Privacy policy
Effective 3 October 2026
The short version
- We keep what is needed to run your workspace: your account, your team's posts and media, and what the networks you connect send us.
- Network tokens are encrypted. We don't sell data, show ads, or use your content to train AI.
- Only your workspace's members can see its data.
- You can disconnect any network and delete your account at any time.
Who we are
Hivenza is run by Versity Life Co-Ltd, a company registered in Cameroon. We decide how the data about your own account is used. For what your team puts in a workspace (posts, contacts, messages from your audience), your organisation decides and we process it on its behalf. Contact: hello@hivenza.com.
What we keep
Your account
- Your name, email address and language, and your password stored only as a one-way hash.
- If you sign in with Google or Apple: the id they give us for you, and from Google your profile picture.
- If you turn on two-factor sign-in: its secret, encrypted, and your recovery codes, stored only as hashes.
- Your answers to the welcome questions (your role, team size and goals), your own invite code and who invited you.
Workspaces and teams
- Workspace and brand names, time zones and settings; who is a member and with what role; invitations, which hold the invited email address.
- Email addresses that receive a brand's monthly report, including people outside the team.
- An activity log of important actions (who connected an account, published a post or changed a role, and when). Some security events, such as a password reset request, also record the IP address it came from.
What your team creates
- Posts, their text for each account, schedules, labels, approvals, notes, saved replies and report settings.
- Images and videos you upload.
Payments
- The plan or pack bought, the amount, currency, payment method, country, the provider's reference and the result.
- For Mobile Money, the number paid from, encrypted, so you can renew in one tap; only a masked form is ever shown.
- We never see or store card numbers: the payment provider takes them on its own page.
People who write to your brands
When your team uses the inbox, we keep what the networks send about the people who comment on or message your brands: their name, username, picture and id on that network, what they wrote, attachments and reactions. For WhatsApp, the contacts you add: phone number, name, and when they agreed to receive messages or asked to stop. Your organisation is responsible for having the right to message these people.
Visitors to your brands' websites
When a brand turns on session replay for its website chat, we keep a recording of how each visitor moved through that site: the pages, scrolls, clicks and changes to the page, never a video of their screen. Everything a visitor types is masked in their own browser before anything is sent, and visitors who declined being counted, or whose browser sends Do Not Track or Global Privacy Control, are never recorded. Recordings are kept in our file storage in the European Union, encrypted, and only people on the brand's team who may see customers' details can watch them. The brand is responsible for telling its visitors in its own privacy notice.
When a brand adds Hivenza's analytics script to its website, we count its visits and page views for the brand: the page, where the visitor came from (a website or a campaign tag), their country, device class, browser and system, how long they stayed, the clicks on links that leave the site and on file downloads, and the events the brand sends. The script sets no cookie and stores nothing on the visitor's device unless the brand's site tells us the visitor agreed, and then only a random id in their own browser. Otherwise a visitor is a code made from the day, the site, their browser and their address, changed every day and never kept: we do not keep the address or the browser's text. Visitors whose browser sends Do Not Track or Global Privacy Control, or who declined on the brand's site, are never counted, and known bots are left out. A brand chooses how long visits are kept (3 months to 5 years) and can delete one visitor's data. The brand is responsible for telling its visitors in its own privacy notice.
People your brands' campaigns reach
When a brand sends campaigns, we keep, on its contacts, why it may write to them first (their consent, a contract or a legitimate interest, with where it came from), the channels they opted out of, and what each campaign sent them and what they did with it. Unless the brand turns it off, its campaign emails carry a tiny picture that tells when one is opened, and their links pass through us to count clicks. Anyone can unsubscribe in one click from the link in every email, without signing in. Addresses that bounced or reported an email as spam are never written to again. The brand is responsible for having a lawful basis and for telling the people it writes to in its own privacy notice.
Running the service
Error reports, which may include your browser, device and IP address, and server logs. They never include network tokens or passwords.
Data from the networks you connect
You decide which accounts to connect. Each network asks you to approve what Hivenza may do, and we only use that access for the features your team uses: publishing what you schedule, showing statistics, and the inbox. Tokens are stored encrypted (AES-256-GCM) and are never shown in the browser or written to logs.
| Network | What we access and keep |
|---|---|
| Facebook Pages | What we access and keepYour Facebook name and id and a login token, used only to list the Pages you manage. For each Page you connect: its name, picture and id, a Page token, the posts you publish, Page and post statistics, and, if your team uses the inbox, comments, Messenger conversations and mentions. |
| What we access and keepThe professional account's name, username, picture and id; the posts, reels and stories you publish; account and post statistics; and, with the inbox, comments, direct messages and mentions. | |
| Threads | What we access and keepThe profile's name, username, picture and id; the posts you publish (and delete); statistics; replies and mentions. |
| YouTube | What we access and keepThe channel's name, picture and id; the videos you upload; channel and video statistics from YouTube Analytics; and comments on your videos, which your team can read and answer. |
| X | What we access and keepThe profile's name, username, picture and id; the posts you publish or delete; post statistics; replies, mentions and direct messages; hiding replies. |
| What we access and keepFor a profile: your name, picture and id (OpenID sign-in) and the posts you publish. For a company Page you administer: its name, logo and id, the posts you publish, their comments, and the Page's statistics. | |
| TikTok | What we access and keepYour basic profile (display name, picture, id) and the videos you choose to post. When enabled: follower and video counts and your list of videos with their statistics. With a TikTok business account and the inbox: comments and messages. |
| Bluesky | What we access and keepYour handle and an app password you create for us (stored encrypted), the profile's name and picture, the posts you publish, statistics, replies and mentions. |
| Telegram | What we access and keepThe token of a bot you create (stored encrypted), the channels and groups you add it to, the posts it publishes, comments in a channel's discussion group, and private chats with the bot. |
| Google Business Profile | What we access and keepFor each location you connect: its name, address and id, a Google token (stored encrypted), the posts you publish, the location's reviews with their reviewers' public names and pictures, your replies, and its performance numbers (views, calls, website clicks, direction requests and search terms). |
| What we access and keepThe account's username, name, picture and id, a token (stored encrypted), its boards, the Pins you publish, and account and Pin statistics. | |
| Canva | What we access and keepYour Canva name and id and a token (stored encrypted), used only to list your designs when you import one; the designs you import are exported and kept in your brand's media library. Nothing is changed in Canva. |
| WhatsApp Business | What we access and keepThe business account and phone number ids, the display number and verified name, a token, the messages your team sends and receives, and the contacts and broadcasts you add. |
| HubSpot and Salesforce | What we access and keepWhen a workspace owner or admin connects one: the account's name and id and a token (stored encrypted); the contacts and companies the workspace chooses to sync, in the directions its settings say, field by field; its deals or opportunities (name, stage, amount, close date, owner's email) and each contact's owner email, read to steer workflows; and the notes, activities and deals its workflows add. Disconnecting stops the sync and forgets the token; what was synced stays in both places. |
Audience figures (countries, cities, age groups, devices, traffic sources and the like) are totals the networks share about your followers or viewers; they are not about any one person.
Why we use it
- To provide the service you signed up for: publishing, analytics, reports, the inbox, teams and billing.
- To keep it secure: sign-in protection, two-factor sign-in, preventing abuse, and fixing errors.
- To write to you about your account: confirmations, invitations, failed posts, renewals, receipts and important changes.
- To meet legal duties, such as keeping payment records.
What we don't do
- We don't sell your data or anyone's in it, and we don't use it for advertising.
- We don't use your content or your networks' data to train AI models, and we don't send it to AI providers.
- We don't post anything your team hasn't written and scheduled or published, or that you ask an AI assistant you connected to post.
- People outside your workspace, including other Hivenza customers, can't see your brands, accounts, posts, messages or numbers.
- No one at Hivenza reads your posts, messages or statistics, except when you ask us to help, to keep the service secure, or when the law requires it.
AI assistants
You can connect an AI assistant (such as Claude or ChatGPT) to one workspace. When you ask it to, the assistant can list your brands and accounts, write and schedule posts, read your posts, suggest good times and give an analytics summary, with no more rights than your role. It cannot read the inbox.
What the assistant receives from Hivenza is then handled by its provider under its own privacy policy. We keep only fingerprints (hashes) of the assistant's keys: an access key lasts one hour and is renewed for up to 60 days; a personal key lasts until you remove it. You can cut an assistant off at any time in Settings, under AI assistants.
Who else processes it
We use these kinds of providers to run Hivenza. Each one only gets what it needs for its job, under a contract that binds it to protect it.
| Provider | What for |
|---|---|
| Hosting and database providers | What forRun Hivenza and store accounts, workspaces, posts, statistics and the inbox. |
| File storage, in the European Union | What forStores the images and videos you upload, copies of files received in the inbox, and session replay recordings. |
| Email delivery | What forSends sign-up links, invitations, alerts, reports and receipts. |
| Error monitoring | What forReceives error reports so we can fix problems. |
| Network and security | What forProtects the connection to the site. |
| Payment providers | What forTake card and Mobile Money payments. They show their name when you pay. |
| Google and Apple | What forSign you in, when you choose to sign in with them. |
| The networks you connect | What forReceive what you publish and send us what is listed above, under their own policies. |
For the current list of providers by name, write to hello@hivenza.com.
How long we keep it
| What | How long |
|---|---|
| Your account | How longUntil you delete it. After that only an anonymous record stays, so your team's history still reads (a post shows “Deleted user”). |
| A workspace's posts, media, statistics and inbox | How longAs long as the workspace exists. They are deleted with it. |
| Support tickets and contacts | How longAs long as the workspace keeps them, or for the time its owners set in Settings → Data and privacy, after which they are anonymised or deleted. |
| Network tokens | How longUntil you disconnect the account, delete your account, or the network withdraws access. Disconnecting deletes the token at once. |
| Notifications | How long90 days. |
| Sign-in session | How long7 days, or until you sign out or change your password. |
| Password reset and sign-in links | How long1 hour for a password reset link, 2 days for an email confirmation link. |
| The activity log | How longAs long as the workspace exists. |
| Payment records | How longAs long as accounting law requires (up to 10 years), even after the workspace is deleted; the Mobile Money number is removed. |
| Website analytics (visits and page views) | How longFor the time the brand chooses, from 3 months to 5 years (2 years unless changed), then deleted automatically. Removing the website deletes them at once. |
| Session replay recordings | How long30 days, then deleted automatically. Turning session replay off deletes them at once. |
| Error reports | How longA limited time, then deleted automatically. |
| Records of deletion requests | How longKept as proof that a deletion was done: a code, the dates and what was removed, in counts only. |
Security
Everything travels over HTTPS. Network tokens, two-factor secrets and Mobile Money numbers are encrypted with AES-256-GCM; passwords and recovery codes are stored only as hashes. Only members of a workspace can reach its data, each according to their role. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
Where your data goes
We are based in Cameroon. Uploaded files are stored in the European Union (Belgium), and some of our providers and every network process data in other countries, including the United States. When data leaves the country it was collected in, we rely on the protections our providers offer, such as the European Commission's standard contractual clauses.
If your organisation needs a written statement of where its data is stored and processed (for a compliance review or a contract), write to us at hello@hivenza.com.
If a regulator or a contract requires your data to stay in a particular region, write to us at hello@hivenza.com: a separate deployment in that region can be agreed.
Your rights
- See and correct your details at any time on your profile.
- Disconnect any social account at any time, from Accounts in the app or from the network's own settings.
- Delete your account yourself from your profile; the data deletion page explains what is removed.
- Ask for a copy of your data, or object to how we use it, by writing to hello@hivenza.com.
We answer within 30 days. If you think we got something wrong, you can also complain to the data protection authority where you live.
Children
Hivenza is a tool for businesses and is not meant for anyone under 16. We don't knowingly keep data about children; if you think we do, tell us and we will delete it.
Google and YouTube
Hivenza's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We use data from YouTube only to upload the videos you schedule, show your channel's and videos' statistics, and let your team read and answer comments.
- We use data from Google Business Profile only to publish the posts you schedule to your locations, show their reviews in your inbox so your team can reply, and show your locations' performance numbers.
- We don't transfer it to anyone except as needed to provide those features, for security, or to comply with the law; we don't use it for advertising; and no person reads it unless you ask us to, for security, or as the law requires.
- Hivenza uses YouTube API Services. By connecting a channel you agree to the YouTube Terms of Service, and Google's use of the data is covered by the Google Privacy Policy.
- We keep comments from YouTube for at most 29 days. Your channel's statistics stay while the channel is connected, and we check that connection every day.
- You can remove Hivenza's access at any time from your Google security settings. Disconnecting the channel in Hivenza deletes our token and everything YouTube gave us about the channel straight away; if you remove access from Google instead, we delete it within 30 days.
Read the Google API Services User Data Policy.
Facebook, Instagram, Threads and WhatsApp
Data from Meta's platforms is used only to provide the features described above and is never sold, shared with data brokers or used to build profiles of people.
If you remove Hivenza in your Facebook settings (Apps and websites) or your Threads settings, Meta tells us and we delete your Meta login and disconnect the accounts you connected, automatically. You get a confirmation code to follow it on our data deletion page.
TikTok
When you connect TikTok, Hivenza asks for your basic profile and permission to post the videos you choose, and, when available, your account's statistics and list of videos. It uses them only to show which profile is connected, publish the videos your team schedules and show how they did.
You can remove access in TikTok under Settings and privacy, Security and permissions, Apps and services; disconnecting in Hivenza deletes our token. TikTok's own use of data is covered by its privacy policy.
X and LinkedIn
Data from X and LinkedIn is used only for the features described above, in line with each network's developer terms. It is not combined with other sources, used to identify people, or shared. You can remove access in X under Settings, Security and account access, Apps and sessions, and in LinkedIn under Settings, Data privacy, Permitted services.
Changes to this policy
If we change this policy in a way that matters, we will tell you in the app and by email before the change applies. The date at the top shows when it last changed.
Contact
Write to hello@hivenza.com with any question about your data. We answer within 30 days.
Hivenza is a product of Versity Life Co-Ltd. Questions about this page: hello@hivenza.com.