Skip to main content
Hedra Up

Privacy policy

Effective date: 10/10/2026

This policy explains how Hedra Up (hedraup.com) processes your personal data, in line with Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 and Decree 356/2025/ND-CP guiding its implementation.

1. Data controller and processor

Hedra Up is operated by an individual who owns the hedraup.com domain. For any question or request about your personal data, contact the data controller at admin@hedraup.com.

2. Data we collect

  • Account information: name, email address and profile picture provided by Google when you sign in with Google, or your email when you use an email sign-in link.
  • Content you create: post text, attached file details (name, type, size), scheduled times, your channel list and channel display names.
  • Media source settings: Google Drive folder link/ID, Cloudflare R2 Account ID, bucket name and public URL. We do not collect R2 access keys through the browser.
  • Technical data: sign-in session cookies; anonymous, cookie-less page view and load-speed statistics (Vercel Web Analytics, Speed Insights); and only if you consent to “Analytics”: visit data via Google Analytics 4 cookies.

We do not collect sensitive personal data.

3. Purposes and legal basis

We process data to: create and maintain your account; store and display your channels, posts and schedule; secure the service; and improve the product through anonymous statistics. The legal basis is your consent when you sign up/sign in and the performance of the service you request.

4. Retention

Data is kept while your account is active. When you delete a post or channel, it is removed from the primary database. When you ask to delete your account, data linked to it is deleted unless the law requires retention.

5. Sharing and cross-border transfer

We do not sell personal data. Data is processed by the following infrastructure providers, which may host servers outside Vietnam:

  • Supabase (database and authentication; servers in Singapore).
  • Vercel (website hosting and operation; anonymous analytics).
  • Cloudflare (DNS and network protection).
  • Google (Sign in with Google, when you choose it; Google Analytics 4, only if you consent to “Analytics”).
  • TikTok (ByteDance) (only if you connect a TikTok account; see section 6).

Transfers abroad are made to provide the service and follow the cross-border transfer rules of Law 91/2025/QH15 and Decree 356/2025/ND-CP.

6. TikTok data

If you connect a TikTok account, Hedra Up uses TikTok Login Kit and the Content Posting API with your permission. We receive and store: your TikTok open ID, display name and avatar (scope user.info.basic), the access and refresh tokens TikTok issues, the scopes you granted, and your creator settings returned by TikTok at posting time (nickname, available privacy levels, comment/duet/stitch availability, maximum video length). We use this data only to show which TikTok account you are posting to and to publish the videos or photos you choose, with the caption, privacy level, interaction and commercial-disclosure settings you select, at the time you choose. We also store the publish ID and status TikTok returns so you can see whether a post succeeded.

Tokens are encrypted at rest (AES-256-GCM) and are only used server-side; they are never shown in the browser or shared. Media you send to TikTok is temporarily copied to our storage (media.hedraup.com) so TikTok can fetch it, and is deleted after publishing finishes or fails (at most 7 days). We do not sell TikTok data, use it for advertising, or share it with third parties other than TikTok itself.

You can disconnect TikTok at any time in Channels; we then revoke the token with TikTok and delete the stored tokens and profile data immediately. You can also remove Hedra Up from TikTok's “Manage app permissions”. Your use of TikTok is also governed by TikTok's Terms of Service and Privacy Policy.

7. Security measures

Connections are encrypted (HTTPS). Every data table enforces row-level access control: an account can only read and edit its own data. System admin keys stay server-side only. Social network access tokens are encrypted at rest and used server-side only.

8. Your rights

You have the right to be informed, to consent or withdraw consent, to access, correct and delete your data, to restrict or object to processing, to request a copy of your data, to complain and to claim damages as provided by law. You can delete posts and channels yourself in the app; for other requests, email admin@hedraup.com.

9. Cookies

Hedra Up uses cookies needed for the sign-in session. Google Analytics cookies are only set if you consent; you can withdraw at any time via “Cookie preferences” at the bottom of the page. See the Cookie policy.

10. Effective date and updates

This policy is effective from 10 October 2026 and was last updated on 11 October 2026. When it changes, we update the effective date on this page and notify you in the app for important changes.