Privacy Policy

Cookie Policy, Acceptable Use Policy and Data Processing Agreement: see the Policies page.

Last Updated: July 21, 2026

1. Introduction

This Privacy Policy explains how HIIPE.io SAS ("HIIPE", "we", "us", or "our") collects, uses, shares, and protects personal data when you use our platform. HIIPE is a French company registered under RCS Paris 100 237 593, with its registered office at 60 rue François Ier, 75008 Paris, France.

This Policy applies to all users of our platform, including Creators (individuals or entities who create accounts to capture, import, or connect fan data) and Fans (individuals whose information is submitted through Capture Links or lawfully imported or connected by a Creator).

By using HIIPE, you acknowledge that you have read and understood this Privacy Policy.

2. Who Is the Controller, and HIIPE's Two Roles

Understanding "who decides why" matters, because it determines who is responsible.

2.1 Creator Data

HIIPE is the Data Controller for personal data collected from Creators during account registration and platform usage (name, contact, billing, usage data). This Policy governs that data.

2.2 Fan Data, Creators are the Controllers

Creators are the Data Controllers for Fan data collected through their Capture Links, or lawfully imported or connected by them. For that Fan data, HIIPE acts as a Data Processor, processing it only on the Creator's documented instructions, in accordance with our Data Processing Agreement.

2.3 Fan Data, HIIPE's own limited controller role

For a short, closed list of purposes, HIIPE acts as an independent Controller in respect of Fan data, because HIIPE, not the Creator, decides these purposes:

  • Securing the Platform and preventing fraud and abuse
  • Billing, accounting, and tax
  • Producing genuinely aggregate or statistical information that does not identify individual Fans

HIIPE does not use Fan data to market to Fans, does not sell Fan data, and does not combine Fan data across different Creators.

Contact for data protection inquiries: privacy@hiipe.io

3. Data We Collect

3.1 Creator Data

When you create a Creator account, we collect:

  • Account information: name (and, for the controller notice, your legal or entity name), email address, phone number, password (hashed), profile image, and country.
  • Payment information: billing address and payment method details (processed by our payment provider).
  • Usage data: login history, feature usage, Capture Link and Bio Link analytics, messaging history.
  • Technical data: IP address, browser type, device information, cookies.

3.2 Fan Data

Fan data may reach the Platform through three routes. In every case it is processed on behalf of the Creator, and in every case HIIPE only makes a Fan messageable on a channel for which per-channel consent evidence exists.

(a) Capture Links. When a Fan submits information through a Creator's Capture Link, we may collect: first name, last name, phone number (required), email address (optional), country (derived from phone number), city (derived from IP or provided), engagement data (which links, opt-in date, per-channel consent, fan tier), and technical data (IP address at time of submission).

(b) Connected Store (e.g. Shopify). Where a Creator connects a store and a customer has given marketing consent in that store, HIIPE may receive that customer's contact details and their separate email and SMS consent states, with their original consent timestamps, to add them to the Creator's fanbase. Email consent enables email only; SMS consent enables SMS only; a consent state that the store cannot vouch for is treated as no consent.

(c) Imports. Where a Creator imports a list they already control, HIIPE receives the contact details together with per-channel consent markers and timestamps, subject to the warranties and the drop rule in the Terms and the Data Processing Agreement.

3.3 Enrichment vs. Ingestion

HIIPE may enrich a Fan who already has a consent record on the Platform, for example, adding a purchase or an event attendance to an existing consented Fan of the same Creator. HIIPE does not create a new messageable contact from a source that lacks valid, channel-specific consent, and does not merge or match Fans across different Creators. Enrichment adds attributes to someone you may already contact; it never manufactures permission.

4. How We Use Data

4.1 Creator Data (HIIPE as Controller)

We use Creator data to: provide and maintain your account and access to the Platform; process payments and manage subscriptions; send service-related communications (account alerts, security notices, feature updates); send marketing communications (with your consent); improve and develop our platform; and comply with legal obligations.

4.2 Fan Data (HIIPE as Processor, on the Creator's instructions)

On behalf of Creators, Fan data is processed to: enable Creators to send Direct Messages (SMS, email) to Fans on consented channels; provide Creators with fanbase analytics and engagement metrics; and manage unsubscribe requests and consent records per channel.

4.3 Fan Data (HIIPE as independent Controller, limited)

For the limited purposes in Section 2.3 only, HIIPE processes Fan data to secure the Platform and prevent fraud, to bill and account, and to produce aggregate statistics that do not identify individuals.

5. Legal Basis for Processing (GDPR)

Legal bases apply to the data for which HIIPE is a controller. For Fan data processed on a Creator's instructions, the Creator is responsible for identifying the legal basis (typically the Fan's consent).

For Creator data (HIIPE as controller):

  • Contract: processing necessary to provide the platform services to you.
  • Consent: for marketing communications to Creators.
  • Legitimate interests: securing the platform and preventing fraud.
  • Legal obligation: accounting, tax, and responding to lawful requests.

For HIIPE's limited independent-controller processing of Fan data (Section 2.3):

  • Legitimate interests: platform security and fraud prevention, and producing aggregate statistics, balanced against Fans' rights, and never used to market to or identify individual Fans.
  • Legal obligation: where retention or disclosure is required by law.

6. Data Sharing

6.1 We Do Not Sell Your Data

HIIPE does not sell personal data to third parties. Fan data is never sold, rented, or shared with third parties for their marketing purposes, and is never combined across Creators.

6.2 Service Providers (Sub-processors)

We share data with trusted service providers who help us operate the platform. The current list, with purpose and location, is maintained in our Data Processing Agreement and updated there. It currently includes providers for SMS delivery, email delivery, hosting, payment processing, IP geolocation, and analytics. All are bound by data processing agreements and required to protect data in accordance with applicable law.

6.3 Creators Cannot Share Fan Data

Creators agree in our Terms of Service that they will not sell, rent, or share Fan data with third parties, and will not import or transfer data they do not themselves control. Fan data may only be used by the Creator, through HIIPE's platform, for direct communication with Fans who consented.

6.4 Legal Requirements

We may disclose personal data if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

7. International Data Transfers

HIIPE is based in France (EU). Some service providers are located outside the European Economic Area (EEA). When we transfer personal data outside the EEA, we ensure appropriate safeguards: EU-approved Standard Contractual Clauses (SCCs); reliance on adequacy decisions or the EU-US Data Privacy Framework where applicable; and supplementary measures where required. All providers are contractually bound to protect the data.

8. Data Retention

8.1 Creator Data

We retain Creator account data for as long as your account is active. After account closure, we retain certain data for up to 10 years as required by French accounting and tax regulations.

8.2 Fan Data

Fan data is retained on behalf of the Creator for as long as it remains in active use, and in any event no longer than 3 years from the Fan's last engagement (last message opened, click, submission, or purchase), unless the Fan is re-engaged, after which the period runs afresh, or unless a longer period is required by law. When a Creator closes their account, Fan personal data is deleted in accordance with the Data Processing Agreement.

We may retain pseudonymised or genuinely aggregate statistics that do not identify individual Fans.

8.3 Consent and Message Records

Records evidencing that a Fan consented, and records of Direct Messages sent, are retained for the period necessary to demonstrate compliance and to establish, exercise, or defend legal claims (in France, generally up to 5 years). Where a Fan is erased, we retain only the minimum record needed to prove the sending was lawful, stripped of identifying content.

9. Your Rights

Under GDPR and applicable data protection laws, you have the rights of: access; rectification; erasure; restriction of processing; data portability; objection (including to direct marketing); and withdrawal of consent at any time, per channel, where processing is based on consent.

To exercise these rights over data a Creator controls, you can contact the Creator or contact us at privacy@hiipe.io and we will assist the Creator. For data HIIPE controls, contact privacy@hiipe.io. We will respond within 30 days.

9.1 For Fans

Fans may exercise their rights by:

  • Replying STOP to any SMS to unsubscribe from that Creator's SMS
  • Clicking unsubscribe in any email to opt out of that Creator's email
  • Contacting the Creator, or privacy@hiipe.io, to request data access, correction, or deletion

10. Data Security

We implement appropriate technical and organizational measures to protect personal data, including: encryption of data in transit (TLS/SSL) and at rest; secure password hashing; access controls and authentication; regular security assessments; and incident response procedures.

In the event of a personal data breach, we will notify the relevant parties as required by GDPR: where HIIPE is the controller, we will notify the competent supervisory authority within 72 hours where required, and affected individuals where the breach is likely to result in a high risk to their rights. Where HIIPE is a processor, we will notify the affected Creator (controller) without undue delay so that they can meet their own notification obligations, see the Data Processing Agreement for the processor notification window.

11. Cookies

We use cookies and similar technologies to operate our platform and analyze usage. For details about the cookies we use and how to manage or refuse them, see our Cookie Policy at hiipe.io/policies.

12. Children's Privacy

HIIPE is not intended for individuals under 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will take steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through the platform at least 30 days before the changes take effect. The "Last Updated" date indicates when it was last revised.

14. Supervisory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. In France:

Commission Nationale de l'Informatique et des Libertés (CNIL)

3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

Website: www.cnil.fr

You may also complain to the supervisory authority in your country of residence.

15. Contact Us

HIIPE.io SAS

60 rue François Ier, 75008 Paris, France

Email: privacy@hiipe.io

RCS Paris: 100 237 593

[ End of Privacy Policy ]