Privacy Policy Draft for Boris's review — not effective until the operator and retention details are approved.

Information processed HypeCommand processes your sign-in email, business name, website, industry, service area, phone, business facts, preferences, optional stories and uploaded media. It processes connected-account identifiers and authorization information through its social-posting provider, planned and published posts, QA results, usage, job costs, billing records, and operational/security logs. Payment-card details will be handled by Stripe if payments are enabled; HypeCommand does not ask for card details in its own forms.

Why we process it We use this information to authenticate access, extract confirmed website facts, create and review content, provide previews, schedule authorized posts, manage quotas and subscriptions, support customers, prevent misuse, and maintain the service. We do not present generated scenes as real customer events.

Service providers The implementation uses Cloudflare for hosting, D1 data and R2 media; Resend for sign-in/service emails; Google Gemini and configured generation providers such as Atlas Cloud or fal.ai for content and review; Shotstack for editing; and Zernio for social connections and publishing. Stripe is currently disabled. The active provider list and applicable contracts must be reviewed before launch. Providers receive data needed for their assigned functions; social platforms process content under their own policies. Processing may occur outside your jurisdiction.

AI processing and public posts Business facts, relevant media, prompts and generated content may be sent to configured AI providers. Do not upload sensitive personal information or a person's likeness without authority and any required consent. Once published, posts are public according to platform settings and may be copied by others. Pausing HypeCommand does not delete already published content.

Cookies, storage and security A session cookie supports sign-in. The service stores business settings, content and billing/usage records in its database and storage. Access controls separate customer data and restrict owner administration. No security measure is a guarantee. The Google Fonts request used by the interface may disclose your IP address to Google; self-hosting fonts should be evaluated before launch.

Retention and your choices You can correct business information, pause posting, disconnect accounts and cancel subscriptions. A verified request can seek access, export or deletion of personal information, subject to legal, fraud-prevention and accounting requirements. The operator must approve specific retention periods and the support contact before launch. This draft does not promise deletion on a schedule the system has not implemented.

Other disclosures The service is intended for adult business users, not children. We do not build cross-customer personal-data profiles or sell customer personal information as a product. If future analytics, advertising or data practices change, this policy and any legally required consent will be updated. Confirm applicable privacy rights, legal bases, international transfer safeguards and any jurisdiction-specific notices with the operator's legal adviser.

Contact and review items Pending: operator legal name/address, privacy contact, effective date, retention schedule, subprocessors/contracts, and applicable regional rights procedures. These must be completed before accepting live customers.