Privacy Policy
The short version
- We collect what we need to publish your posts, show you their results and run your account. Nothing more.
- We never see or store your social media passwords. Access keys are encrypted and deleted when you disconnect.
- We do not sell your data, do not use it for advertising and do not use your content or your social data to train AI models.
- You can export or delete your data at any time. See Data deletion.
- Who we are
- What we collect
- How we use it
- Social networks
- Who we share with
- How long we keep it
- Your rights
1. Who we are
hov.social is operated by KUTIA SH.P.K., registered in the Republic of Kosovo under unique identification number 810827727, at St. C, Sima Com Complex, Building B, No. 7, 10000 Pristina, Kosovo (“hov”, “we”). For any privacy question, write to [email protected].
Controller or processor. We are the controller for your account, billing and early access data. For payments, Paddle.com acts as our reseller and Merchant of Record and is the controller of the payment data it collects at checkout, under its own privacy policy. For the content inside a workspace (posts, media, captions, comments, approval decisions and the names and emails of client approvers), the workspace owner decides what goes in and why, so we process it on their behalf as a processor. A data processing agreement is available on request.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Early access list | Email, the role you picked (agency, company, creator), sign-up time | You, on hov.social |
| Account | Name, email, password (stored only as a hash), Google account ID if you sign in with Google, two-factor settings, language, time zone | You |
| Workspace content | Posts, media files, captions, schedules, comments, reminders, approval decisions | You, your team, your import files, the API or an AI assistant you connect |
| Client approvers | Name, email, decision, time, IP address and device of each approval | The workspace that invited them, and the approver |
| Connected social accounts | Access keys, account or page ID, name, handle, profile picture, list of pages you manage, IDs and links of published posts, post metrics and follower counts | TikTok, Instagram, Facebook and LinkedIn, after you connect them |
| Billing | Company name, billing email, VAT number, invoices, plan. Card details go directly to Paddle.com, our reseller and Merchant of Record; we never see the full number | You and Paddle |
| Usage and devices | IP address, browser, app version, push notification token, log of actions in the app | Your browser or phone |
Cookies. hov.social and the app use only the cookies needed to keep you logged in and secure. We use no advertising or cross-site tracking cookies. If we ever add analytics that need consent, we will ask first.
3. How we use it, and why we are allowed to
| Purpose | Legal basis |
|---|---|
| Run your account and workspace, publish what you scheduled, show results, send the reminders you chose | Contract with you |
| Keep hov secure, prevent abuse, fix errors, keep an audit log | Our legitimate interest in a safe service |
| Email you about early access and the launch | Your consent, which you can withdraw with one click or by email |
| Send important service messages (security, billing, changes to these terms) | Contract and legal obligation |
| Keep invoices and accounting records | Legal obligation |
4. Data from social networks
When you connect an account, you log in on the network’s own page and choose what hov may do. We use the official APIs of TikTok, Meta (Instagram and Facebook) and LinkedIn, and only to:
- publish the posts you or your team scheduled and approved, at the time you set;
- show which accounts and pages you can publish to;
- read the results of posts published through hov, and your follower counts, to show you recaps.
We do not read your private messages, do not post anything you did not schedule, and do not share this data with anyone except to deliver the service to your workspace. Your use of each network stays subject to its own terms and privacy policy: TikTok, Meta, LinkedIn.
Google sign-in. If you sign in with Google we receive only your name, email and profile picture. hov’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
AI assistants (MCP). If you connect ChatGPT, Claude or another assistant to hov, that assistant receives the hov data it asks for on your behalf, only for the brands you allowed. The assistant’s provider handles that data under its own terms. You can disconnect it at any time in the app.
5. Who we share it with
We never sell personal data. We share it only with:
- Service providers that run hov for us, under written contracts: cloud hosting and storage in the European Union, email delivery, push notifications and error monitoring. The current list is available from [email protected].
- Paddle.com, our reseller and Merchant of Record, which processes payments, invoices, taxes and refunds for hov orders.
- Social networks, when hov publishes or reads results for you.
- People in your workspace and the client approvers your workspace invites, who see the posts they are asked to approve.
- Authorities, when the law requires it.
- A buyer or successor of hov, if the business is sold, under this same policy.
Transfers outside Kosovo and the EU. We host in the EU. When a provider processes data elsewhere, we use safeguards required by law, such as the European Commission’s standard contractual clauses.
6. How long we keep it
| Data | Kept until |
|---|---|
| Early access list | You unsubscribe, or 12 months after launch if you never create an account |
| Social network access keys | You disconnect the channel (deleted at once) or delete the workspace |
| Workspace content and metrics | The workspace is deleted, plus 30 days so it can be restored if deleted by mistake |
| Account | You delete it, plus 30 days |
| Backups | Up to 14 days after the data is deleted from the live system |
| Invoices and accounting records | As long as tax law requires |
| Security logs | 12 months |
7. How we protect it
Access keys are encrypted with keys kept outside our database and are never sent to your browser or phone. Passwords are hashed. Every request is limited to your workspace. Media is stored privately and served through links that expire. Two-factor login is available to everyone. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
8. Your rights
Under the Law No. 06/L-082 on Protection of Personal Data of the Republic of Kosovo, and the EU General Data Protection Regulation where it applies, you can ask us to:
- show you the data we hold about you, and give you a copy in a common format;
- correct it;
- delete it;
- limit or object to how we use it;
- withdraw consent at any time, without affecting what happened before.
Write to [email protected]. We answer within 30 days. If the data belongs to a workspace, we pass your request to the workspace owner and help them answer it. You can also complain to the Information and Privacy Agency of Kosovo or, in the EU, to your local data protection authority.
9. Children
hov is a business tool for people aged 18 and over. We do not knowingly collect data from children.
10. Changes
When we change this policy we update the date at the top. If the change matters, we tell account owners by email at least 14 days before it applies.