Dasar Privasi

Data yang kami kumpul

Apabila anda menghubungkan akaun Threads anda, kami mengakses data berikut melalui Threads Graph API (skop: threads_basic, threads_manage_insights, threads_read_replies, threads_manage_mentions, threads_profile_discovery, threads_keyword_search):

Maklumat profil

• Nama pengguna dan nama paparan
• Biografi profil
• Gambar profil
• Status pengesahan akaun

Metrik akaun

• Bilangan followers
• Paparan profil
• Negara teratas followers (bagi akaun 100+ followers)

Data kandungan dan penglibatan

• Teks 20 post terkini (digunakan untuk penilaian AI sahaja; tidak disimpan selepas penilaian)
• Purata balasan, repost, dan sebutan per post
• Metrik penglibatan 7 hari (likes, reposts, quotes, paparan)
• Kekerapan posting (30 hari lepas)

Balasan dan sebutan (pada post anda sendiri sahaja)

• Teks balasan pada post anda sendiri (sehingga 80 balasan: 10 setiap post × 8 post terkini). Digunakan untuk skor Engagement Quality dan ekstraksi tema perbualan. Kandungan asal tidak disimpan selepas analisis.
• Sebutan tentang akaun anda — sama ada melalui @-tag (Sebutan Terkini) atau melalui carian kata kunci nama bisnes anda (Sebutan Organik) — 10 paling terkini bagi setiap kategori disimpan untuk paparan pada /brand/analysis. Sebutan ini adalah kandungan awam dari pokok thread anda sendiri atau tentang brand anda.
• Data perbualan niche (post awam yang sepadan dengan kata kunci target anda) dibaca semasa analisis untuk membantu AI kami menghasilkan cadangan kempen yang lebih bersifat masa kini. Post asal TIDAK disimpan — hanya kiraan setiap kata kunci niche disimpan. Pengarang post awam tersebut tidak disimpan.
• Corak balasan pada post anda sendiri (berapa ramai yang membalas, berapa ramai yang kembali membalas, balasan yang sama perkataan demi perkataan, dan masa balasan), dikira daripada balasan itu sendiri untuk skor Audience Quality. Kami tidak mencari profil orang yang membalas, dan nama pengguna mereka tidak disimpan — hanya angka-angka ini.
• Senarai harian "Hari ni" (pelan berbayar): setiap pagi kami pilih sehingga 5 post awam yang anda mungkin nak balas, iaitu sebutan tentang anda, balasan pada post anda yang belum dibalas, dan post awam dalam niche anda yang bertanya tentang barang seperti yang anda jual. Untuk setiap satu, kami simpan pautan post, nama pengguna penulisnya, teksnya (sehingga 500 aksara) dan draf balasan yang AI kami tulis, supaya anda boleh lihat dan gunakannya. Teks, nama pengguna dan draf itu dipadam bila anda tanda selesai atau langkau, atau selepas 3 hari; hanya hasilnya (dibuat atau tidak) disimpan. Heboh tidak pernah post atau membalas bagi pihak anda.

Token akses

• Token OAuth Threads anda, dienkripsi sepenuhnya sebelum disimpan

Cara kami menggunakan data anda

Data yang dikumpul digunakan untuk tujuan berikut sahaja:

• Mengira skor kreator anda (jangkauan, aktiviti, kualiti konten)
• Menjana rate card peribadi anda
• Menilai kelayakan platform menggunakan penilaian AI
• Pemadanan kempen brand apabila anda diluluskan ke platform
• Mengekstrak tema perbualan daripada balasan untuk membantu anda fahami audiens
• Menilai sentiment sebutan untuk skor Reputation brand
• Menilai kualiti audiens daripada profil awam pengguna yang membalas post anda
• Menambah baik kaedah pemarkahan platform dari masa ke masa
• Mencari sebutan organik tentang brand anda dan trend niche di Threads untuk panduan kempen yang lebih tepat masa
• Membandingkan akaun Threads brand anda dengan sehingga 3 akaun serupa yang anda pilih sendiri, menggunakan profil awam dan engagement 7 hari terakhir mereka

Teks post, teks balasan, teks sebutan, dan corak balasan (angka sahaja) dihantar ke Anthropic API (Claude) untuk penilaian skor dan ekstraksi tema. Data ini tidak digunakan untuk melatih model AI mana-mana pihak ketiga. Kandungan asal tidak disimpan dalam pangkalan data kami selepas analisis — hanya skor yang diperoleh dan ringkasan yang diparafrasa (setiap contoh dihad pada 140 aksara) disimpan.

Tempoh penyimpanan data

Data anda disimpan selama 12 bulan dari tarikh aktiviti terakhir atau sehingga anda meminta pemadaman, yang mana lebih awal. "Aktiviti" bermaksud log masuk terakhir atau kemaskini data profil.

Token akses Threads dipadam serta-merta apabila anda membatalkan kebenaran melalui tetapan Threads anda.

Perkongsian data

Kami tidak menjual, menyewakan, atau menukar data peribadi anda kepada mana-mana pihak ketiga. Satu-satunya perkongsian untuk pengiklanan ialah pengukuran iklan Meta yang diterangkan di bahagian Analitik.

Data disimpan dan diproses melalui perkhidmatan infrastruktur berikut:

• Supabase — pangkalan data PostgreSQL yang menyimpan profil dan skor kreator
• Anthropic API (Claude) — penilaian skor dan ekstraksi tema (teks post, balasan, sebutan, dan corak balasan dihantar untuk analisis; kandungan asal tidak disimpan selepas analisis)
• Vercel — hosting aplikasi web
• HitPay — pemproses pembayaran untuk pelan dan top-up dalam ringgit (Malaysia)
• Stripe — pemproses pembayaran untuk pelan global dalam USD. Stripe menerima nama, e-mel, nama bisnes, alamat bil, nombor cukai (jika diberi) dan butiran kad terus; kami tidak simpan nombor kad. Kami simpan ID pelanggan Stripe dan butiran langganan (pelan, status, tarikh bil) sahaja.

Hak anda

Anda berhak untuk:

• Akses — meminta salinan data yang kami simpan tentang anda
• Pembetulan — meminta pembetulan data yang tidak tepat
• Pemadaman — meminta pemadaman semua data anda dari sistem kami

Untuk melaksanakan mana-mana hak di atas, e-mel ke hello@heboh.xyz dengan subjek "Permintaan Data Saya". Kami akan membalas dalam masa 30 hari.

Pemadaman data

Terdapat dua cara untuk memadamkan data anda:

1. Batalkan kebenaran melalui Threads

Pergi ke Tetapan Threads anda, kemudian Akaun, kemudian Aplikasi dan Laman Web, dan batalkan akses Heboh. Kami akan menerima pemberitahuan webhook dan memadam token akses anda dalam masa 30 hari.

2. Permintaan e-mel

Hantar e-mel ke hello@heboh.xyz dengan subjek "Padam Data Saya". Semua data profil, skor, dan token akan dipadam dalam masa 30 hari.

Keselamatan data

Token akses Threads dienkripsi menggunakan AES-256-GCM sebelum disimpan. Akses pangkalan data dihadkan kepada kunci perkhidmatan yang tidak terdedah kepada awam. Tiada token atau kata laluan yang disimpan dalam bentuk teks biasa.

Analitik

Lawatan. Kami menggunakan Vercel Web Analytics dan Speed Insights untuk mengira lawatan, halaman, sumber trafik dan kelajuan halaman. Hanya laluan halaman dan tag kempen (utm) dihantar; parameter lain dalam alamat dibuang dahulu. Vercel tidak menetapkan kuki untuk ini.

Apa yang anda buat di skrin pendaftaran. Pada halaman pemasaran, rate card, borang pendaftaran, onboarding brand dan beberapa skrin pertama portal, kami merekod sejauh mana anda menatal, ruangan mana yang anda masuki dan sama ada ia diisi (ya atau tidak), butang yang ditekan, dan bila anda meninggalkan halaman. Apa yang anda taip tidak pernah direkod. Pelayar anda menyimpan ID rawak (localStorage dan kuki hb_fdev) supaya lawatan sebelum mendaftar boleh dikaitkan dengan akaun anda selepas mendaftar. Apabila anda mendaftar, kami juga menyimpan tag kempen (utm) dan laman yang merujuk anda (kuki hb_utm). Data ini hanya untuk kami memperbaiki Heboh dan tidak dikongsi. Rekod skrin dipadam selepas 90 hari; tag kempen disimpan selagi akaun anda wujud.

Pengukuran iklan Meta. Untuk mengukur sama ada iklan kami di Facebook, Instagram dan Threads berkesan, halaman pemasaran, log masuk dan portal brand kami memuatkan piksel Meta, yang menetapkan kuki Meta (_fbp, dan _fbc jika anda datang dari iklan). Apabila brand mendaftar, melengkapkan onboarding, menekan bayar dan selesai membayar pelan pertama, pelayan kami memberitahu Meta. Kami menghantar e-mel, ID akaun, nombor WhatsApp (jika anda isi di profil) dan negara anda dalam bentuk hash, bersama alamat IP, jenis pelayar dan kuki Meta tersebut. Alamat IP dan pelayar semasa anda menekan bayar disimpan sehingga pembayaran dilaporkan, paling lama 30 hari. Piksel ini tidak dimuatkan pada portal kreator atau halaman lain.

Perubahan kepada dasar ini

Sekiranya kami membuat perubahan material kepada dasar ini, kami akan mengemaskini tarikh di bahagian atas halaman ini. Penggunaan berterusan platform selepas perubahan dianggap sebagai penerimaan dasar yang dikemaskini.

Hubungi kami

Untuk sebarang pertanyaan berkaitan privasi, hubungi kami:

Akta Perlindungan Data Peribadi 2010 (PDPA Malaysia)

Heboh ialah pengawal data peribadi anda di bawah Akta Perlindungan Data Peribadi 2010 (PDPA Malaysia). Anda mempunyai hak berikut:

• Hak untuk mengakses data peribadi yang kami simpan tentang anda.
• Hak untuk memperbetulkan data peribadi yang tidak tepat.
• Hak untuk menarik balik persetujuan untuk pemprosesan data.
• Hak untuk memohon pemadaman data peribadi anda.
• Hak untuk mengemukakan aduan kepada Pesuruhjaya Perlindungan Data Peribadi.

Untuk menjalankan mana-mana hak ini, e-mel kami di hello@heboh.xyz dengan tajuk “Permintaan PDPA”. Kami akan respons dalam tempoh 21 hari.

Pengawal data: Heboh (operasi oleh entiti berdaftar di Malaysia).
Tempoh penyimpanan: Data kreator disimpan selagi akaun aktif, dan sehingga 24 bulan selepas akaun dipadam untuk tujuan audit dan pematuhan kewangan.

Data we collect

When you connect your Threads account, we access the following data through the Threads Graph API (scopes: threads_basic, threads_manage_insights, threads_read_replies, threads_manage_mentions, threads_profile_discovery, threads_keyword_search):

Profile information

• Username and display name
• Profile biography
• Profile picture
• Account verification status

Account metrics

• Follower count
• Profile views
• Top follower countries (accounts with 100+ followers)

Content and engagement data

• Text from your 20 most recent posts (used for AI evaluation only; not stored after evaluation completes)
• Average replies, reposts, and quotes per post
• 7-day engagement metrics (likes, reposts, quotes, views)
• Posting frequency over the past 30 days

Replies and mentions (on your own posts only)

• Reply text on your own posts (up to 80 replies: 10 per post × 8 most recent posts). Used for Engagement Quality scoring and conversation theme extraction. Raw content is not retained after analysis.
• Mentions of your account — either via @-tag (Recent Mentions) or via a public keyword search of your business name (Organic Mentions) — up to 10 most recent of each kind are retained for display on /brand/analysis. The mention is public content from your own threads tree or about your brand.
• Niche conversation data (public posts matching your target keywords) is read during analysis to ground our AI campaign brief recommendations in current Threads conversation. Raw posts from those searches are NOT retained — only an aggregate count per niche keyword is stored. Authors of those public posts are not retained.
• Reply patterns on your own posts (how many people reply, how many come back, replies that match word for word, and reply timing), computed from the replies themselves to score your audience quality. We do not look up the profiles of people who reply, and their usernames are not retained — only these numbers.
• The daily "Today" list (paid plans): each morning we pick up to 5 public posts you may want to reply to: mentions of you, unanswered replies on your own posts, and public posts in your niche asking about the kind of thing you sell. For each, we keep the post link, its author's username, its text (up to 500 characters) and the reply draft our AI writes, so you can see and use them. That text, username and draft are deleted when you mark the item done or skip it, or after 3 days; only the outcome (acted on or not) is kept. Heboh never posts or replies for you.

Access token

• Your Threads OAuth token, fully encrypted before storage

How we use your data

The data collected is used only for the following purposes:

• Calculating your creator score (reach, activity, content quality)
• Generating your personalised rate card
• Evaluating platform eligibility using AI
• Matching brand campaigns when you are approved to the platform
• Extracting conversation themes from replies to help you understand your audience
• Evaluating mention sentiment for the brand Reputation score
• Evaluating audience quality from public profile data of users who replied to your posts
• Improving our scoring methodology over time
• Searching for organic mentions of your brand and niche conversation trends on Threads to ground campaign recommendations in current discussion
• Comparing your brand’s Threads account with up to 3 similar accounts you choose, using their public profile and last-7-day engagement

Post text, reply text, mention text, and reply patterns (numbers only) are sent to the Anthropic API (Claude) for scoring and theme extraction. This data is not used to train any third-party AI model. Raw content is not stored in our database after analysis — only derived scores and paraphrased summaries (each example capped at 140 characters) are retained.

Data retention

Your data is retained for 12 months from the date of last activity or until you request deletion, whichever comes first. "Activity" means your last login or profile data refresh.

Your Threads access token is deleted immediately upon revoking authorisation through your Threads settings.

Data sharing

We do not sell, rent, or trade your personal data to any third party. The only sharing for advertising is the Meta ad measurement described under Analytics.

Data is stored and processed through the following infrastructure providers:

• Supabase — PostgreSQL database storing creator profiles and scores
• Anthropic API (Claude) — scoring and theme extraction (post text, reply text, mention text, and reply patterns sent for analysis; raw content is not retained after analysis)
• Vercel — web application hosting
• HitPay — payment processor for plans and top-ups in ringgit (Malaysia)
• Stripe — payment processor for global plans in USD. Stripe receives your name, email, business name, billing address, tax ID (if you give one) and card details directly; we never store card numbers. We keep only your Stripe customer ID and subscription details (plan, status, billing dates).

Your rights

You have the right to:

• Access — request a copy of the data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of all your data from our systems

To exercise any of the above rights, email hello@heboh.xyz with the subject "My Data Request". We will respond within 30 days.

Data deletion

There are two ways to delete your data:

1. Revoke access through Threads

Go to your Threads Settings, then Account, then Apps and Websites, and revoke Heboh's access. We will receive a webhook notification and delete your access token within 30 days.

2. Email request

Send an email to hello@heboh.xyz with the subject "Delete My Data". All profile data, scores, and tokens will be deleted within 30 days.

Data security

Threads access tokens are encrypted using AES-256-GCM before storage. Database access is restricted to service-role keys that are not publicly exposed. No tokens or credentials are stored in plain text.

Analytics

Visits. We use Vercel Web Analytics and Speed Insights to count visits, pages, traffic sources and page speed. Only the page path and campaign (utm) tags are sent; any other address parameters are removed first. Vercel sets no cookies for this.

What you do on the signup screens. On our marketing pages, the rate card, the signup forms, brand onboarding and the first few portal screens, we record how far you scroll, which fields you go into and whether they are filled (yes or no), which buttons you press, and when you leave. What you type is never recorded. Your browser keeps a random ID (localStorage and the hb_fdev cookie) so visits before signing up can be linked to your account once you sign up. When you sign up, we also keep the campaign (utm) tags and referring site that brought you (hb_utm cookie). This is only for us to improve Heboh and is not shared. Screen records are deleted after 90 days; the campaign tags are kept for as long as your account exists.

Meta ad measurement. To measure whether our ads on Facebook, Instagram and Threads work, our marketing, sign-in and brand portal pages load the Meta pixel, which sets Meta cookies (_fbp, and _fbc if you arrived from an ad). When a brand signs up, completes onboarding, presses pay and finishes paying for its first plan, our server tells Meta. We send your email, account ID, WhatsApp number (if you added one to your profile) and country as a hash, with IP address, browser type and those Meta cookies. The IP address and browser from when you pressed pay are kept until the payment is reported, 30 days at most. The pixel is not loaded on the creator portal or any other page.

Changes to this policy

If we make material changes to this policy, we will update the date at the top of this page. Continued use of the platform after any changes constitutes acceptance of the updated policy.

Contact us

For any privacy-related enquiries, contact us:

Personal Data Protection Act 2010 (PDPA Malaysia)

Heboh is the data controller of your personal data under the Malaysian Personal Data Protection Act 2010 (PDPA). You have the following rights:

• Right to access the personal data we hold about you.
• Right to correct inaccurate personal data.
• Right to withdraw consent to processing.
• Right to request deletion of your personal data.
• Right to file a complaint with the Personal Data Protection Commissioner.

To exercise any of these rights, email us at hello@heboh.xyz with the subject “PDPA Request”. We will respond within 21 days.

Data controller: Heboh (operated by a Malaysia-registered entity).
Retention period: Creator data is retained while the account is active, and for up to 24 months after account deletion for audit and financial-compliance purposes.