Privacy Policy
Who is responsible
Kankara Agency Limited, Business Registration No. 76775552, Unit 1102, 11/F, 29 Austin Road, Tsim Sha Tsui, Kowloon, Hong Kong. Send requests about personal data to the company at that address or to privacy@hypari.com.
What this policy covers
This website; email you send to our addresses; and the social media accounts Hypari runs or will run on TikTok, YouTube, Instagram, Threads, Pinterest, VK, Dzen and Telegram, together with the tools we use to publish to them, including Hypari Publisher, the TikTok developer app we are building. All of these accounts belong to us: our publishing tools never connect accounts of other people or businesses. Each platform also processes your data as an independent company under its own privacy policy.
What we collect
- When you visit this website — standard web server logs: IP address, time, page requested, referring page and browser identification. The site sets no cookies and runs no analytics or advertising trackers.
- When you write to us — your email address and what you wrote.
- When you comment on our videos or message one of our accounts — the platform passes us the text you wrote and your public account identifiers (username or display name, and the identifier the platform uses for you), so that we can read and answer it.
- About our own accounts — statistics of our own posts and accounts (views, likes, comments, followers) and the aggregated audience reports the platforms provide. These do not identify individual viewers.
Through our apps and the platforms' APIs we access only our own accounts, the comments and messages sent to them and, for people who message one of our accounts, whether they follow that account. We do not buy personal data, do not track you across websites and never ask anyone for a password.
Why we use it, and on what basis
To run this website and keep it secure, to publish to our own accounts and to learn which videos are useful — on the basis of our legitimate interest in running our channels. To answer your emails, comments and messages — on the basis of your request. To keep the records the law requires — on the basis of that legal obligation.
Who processes it for us
Service providers acting on our instructions: our hosting and backup providers, our email routing and mailbox providers, InstantDM, which receives the comments and direct messages sent to our Instagram accounts, sends our replies and tells us whether the sender follows our account, and Postmypost, which publishes our videos and captions to our VK communities. If we start using another tool that handles comments or messages on our accounts, it will act on our instructions and will be listed here before it is used. The platforms process data as independent companies under their own policies. We do not sell personal data and do not share it for advertising.
Where it is stored
Our server is hosted by Hetzner in Finland. Backup copies are kept by our backup providers. Email to our addresses is stored by Zoho in its EU data centres and forwarded to Google, which also stores it. These providers and our email providers may process data outside the country where you live.
How long we keep it
- Web server logs — up to 90 days.
- Email — as long as needed to handle your request, and no longer than 24 months after the last message.
- Comments, messages and identifiers received from the platforms — refreshed or deleted within 30 days.
- Aggregated statistics of our own posts and accounts, including audience reports, which identify no one — as long as the channel exists.
Deleted data can remain in backup copies for up to 3 months, until those copies are replaced on their regular schedule; we do not restore it from them.
Your rights
You can ask for a copy of the data we hold about you, for its correction or deletion, or object to its use. Write to privacy@hypari.com; we confirm within 7 days and complete the request within 30 days. How to ask for deletion is set out on the data deletion page. You may also complain to the Office of the Privacy Commissioner for Personal Data in Hong Kong or to the supervisory authority where you live.
YouTube API Services
Hypari uses YouTube API Services to publish to and report on our own YouTube channels. The YouTube Terms of Service apply, and Google's handling of data is described in the Google Privacy Policy. If you have ever granted any app access to your Google account, you can review and revoke it on the Google account permissions page. Data retrieved through YouTube API Services is used only to operate our own channels; any comments and viewer identifiers are refreshed or deleted within 30 days; nothing is used to train models or to build profiles of viewers.
TikTok
Hypari Publisher, the in-house app we are building, will use TikTok API for Business only with TikTok accounts that we own. Through it we will publish our videos, check their publishing status, read insights for our own videos and accounts, and read and reply to comments on our videos. Comment text and the commenter's public username will be used only to read and answer comments and to see which questions viewers ask; we will not build profiles of commenters. TikTok data will not be sold, will not be shared except with our hosting and backup providers acting on our instructions, will not be used for advertising or to train AI models, and will be refreshed or deleted within 30 days, except aggregated statistics of our own videos and accounts. TikTok's own processing is described in TikTok's privacy policy.
Security
Traffic to this site is encrypted in transit. Access tokens and credentials are stored outside the code repository, with access restricted to the company's designated administrators.
Children
Our channels are general-audience educational content and are not directed at children. We do not knowingly collect data from anyone under 16; if we learn that we hold such data, we delete it.
Changes
When this policy changes, the new version is published here with a new date.