DRAFT - for counsel review
Privacy Policy
The short version. We collect what we need to run Hour Zero: your email address, the brand profiles and decisions you enter, usage records and billing status. We use it to provide the service, not to advertise to you. We do not sell or share personal information, we do not use tracking pixels, and we do not use your data to train AI models. Trend snapshots are deleted after 30 days, and account data within 30 days of closing your workspace.
1. Who we are
Hour Zero is operated by Farasu Holdings LLC, a Delaware limited liability company at [registered address, Dover, DE] ("we", "us"). Contact: hello@farasuholdings.com.
For account and billing information, and for running and improving the service, we are the controller (or "business" under California law). For the brand and workspace content our customers enter, we act on our customer's behalf as a processor (or "service provider"). [Counsel: confirm this split, and whether a UK/EU representative is needed.]
Hour Zero is a business tool. This policy applies to the website, the web app, the daily email and Slack digests, and related support.
2. Information we collect
Information you give us
- Account email. Your email address, used to send one-time sign-in links. We do not use passwords.
- Workspace and team. Workspace name, time zone, digest time and preferences, and the email addresses of team members you invite, with their role.
- Brand profiles. For each brand: name, description, website address, audience, tone of voice, hard lines, the formats and channels you use, regions, campaigns and notes. These describe businesses, but they may contain personal information if you include it (for example, a presenter's name).
- Decisions and feedback. Your "use it", "later" and "not for us" decisions on ideas, any reasons you give, and "Report a problem" flags.
- Slack webhook. If you connect Slack, the incoming webhook URL you paste, used only to post your workspace's digest to the channel you chose. We never show the full URL back in the app or in our responses.
- Support messages. What you send us by email.
Information created when you use the service
- Usage and AI metering. Records of ideas generated, AI calls made for your workspace (counts, model used, tokens and cost), brand-profile drafts requested and digests sent, so we can apply plan limits and control costs.
- Website fetch. If you ask us to draft a brand profile from a website, we fetch that one public page, extract its visible text and send it to our AI provider to produce a draft. The page text and the draft are not saved unless you save the profile.
- Technical logs. IP address, browser type, request times and error logs, created by our hosting, database and email providers when you use the service or open a link. Email delivery records (sent, delivered, bounced) and unsubscribe choices.
- Billing. When you subscribe, Stripe collects your payment details directly. We receive and store your Stripe customer and subscription IDs, plan, billing period, payment status and billing email. We do not receive or store card numbers.
Public trend data
To find trends we collect public data from sources such as Google Trends, Bluesky, Wikimedia pageviews, Hacker News and YouTube: search terms, topic names, article or post titles, links, ranks, counts and, for YouTube, video titles, channel names and thumbnails. This is about what is popular, not about you, and we do not build profiles of the people who created it.
3. How we use it
- To sign you in, run your workspace and enforce plan limits.
- To score trends against your brand profiles and write ideas for your workspace, including by sending your brand profile and the relevant trend data to our AI provider.
- To send the daily digest by email and, if connected, to Slack, and to send service messages (sign-in links, billing and important changes).
- To take payment and manage subscriptions through Stripe.
- To use your decisions and feedback to improve the ideas shown to your workspace and to find and fix quality problems.
- To keep the service secure, prevent abuse, and meet legal obligations.
We do not sell personal information, use it for targeted advertising, or use your customer data to train AI models. Your workspace data is never shown to other customers.
4. Legal bases (UK and EU users)
Where the UK GDPR or EU GDPR applies, we rely on:
- Contract - to provide the service you signed up for (account, workspace, ideas, digests, billing);
- Legitimate interests - to secure, support and improve the service, measure data quality and prevent abuse, balanced against your rights;
- Legal obligation - to keep tax and billing records and respond to lawful requests; and
- Consent - where we ask for it, for example for optional emails. You can withdraw consent at any time.
5. Sub-processors
We use these providers to run the service. Each processes data only to provide its service to us, under contract.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in and server functions | All account, workspace and usage data | US |
| Anthropic, PBC | AI generation of scores, ideas and profile drafts | Brand profiles, trend data, fetched website text | US |
| Resend (Plus Five Five, Inc.) | Sign-in and digest emails | Email address, email content | US |
| Stripe, Inc. | Payments and subscriptions | Billing contact, payment details, subscription | US and other locations |
| Cloudflare, Inc. | Website hosting, content delivery and security | IP address, request logs | Global network |
| Google LLC (YouTube API Services) | Public YouTube data shown in the app | No customer personal data is sent | US |
| Slack Technologies, LLC | Digest delivery, only if you connect it | Digest content sent to your webhook | US |
Anthropic does not use inputs or outputs from its commercial API to train its models. [Counsel: confirm legal entity names and add Meta Platforms, Inc. when Instagram goes live.]
6. International transfers
We are based in the United States and our providers mainly process data in the US. If you are in the UK, EU or elsewhere, your information will be transferred to the US. Where required, we rely on safeguards such as the EU-US Data Privacy Framework and its UK Extension where a provider is certified, or the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. [Counsel: confirm which mechanism applies for each provider.]
7. How long we keep it
| Data | Kept for |
|---|---|
| Trend snapshots (public trend data) | 30 days, then deleted |
| YouTube data | Refreshed or deleted within 30 days (see section 13) |
| Account data (email, workspace, settings, brand profiles) | While your account or workspace is active, plus 30 days |
| Decisions and feedback | While the workspace is active, then deleted with it |
| Usage and AI metering records | While the workspace is active, plus 30 days |
| Internal pipeline run records | Up to 90 days |
| Billing and tax records | As long as the law requires (typically up to 7 years) [counsel to confirm] |
| Technical logs held by our providers | Per the provider's retention, typically short [confirm periods] |
Backups are overwritten in the normal backup cycle [confirm period with Supabase plan].
8. Security
- All connections to the service use encryption in transit (HTTPS/TLS), and our database provider encrypts data at rest.
- Workspaces are isolated from each other at the database level: row-level security means each request can read only the data of workspaces its signed-in user belongs to.
- Sign-in uses one-time email links rather than passwords. Secrets such as Slack webhooks and API keys are never returned to the browser.
- Only a small number of authorised people can access production systems, and only to run and support the service.
No system is completely secure. If we become aware of a breach affecting your personal information, we will notify you and regulators as the law requires.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you;
- correct it if it is wrong;
- delete it;
- export it in a portable format;
- object to or restrict some processing, and withdraw consent; and
- complain to a data protection authority (in the UK, the Information Commissioner's Office).
To use these rights, email hello@farasuholdings.com from your account email. We may need to verify your identity. We reply within 30 days (45 days where California law applies). If you are a team member of a customer's workspace, we may refer requests about workspace content to that customer. We will not treat you differently for exercising your rights.
10. California notice
In the last 12 months we have collected these categories of personal information: identifiers (email address, IP address), commercial information (plan and billing status), internet or network activity (usage records and logs), and professional information (business and brand details you enter). We collect them from you, your device and your team, for the purposes in section 3, and disclose them only to the service providers in section 5.
We do not sell or share personal information, as those terms are defined in the California Consumer Privacy Act, and have not done so in the last 12 months. We do not use or disclose sensitive personal information for purposes that would give a right to limit. You may use the rights in section 9, or have an authorised agent do so for you.
11. Cookies and local storage
We use only what is essential for the service to work. When you sign in, your browser stores a session token in local storage so you stay signed in, and the app remembers small preferences such as your last workspace. We do not use advertising cookies, analytics trackers or tracking pixels, on the website, in the app or in our emails. [Confirm with Resend that open and click tracking is switched off.]
12. Children
Hour Zero is a business service and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.
13. YouTube API Services
Hour Zero uses YouTube API Services. By using features that display YouTube content, you agree to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy at https://policies.google.com/privacy.
- What we store: public YouTube data only - video titles, links, thumbnails, view counts, publish times and channel names - from YouTube's trending lists and public search results.
- How long: this data is refreshed or deleted within 30 days.
- How it is used: it is shown in the app and digest as YouTube provides it, labelled "From YouTube". It is not used to calculate our trend scores or ideas.
- Your YouTube account: we do not ask you to sign in with Google or YouTube and we do not access any user's YouTube account or private data. If that ever changes, you will be able to revoke access at Google's security settings page.
- We do not place cookies or other tracking on your device in connection with YouTube data.
14. Instagram (when available)
This feature is not live yet. When it is, it will work like this:
- A workspace owner or editor may choose to connect an Instagram Business or Creator account in Settings, using Meta's own login screen.
- We will use Meta's APIs only to run hashtag searches for your workspace (for example, hashtags related to your brands), within Meta's limit of 30 hashtags per account every 7 days. We will not post, comment, send messages or read your private messages, and we will not access other people's private data.
- We will store the access token Meta issues (encrypted), your connected account's ID and username, the hashtags searched, and the public post data Meta returns (such as post links, captions, media type, like and comment counts and timestamps). Results stay in your workspace and are not shown to other customers.
- Hashtag results will be deleted within 30 days. You can disconnect at any time in Settings or from your Instagram or Facebook settings, and we will delete the token and connected account details within 30 days [target: immediately on disconnect].
- To ask us to delete Instagram data, follow the steps in section 15 or at our data deletion page.
15. Data deletion instructions
You can ask us to delete your account, a workspace, or any Instagram data we hold:
- Email hello@farasuholdings.com from the email address you use to sign in, with the subject Delete my data.
- Say whether you want your whole account deleted or a specific workspace closed. Only a workspace owner can close a workspace.
- If you connected Instagram, you can also remove Hour Zero in Instagram under Settings, then Apps and websites, or in Facebook under Settings, then Business integrations.
- We confirm receipt, verify the request comes from the account email, and confirm completion within 30 days.
Full details of what is deleted are on our data deletion page.
16. Changes to this policy
We will post any changes on this page with a new "last updated" date. If a change is material, we will tell workspace owners by email or in the app before it takes effect.
17. Contact
Farasu Holdings LLC
[registered address, Dover, DE]
hello@farasuholdings.com