Privacy Policy

1. Data Controller

Your personal data is controlled by:

References to "HEVEA Pulse," "we," "us," or "our" in this policy refer to Hevea Investment as the data controller for the HEVEA Pulse service.

2. Data We Collect

We collect the following categories of data:

2.1 Account Information

When you create an account, we collect your name, email address, password (hashed), and any profile details you choose to provide.

2.2 Uploaded Footage and Content

When you use the Service, you upload raw video footage, images, and associated metadata (file names, timestamps, geolocation embedded in files if present). This content is necessary to provide the core service.

2.3 Instagram Insights Data

If you connect your Instagram account, we access performance data provided by the Instagram/Meta API, including reach, impressions, engagement rates, follower counts, and audience demographics. This data is used solely to power the performance feedback loop within the Service.

2.4 Billing Information

Payment is processed by Stripe. We do not store full card numbers. We retain billing records including plan type, amount, and transaction dates for accounting and legal compliance purposes.

2.5 Usage Analytics

We collect data on how you interact with the Service, including pages visited, features used, session duration, and error reports. This data is used to improve the product and identify technical issues.

2.6 Technical Data

We collect IP addresses, browser type and version, operating system, device identifiers, and referring URLs as part of standard server logs and analytics.

3. How We Use Your Data

We use your data for the following purposes:

• Service delivery: To operate the platform, process your footage, generate content outputs, and publish to Instagram on your behalf.
• AI processing: To run our narrative arc detection, clip selection, and content sequencing algorithms on your uploaded footage.
• Performance feedback loop: To analyse your Instagram Insights data and refine future content recommendations.
• Billing and account management: To process payments, manage subscriptions, and send transactional emails (receipts, renewal reminders, account alerts).
• Product improvement: To identify bugs, improve features, and develop new functionality, using aggregated and anonymised data where possible.
• Legal compliance: To comply with applicable laws, respond to legal requests, and enforce our Terms of Service.

4. Data Storage and Security

Your data is stored using Supabase (database and file storage), hosted on cloud infrastructure in the European Union. Uploaded footage and processed video files are stored in cloud object storage. We apply encryption in transit (TLS) and at rest for all sensitive data.

We implement access controls, audit logs, and security monitoring to protect your data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

5. Footage Retention

5.1 Standard Footage

Raw footage uploaded for processing is retained for 30 to 90 days after processing is complete, unless you choose to delete it sooner. After this period, raw footage files are automatically deleted from our systems.

5.2 Narrative Thread Archive

Clips and content that form part of your narrative thread archive are retained long-term so that HEVEA Pulse can maintain story continuity across weeks and months. This archive is fully user-controlled: you can delete individual clips or your entire archive at any time from your account settings. Deletion is permanent and irreversible.

5.3 Account Closure

When you close your account, we will delete all your User Content within 90 days, unless we are required by law to retain it for longer. Account and billing records may be retained for up to 7 years for accounting compliance.

6. Third-Party Services

We share data with the following third-party services, solely as necessary to operate the Service:

We do not sell your personal data to third parties, and we do not use your data for advertising purposes.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request your data in a structured, machine-readable format.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.

To exercise any of these rights, contact us at hello@heveapulse.com. We will respond within 30 days.

8. Cookies

We use functional cookies (required for authentication and session management) and analytics cookies (Google Analytics 4, which can be opted out of). We do not use advertising or tracking cookies. For full details, see our Cookie Policy.

9. International Transfers

We are based in Hong Kong and our primary storage infrastructure is in the European Union. If you are located outside these regions, your data may be transferred internationally. We ensure appropriate safeguards are in place for all transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice in the Service. The date at the top of this page reflects when the policy was last updated.

11. Contact

For privacy-related questions or to exercise your rights, contact us at: