Privacy policy

Who is responsible

Hooky is published by theAppsfactory, a simplified joint-stock company (SAS) with share capital of €1,000, 24 rue Abel Gance, 84100 Orange, France, registered with the Trade and Companies Register (RCS) of Avignon under number 821 324 332 (“we”).

For any question about your data, write to us at support@heyhooky.com.

This policy applies to the heyhooky.com site, the web workspace, the Hooky apps (iPhone, iPad, Mac and Android), the chat bubble and the API.

Two different roles

• For your own data (your profile, your account, your subscription), we are the controller within the meaning of the GDPR.
• For the data of your sites’ visitors (their messages, their email if they leave it, your sites’ stats), you, or the business that publishes the site, are the one responsible for it. Hooky processes it on your behalf, as a processor, according to your instructions and the terms of use. So it’s up to you to inform your visitors, for example in your site’s privacy policy, by mentioning Hooky.

What we collect about you

When you create a profile, log in or use Hooky:

Hooky doesn’t keep any passwords: login goes through Google Firebase Authentication. We don’t store your profile picture. We don’t use your data to show you ads, and we don’t sell it.

Your sites’ visitors’ data

When a visitor writes in a site’s Hooky bubble, we process, on the site’s behalf:

• their messages, with their date and read status;
• the photos and files they send (photos, PDFs): photos are resized and stripped of their metadata (EXIF, GPS location), and the original isn’t kept;
• their name and email address, only if they choose to leave them, so they get replies by email;
• the address of the page they’re writing from, their language and their time zone (provided by the browser), to reply in their language and at their local time;
• a conversation token, kept in the browser’s local storage on the site, so they find their conversation on their next visit. The bubble sets no cookies.

Stats. The events the site sends (Hooky.track("inscription") or the API) are counted with no visitor identifier: an event name, an optional value, the date and the properties chosen by the site. Stats don’t follow anyone from one page or site to another. The site must not put any personal data in them (email, name, phone number).

Channels. Notifications a site posts to its channel are kept for 90 days, then erased. They must not contain any personal data.

Are you a visitor to a site that uses Hooky and want to access your messages or have them erased? Contact the site in question first. You can also write to us: we’ll pass your request on to the site.

Usage measurement and crashes in the app

The Hooky apps use two Google tools:

• Firebase Crashlytics: when the app crashes, a technical report is sent (device model, system and app version, error trace), so we can fix the bug.
• Google Analytics for Firebase: usage measurement of the app (screens viewed, and events such as logging in, creating a site, sending a message or making a purchase), linked to your Hooky identifier, without your email or the content of your messages. It helps us understand what works and what gets stuck in the app.

Neither uses an advertising identifier, and no data is used for advertising: ad data storage and sharing are denied (Google Consent Mode). You can turn both off at any time in the app, in the Me tab, with the “Anonymous usage statistics” setting. The web workspace and the heyhooky.com site have no audience measurement at all.

Cookies and local storage

No advertising cookies or third-party trackers on heyhooky.com. The site and the workspace only keep, in your browser:

• the hooky_lang cookie, your language when you choose it (1 year);
• your session, your language and your theme (light or dark) in local storage, and Firebase’s login state;
• on your clients’ sites, the bubble only keeps the visitor’s conversation token (see above).

All of this is needed for the service or keeps a choice you made: no consent is requested.

Payments

We never see your card number.

• On the web, payment goes through Stripe, which collects your payment details and issues the invoices. We only keep your Stripe customer identifier and your subscription status.
• In the app, purchases go through the App Store (Apple) or Google Play. They process payment under their own privacy rules; we receive a signed proof of purchase (product, dates, transaction identifier) to activate your plan.

Who else sees this data

In your account, your team members see the conversations and stats of the sites they have access to. Otherwise, only our technical processors, each for its own task:

We may also disclose data if the law requires us to (at the request of an authority, for example).

Transfers outside the European Union

Some providers are based in the United States or process data there. These transfers are covered by the EU–U.S. Data Privacy Framework when the provider is certified under it, and by the European Commission’s standard contractual clauses.

How long

When you delete your profile, your replies stay in the conversations of accounts where others work, but without your name.

Security

Everything goes over HTTPS. Session tokens are only kept as hashes, API keys are encrypted in the database, and server access is restricted. Each team member only sees the sites they’ve been given access to.

Your rights

You can at any time request access to your data, its rectification, erasure or portability, object to processing based on our legitimate interest or request its restriction, and give instructions on what happens to your data after your death.

• Delete your profile: in the app, Me tab › Delete my profile; in the web workspace, My profile › Delete my profile. Accounts where nobody else works are erased along with their sites and conversations, and their Stripe or Google Play subscriptions canceled. An App Store subscription is canceled in your Apple account settings.
• Delete an account (and all its sites): at the bottom of the Team page, for the owner.
• To also erase your login identity at Firebase, or for any other request, write to support@heyhooky.com. We reply within one month.

If you believe your rights aren’t being respected, you can lodge a complaint with the CNIL (cnil.fr), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or the data protection authority of your country.

Minors

Hooky is a tool for people who run websites. It isn’t intended for children under 15, and we don’t knowingly collect their data.

Changes

If this policy changes in a significant way, we’ll let you know by email or in the app before the change takes effect. The date of the last update is at the top of this page.