Privacy Policy

HYDP LTD (company number 13407890), trading as HYDP, operates our website and Team Hub. Its registered office is 71–75 Shelton Street, London, Greater London, United Kingdom, WC2H 9JQ. HYDP LLC operates Luna’s Meta integration, as described separately below; its address is 447 Broadway, Floor 2, New York, NY 10013, United States. Contact hello@hydp.co.uk for privacy questions and requests about either service.

This notice covers our website, reports, enquiries and HYDP Team Hub, including authorised agents and connected platform features, and the Luna Meta review pilot described below. When we process information solely on a client’s instructions, the client’s privacy notice and our agreement with them also apply.

Information you provide: your name, work email, company, job title, phone number, project requirements, budget, timing, messages, report requests and marketing preferences. We also hold business contacts, deal records, follow-up tasks, correspondence and notes supplied by authorised team members, imported from our existing CRM, or recorded by authorised agents.

Business contact information may come from your employer, professional introductions, public business sources or a service you use to contact us. We distinguish inbound enquiries, report requests, existing relationships and outbound outreach in the CRM. A public profile or an interaction with a post does not by itself mean you have subscribed to marketing.

Team access: Google sign-in supplies identity information such as name, email address, account identifier and profile image where provided. We use it to authenticate invited team members. Google sign-in alone does not give us access to Gmail, Drive, YouTube or advertising accounts.

Technical information: hosting and security services process information such as IP addresses, browser details, request times and error diagnostics. With analytics permission, we also record page visits, referring domains and campaign attribution.

Connected features are available only where implemented, enabled and approved by the relevant platform. A platform being named here does not mean it is already connected, or that we can access every account or permission. We request only the permissions needed for the feature being connected. The authorisation screen identifies the requested access; the account owner or authorised administrator chooses whether to grant it.

Depending on the enabled integration, authorised data can include account, Page, organisation, channel and advertising-account identifiers and names; profile information; posts, captions, media references and publishing dates; and performance measures such as impressions, reach, views, engagement, followers, clicks, spend and reported conversions. Access and refresh tokens, where issued, enable the authorised connection without us receiving your platform password.

Meta (Facebook and Instagram), TikTok and LinkedIn: permitted account and content information and performance metrics support management and reporting for authorised business accounts. Comments or other interaction data are accessed only where an enabled feature and approved permission require them. We do not scrape private accounts or obtain unrestricted private messages. LinkedIn member data obtained through Marketing APIs is not used to create sales prospects, enrich CRM contacts or build advertising audiences.

Google services: separately authorised Analytics, Search Console and Ads features support website, search and campaign reporting. YouTube features, where enabled, use YouTube API Services for permitted channel, video and performance information. Account and channel data are shown to the authorising user and authorised representatives, subject to platform restrictions.

Email integration, if separately enabled and authorised, is limited to CRM-originated correspondence and Gmail conversations explicitly labelled “HYDP CRM”. Relevant sender and recipient details, thread identifiers, dates, subjects, message content and reply status can be used to maintain the contact history. Unlabelled personal conversations are not part of this workflow. Team members must not label unrelated or sensitive conversations for CRM use.

We use connected data for the feature you authorise, such as reporting or recording campaign activity. Connecting an account does not itself instruct us to publish content, send messages or spend advertising budget. These actions require an available feature and a separate instruction or explicitly configured workflow.

HYDP LLC is responsible for operating Luna’s connection to Meta. It is currently an internal HYDP review pilot, not a generally available client integration. An authorised account owner connects through Facebook Login for Business and selects the relevant business, Facebook Page and linked professional Instagram account. Approval for wider access remains subject to Meta’s review.

The pilot processes the authorising Facebook user identifier, selected business and Page/account identifiers, usernames, permission scopes, access tokens, expiry information and connection status. On request, it reads professional profile information, recent post captions and references, publication details, available engagement counts and daily reach. Creator Marketplace tests retrieve permitted creator profile information, country and follower information. Standard-access test results are identified as test data; they are not verified recommendations.

We use this information to provide the connection, show authorised account content and performance, and test creator discovery for potential collaborations. This pilot does not publish posts, send messages, buy advertising, schedule tracking or add Meta results to client reports or a general creator database. It does not send Meta content to AI or research providers or use it to train general-purpose models. Any wider use requires a supported feature, an appropriate notice and platform permission.

Supabase provides Luna’s authentication, backend functions, encrypted connection storage and primary database, whose configured location is Ireland. AWS provides Luna’s web hosting and delivery. These services process information needed to operate and secure the integration. HYDP staff work in the United Kingdom and United States. Primary database location does not mean all processing stays in Ireland: function execution, infrastructure delivery and authorised provider operations or support may involve other countries. The international-processing section below and our providers’ current privacy resources give further information; contact us for the safeguards applicable to your data.

Connection access is restricted to the authorised Luna account and organisation. Stored platform tokens are encrypted, and a successful disconnect clears the saved credentials. Token expiry requires reconnection. The pilot displays retrieved content, insights and discovery results for the current session without storing those results in Luna’s reporting or creator databases. Minimal account, connection-attempt and security records, and restricted infrastructure backups, are subject to the retention and deletion criteria below.

Luna’s operational diagnostics are separate from the optional marketing-website analytics described below. Where configured, Sentry and PostHog support application diagnostics and usage measurement. The Meta connection screen is excluded from content replay and autocapture, and callback codes are removed before application analytics starts. Platform response content and tokens must not be included in diagnostic reports.

Enquiries and services: we use contact and project details to respond, arrange work and deliver requested services. We rely on steps you ask us to take before a contract or performance of a contract where you are a party, and our legitimate interests in managing business relationships where you act for an organisation.

Report delivery and CRM follow-up: we use your details to deliver the report you request, keep a record and notify the relevant HYDP team. Our legitimate interests are responding to business requests and managing relevant follow-up. Downloading a report does not subscribe you to a newsletter. We use consent for optional marketing subscriptions and honour objections to direct marketing.

Business development: where permitted, we use relevant business contact details for proportionate professional outreach based on our legitimate interests in developing our business. We consider people’s expectations and rights, use consent where required, identify ourselves and provide a way to stop further contact.

Analytics and connected accounts: we use consent for optional website tracking. For authorised business-account reporting and team administration, we rely on the relevant service contract or our legitimate interests in running a secure, effective business, and on consent where required. Platform authorisation controls technical access and does not replace applicable privacy requirements.

Security and legal obligations: we use information to protect the service, prevent abuse, investigate problems and maintain necessary records, based on our legitimate interests and applicable legal obligations.

Essential authentication and security functions use cookies or similar storage where needed. Optional analytics starts only after you allow it. Forms and report downloads work if you decline. Use “Privacy preferences” on the website to change your choice.

Our visit collector records page paths, visit times, the referring domain rather than the complete referring URL, and campaign tags such as source, medium, campaign, content, creator and rep. These visit records do not contain your form answers or email. With analytics permission, attribution may accompany a submitted enquiry or report request so we can understand its source.

A random identifier groups visits within the same browser tab and resets after 30 minutes without recorded activity. Your analytics choice is kept in browser storage. Pending visits may be retried from tab storage for up to 24 hours; withdrawing permission clears pending analytics in that tab. We also use short-lived, non-readable identifiers to limit abusive requests. Where configured, PostHog supplies consent-based website analytics.

Access is limited to authorised HYDP personnel and service providers that need information for their role. Our CRM is hosted by Supabase; Vercel hosts the website; Resend delivers service emails and team notifications; Google provides team sign-in; Sentry supports error reporting; and PostHog provides optional analytics where configured. Historical business records may have been imported from Notion. Connected platform providers process authorisation and API requests under their own policies.

Authorised agents and automation services can process assigned CRM records and activity through scoped access or configured event notifications. They must act for HYDP within their authorised purpose. Sensitive platform data is not made available to an agent simply because that agent has a CRM key; platform restrictions and the user’s authorisation still apply.

If you use Ask HYDP, your submitted chat messages may be sent to OpenAI to generate a response. Do not include confidential or sensitive personal information. Connected-account API data and private email content are not submitted to the public Ask HYDP assistant or used to train general-purpose AI models.

We do not sell personal information. We may disclose necessary information where legally required, to establish or defend legal claims, or as part of a business reorganisation with appropriate protections. We do not make contact records public. Files intentionally uploaded to public media hosting for campaign use are accessible to anyone with the link; confidential material must not be uploaded there.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use that information only to provide or improve the user-facing feature for which access was authorised. We do not use it for advertising targeting, sell it, or use it to train general-purpose AI models.

Access or transfer is restricted to what is needed for that feature, with the user’s agreement, security purposes or legal obligations and other circumstances permitted by Google’s policy. Human access is limited to the user’s consent for specific data, necessary security or legal purposes, or other expressly permitted cases. Separate authorisation is required for additional services or materially different uses.

We retain identifiable information only for as long as needed for its purpose. For enquiries and CRM records, this depends on whether a discussion or business relationship remains active, relevant follow-up, your preferences, and any legal or contractual recordkeeping needs. Marketing subscription details are kept while the subscription is active. We may keep a minimal suppression record after an opt-out so we do not contact you again.

Account permissions and connection credentials are needed only while the connection remains authorised and required. Platform-derived data is subject to that provider’s deletion, refresh and retention rules, which may be shorter than our general business-record needs. Where YouTube API Services are enabled, requests to delete stored user data are handled as soon as possible and within seven calendar days; other revocation and refresh requirements also apply.

When handling a deletion request we identify the relevant records, delete or irreversibly anonymise what is no longer needed, and explain any lawful exception. Restricted backup copies are not used for ordinary business processing and expire through the relevant backup cycle. If a backup is restored, the deletion must be reapplied. Contact us for information about the records and retention criteria applicable to you.

We use access controls, authenticated team access, scoped agent credentials and encrypted connections to protect information. No online service can guarantee complete security. Contact us promptly if you believe an account or credential has been compromised.

Our providers and connected platforms may process information outside the United Kingdom or European Economic Area. Where a restricted transfer applies, we use the applicable safeguards, such as an adequacy decision or approved contractual protections and any required additional measures. Contact us for details of the safeguards relevant to your information.

Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your information, and object to processing. You can object to direct marketing at any time. Where we rely on consent, you may withdraw it without affecting processing that took place before withdrawal. We do not use these services to make solely automated decisions with legal or similarly significant effects on you.

Email hello@hydp.co.uk to exercise your rights. We may ask for proportionate information to verify your identity or authority. We normally respond within one month; if the law allows an extension for a complex request, we will explain it. Deletion and account-revocation instructions are available on our dedicated page. You may also complain to the UK Information Commissioner’s Office or your relevant local data-protection authority.

The Team Hub is a business service for authorised adults. We do not knowingly collect children’s information through its account connections. If you believe a child has supplied personal information to us, contact us so we can investigate.

We update this notice when our services or practices change and show the revision date above. Material changes to connected-data use will be explained before that new use starts, with further consent or authorisation where required.