Dasar Privasi

Data yang kami kumpul

Apabila anda menghubungkan akaun Threads anda, kami mengakses data berikut melalui Threads Graph API (skop: threads_basic, threads_manage_insights, threads_read_replies, threads_manage_mentions, threads_profile_discovery, threads_keyword_search):

Maklumat profil

• Nama pengguna dan nama paparan
• Biografi profil
• Gambar profil
• Status pengesahan akaun

Metrik akaun

• Bilangan followers
• Paparan profil
• Negara teratas followers (bagi akaun 100+ followers)

Data kandungan dan penglibatan

• Teks 20 post terkini (digunakan untuk penilaian AI sahaja; tidak disimpan selepas penilaian)
• Purata balasan, repost, dan sebutan per post
• Metrik penglibatan 7 hari (likes, reposts, quotes, paparan)
• Kekerapan posting (30 hari lepas)

Balasan, sebutan, dan profil engager (pada post anda sendiri sahaja)

• Teks balasan pada post anda sendiri (sehingga 80 balasan: 10 setiap post × 8 post terkini). Digunakan untuk skor Engagement Quality dan ekstraksi tema perbualan. Kandungan asal tidak disimpan selepas analisis.
• Sebutan tentang akaun anda — sama ada melalui @-tag (Sebutan Terkini) atau melalui carian kata kunci nama bisnes anda (Sebutan Organik) — 10 paling terkini bagi setiap kategori disimpan untuk paparan pada /brand/analysis. Sebutan ini adalah kandungan awam dari pokok thread anda sendiri atau tentang brand anda.
• Data perbualan niche (post awam yang sepadan dengan kata kunci target anda) dibaca semasa analisis untuk membantu AI kami menghasilkan cadangan kempen yang lebih bersifat masa kini. Post asal TIDAK disimpan — hanya kiraan setiap kata kunci niche disimpan. Pengarang post awam tersebut tidak disimpan.
• Maklumat profil awam pengguna yang membalas post anda (followers_count, biografi, status pengesahan; sehingga 15 engager). Digunakan untuk skor Audience Quality sahaja. Identiti engager tidak disimpan dan kami tidak membentuk profil tentang mereka.

Token akses

• Token OAuth Threads anda, dienkripsi sepenuhnya sebelum disimpan

Cara kami menggunakan data anda

Data yang dikumpul digunakan untuk tujuan berikut sahaja:

• Mengira skor kreator anda (jangkauan, aktiviti, kualiti konten)
• Menjana rate card peribadi anda
• Menilai kelayakan platform menggunakan penilaian AI
• Pemadanan kempen brand apabila anda diluluskan ke platform
• Mengekstrak tema perbualan daripada balasan untuk membantu anda fahami audiens
• Menilai sentiment sebutan untuk skor Reputation brand
• Menilai kualiti audiens daripada profil awam pengguna yang membalas post anda
• Menambah baik kaedah pemarkahan platform dari masa ke masa
• Mencari sebutan organik tentang brand anda dan trend niche di Threads untuk panduan kempen yang lebih tepat masa

Teks post, teks balasan, teks sebutan, dan medan profil awam engager dihantar ke Anthropic API (Claude) untuk penilaian skor dan ekstraksi tema. Data ini tidak digunakan untuk melatih model AI mana-mana pihak ketiga. Kandungan asal tidak disimpan dalam pangkalan data kami selepas analisis — hanya skor yang diperoleh dan ringkasan yang diparafrasa (setiap contoh dihad pada 140 aksara) disimpan.

Tempoh penyimpanan data

Data anda disimpan selama 12 bulan dari tarikh aktiviti terakhir atau sehingga anda meminta pemadaman, yang mana lebih awal. "Aktiviti" bermaksud log masuk terakhir atau kemaskini data profil.

Token akses Threads dipadam serta-merta apabila anda membatalkan kebenaran melalui tetapan Threads anda.

Perkongsian data

Kami tidak menjual, menyewakan, atau menukar data peribadi anda kepada mana-mana pihak ketiga untuk tujuan pemasaran atau pengiklanan.

Data disimpan dan diproses melalui perkhidmatan infrastruktur berikut:

• Supabase — pangkalan data PostgreSQL yang menyimpan profil dan skor kreator
• Anthropic API (Claude) — penilaian skor dan ekstraksi tema (teks post, balasan, sebutan, dan profil awam engager dihantar untuk analisis; kandungan asal tidak disimpan selepas analisis)
• Vercel — hosting aplikasi web

Hak anda

Anda berhak untuk:

• Akses — meminta salinan data yang kami simpan tentang anda
• Pembetulan — meminta pembetulan data yang tidak tepat
• Pemadaman — meminta pemadaman semua data anda dari sistem kami

Untuk melaksanakan mana-mana hak di atas, e-mel ke [email protected] dengan subjek "Permintaan Data Saya". Kami akan membalas dalam masa 30 hari.

Pemadaman data

Terdapat dua cara untuk memadamkan data anda:

1. Batalkan kebenaran melalui Threads

Pergi ke Tetapan Threads anda, kemudian Akaun, kemudian Aplikasi dan Laman Web, dan batalkan akses Heboh. Kami akan menerima pemberitahuan webhook dan memadam token akses anda dalam masa 30 hari.

2. Permintaan e-mel

Hantar e-mel ke [email protected] dengan subjek "Padam Data Saya". Semua data profil, skor, dan token akan dipadam dalam masa 30 hari.

Keselamatan data

Token akses Threads dienkripsi menggunakan AES-256-GCM sebelum disimpan. Akses pangkalan data dihadkan kepada kunci perkhidmatan yang tidak terdedah kepada awam. Tiada token atau kata laluan yang disimpan dalam bentuk teks biasa.

Analitik

Kami menggunakan Umami, alat analitik tanpa kuki yang menjejak metrik agregat sahaja (jumlah lawatan halaman, kadar penukaran corong, sumber trafik). Tiada data peribadi dikumpul dan tiada kuki disimpan pada peranti anda. Umami tidak mengenal pasti pengunjung individu.

Perubahan kepada dasar ini

Sekiranya kami membuat perubahan material kepada dasar ini, kami akan mengemaskini tarikh di bahagian atas halaman ini. Penggunaan berterusan platform selepas perubahan dianggap sebagai penerimaan dasar yang dikemaskini.

Hubungi kami

Untuk sebarang pertanyaan berkaitan privasi, hubungi kami:

Akta Perlindungan Data Peribadi 2010 (PDPA Malaysia)

Heboh ialah pengawal data peribadi anda di bawah Akta Perlindungan Data Peribadi 2010 (PDPA Malaysia). Anda mempunyai hak berikut:

• Hak untuk mengakses data peribadi yang kami simpan tentang anda.
• Hak untuk memperbetulkan data peribadi yang tidak tepat.
• Hak untuk menarik balik persetujuan untuk pemprosesan data.
• Hak untuk memohon pemadaman data peribadi anda.
• Hak untuk mengemukakan aduan kepada Pesuruhjaya Perlindungan Data Peribadi.

Untuk menjalankan mana-mana hak ini, e-mel kami di [email protected] dengan tajuk “Permintaan PDPA”. Kami akan respons dalam tempoh 21 hari.

Pengawal data: Heboh (operasi oleh entiti berdaftar di Malaysia).
Tempoh penyimpanan: Data kreator disimpan selagi akaun aktif, dan sehingga 24 bulan selepas akaun dipadam untuk tujuan audit dan pematuhan kewangan.

UU No. 27 Tahun 2022 (Pelindungan Data Pribadi — Indonesia)

Untuk pengguna di Indonesia, Heboh memproses data peribadi mengikut UU No. 27 Tahun 2022 (UU PDP). Anda mempunyai hak yang setara dengan PDPA Malaysia di atas — akses, pembetulan, pemadaman, dan penarikan balik persetujuan.

Permintaan UU PDP boleh dihantar ke [email protected] dengan tajuk “Permintaan UU PDP”. Kami akan respons dalam tempoh 30 hari mengikut keperluan undang-undang Indonesia.

Data we collect

When you connect your Threads account, we access the following data through the Threads Graph API (scopes: threads_basic, threads_manage_insights, threads_read_replies, threads_manage_mentions, threads_profile_discovery, threads_keyword_search):

Profile information

• Username and display name
• Profile biography
• Profile picture
• Account verification status

Account metrics

• Follower count
• Profile views
• Top follower countries (accounts with 100+ followers)

Content and engagement data

• Text from your 20 most recent posts (used for AI evaluation only; not stored after evaluation completes)
• Average replies, reposts, and quotes per post
• 7-day engagement metrics (likes, reposts, quotes, views)
• Posting frequency over the past 30 days

Replies, mentions, and engager profiles (on your own posts only)

• Reply text on your own posts (up to 80 replies: 10 per post × 8 most recent posts). Used for Engagement Quality scoring and conversation theme extraction. Raw content is not retained after analysis.
• Mentions of your account — either via @-tag (Recent Mentions) or via a public keyword search of your business name (Organic Mentions) — up to 10 most recent of each kind are retained for display on /brand/analysis. The mention is public content from your own threads tree or about your brand.
• Niche conversation data (public posts matching your target keywords) is read during analysis to ground our AI campaign brief recommendations in current Threads conversation. Raw posts from those searches are NOT retained — only an aggregate count per niche keyword is stored. Authors of those public posts are not retained.
• Public profile fields of users who replied to your posts (followers_count, biography, verification status; up to 15 engagers). Used solely to score your audience quality. Engager identities are not retained, and we do not build profiles about them.

Access token

• Your Threads OAuth token, fully encrypted before storage

How we use your data

The data collected is used only for the following purposes:

• Calculating your creator score (reach, activity, content quality)
• Generating your personalised rate card
• Evaluating platform eligibility using AI
• Matching brand campaigns when you are approved to the platform
• Extracting conversation themes from replies to help you understand your audience
• Evaluating mention sentiment for the brand Reputation score
• Evaluating audience quality from public profile data of users who replied to your posts
• Improving our scoring methodology over time
• Searching for organic mentions of your brand and niche conversation trends on Threads to ground campaign recommendations in current discussion

Post text, reply text, mention text, and engager public profile fields are sent to the Anthropic API (Claude) for scoring and theme extraction. This data is not used to train any third-party AI model. Raw content is not stored in our database after analysis — only derived scores and paraphrased summaries (each example capped at 140 characters) are retained.

Data retention

Your data is retained for 12 months from the date of last activity or until you request deletion, whichever comes first. "Activity" means your last login or profile data refresh.

Your Threads access token is deleted immediately upon revoking authorisation through your Threads settings.

Data sharing

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

Data is stored and processed through the following infrastructure providers:

• Supabase — PostgreSQL database storing creator profiles and scores
• Anthropic API (Claude) — scoring and theme extraction (post text, reply text, mention text, and engager public profile fields sent for analysis; raw content is not retained after analysis)
• Vercel — web application hosting

Your rights

You have the right to:

• Access — request a copy of the data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of all your data from our systems

To exercise any of the above rights, email [email protected] with the subject "My Data Request". We will respond within 30 days.

Data deletion

There are two ways to delete your data:

1. Revoke access through Threads

Go to your Threads Settings, then Account, then Apps and Websites, and revoke Heboh's access. We will receive a webhook notification and delete your access token within 30 days.

2. Email request

Send an email to [email protected] with the subject "Delete My Data". All profile data, scores, and tokens will be deleted within 30 days.

Data security

Threads access tokens are encrypted using AES-256-GCM before storage. Database access is restricted to service-role keys that are not publicly exposed. No tokens or credentials are stored in plain text.

Analytics

We use Umami, a cookieless analytics tool that tracks aggregate funnel metrics only (total page views, funnel conversion rates, traffic sources). No personal data is collected and no cookies are stored on your device. Umami does not identify individual visitors.

Changes to this policy

If we make material changes to this policy, we will update the date at the top of this page. Continued use of the platform after any changes constitutes acceptance of the updated policy.

Contact us

For any privacy-related enquiries, contact us:

Personal Data Protection Act 2010 (PDPA Malaysia)

Heboh is the data controller of your personal data under the Malaysian Personal Data Protection Act 2010 (PDPA). You have the following rights:

• Right to access the personal data we hold about you.
• Right to correct inaccurate personal data.
• Right to withdraw consent to processing.
• Right to request deletion of your personal data.
• Right to file a complaint with the Personal Data Protection Commissioner.

To exercise any of these rights, email us at [email protected] with the subject “PDPA Request”. We will respond within 21 days.

Data controller: Heboh (operated by a Malaysia-registered entity).
Retention period: Creator data is retained while the account is active, and for up to 24 months after account deletion for audit and financial-compliance purposes.

Law No. 27 of 2022 (Personal Data Protection — Indonesia)

For users in Indonesia, Heboh processes personal data in accordance with Indonesian Law No. 27 of 2022 (UU PDP). You have rights equivalent to those listed under PDPA Malaysia above — access, correction, deletion, and withdrawal of consent.

UU PDP requests can be sent to [email protected] with the subject “UU PDP Request”. We will respond within 30 days as required by Indonesian law.