secure. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by law.

Hazmeviral is operated using cloud infrastructure that may store and process data in countries outside your own (including the United States). When data is transferred internationally, we rely on the safeguards required by the applicable law, such as standard contractual clauses.

Hazmeviral is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. For material changes we will give you reasonable notice (for example, an email or an in-app banner). Continued use of the service after a change means you accept the updated policy.