Privacy Policy / プライバシーポリシー

1. About Trendio

Trendio is a customer engagement platform that helps small-to-medium businesses respond to Instagram and TikTok comments, manage customer records, and analyze audience insights. Trendio is operated by HelixPlus Inc.(the "Operator").

2. Data We Collect

We collect the following data only when a customer of Trendio ("User") explicitly connects their Instagram or TikTok account through OAuth:

• Account identifiers: Instagram Business Account ID, TikTok open_id, account display name, profile picture URL.
• Access tokens: short-lived and long-lived OAuth access tokens issued by Meta / TikTok, stored encrypted at rest.
• Comments: text, timestamp, commenter username and profile picture URL of comments posted to the User's Instagram media.
• Insights: account-level follower count, impressions, reach, follower demographics (gender / age range / region) — aggregated values only, no individual follower PII.
• Trendio account info: email, company name, encrypted password (hashed by Supabase Auth, never visible to Operator), login timestamps.

3. How We Use the Data

• Display the User's account insights and audience analytics on the Trendio dashboard.
• Generate AI-assisted reply drafts for incoming comments (processed by Anthropic Claude API; see Section 5).
• Maintain a customer record (CRM) of commenters who have interacted with the User's account.
• Detect and log automated replies (subject to User-defined rules) for audit purposes.

We do not use the data for advertising, profile building outside Trendio, resale, or any purpose unrelated to the features the User has enabled.

4. Legal Basis

We process data on the basis of (a) the User's consent given at OAuth time, and (b) performance of the service contract.

5. Third-Party Processors

We share data with the following third parties strictly for service delivery:

• Meta Platforms, Inc.— provides the Instagram Graph API. Subject to Meta's data policies.
• TikTok Pte. Ltd.— provides the TikTok API. Subject to TikTok's data policies.
• Anthropic, PBC— operates the Claude AI API used to generate reply drafts. Only the specific comment text and the User's rule configuration are sent; no account identifiers are forwarded.
• Supabase Inc. — database and authentication infrastructure (Tokyo region).
• Vercel Inc. — application hosting.

We do not sell personal data or share it with any third party for advertising purposes.

6. Retention

We retain data for as long as the User maintains an active Trendio account. Upon account deletion or disconnection of a SNS account, we delete the associated access tokens immediately and other associated records within 30 days. Aggregated, anonymized statistics may be retained indefinitely for service improvement.

7. Your Rights — Data Deletion

You may request deletion of your data at any time by:

• Disconnecting your Instagram / TikTok account in Settings → SNS Connections → Disconnect; or
• Deleting your Trendio account by contacting our support; or
• For Meta users: using Meta's "Apps and Websites" settings to revoke Trendio's access. Meta will notify our Data Deletion Callback at /api/meta/data-deletion and we will delete all associated records within 30 days.

8. Security

Access tokens are stored encrypted at rest. Passwords are hashed by Supabase Auth (we never store or view plaintext passwords). All traffic is over HTTPS. Row-Level Security ensures Users can only access their own data.

9. International Transfers

Data is primarily stored in Tokyo (Supabase ap-northeast-1). Third-party processors (Meta, TikTok, Anthropic, Vercel) may process data in their respective regions.

10. Children

Trendio is not intended for children under 18 and we do not knowingly collect data from them.

11. Changes

We will notify Users of material changes by email or in-app banner at least 14 days before they take effect.

12. Contact

Privacy questions: [email protected]
Postal: HelixPlus Inc., Japan