Privacy Policy

Last updated: September 16, 2026

GDPR Compliant · LOPDGDD (Spain)

1. Controller

WEEBEE DESIGN, S.L.
Calle Gremi de Fusters 33, Local 6
07009 Palma de Mallorca, Spain
Email: fabian@hiddin.app
Tax ID: ESB01597624

2. What Data We Collect

We collect the following personal data when you use Hiddin:

• Restaurant owners: Name, email address, business name, address, phone number, payment information (via Stripe)
• Influencers: Name, email address, TikTok, Instagram, Facebook Page and YouTube profile data (display name, follower/subscriber counts, engagement of recent posts, avatar), bank account details (IBAN) for payouts
• Super-Influencers: Name, email address, phone number, IBAN, tax status, tax identification number, country of residence, VAT identification number (for recruitment commissions)
• Scouts: Name, email address, phone number, IBAN, tax status, tax identification number, country of residence, VAT identification number (for recruitment commissions)
• Newsletter subscribers: Email address, first name, city (optional), preferred language, subscription source
• All users: IP address, device information, usage data, cookies

3. TikTok Integration (TikTok Login Kit)

When you connect your TikTok account to Hiddin, we access the following data via the TikTok Login Kit API:

• user.info.basic: Your TikTok open ID, display name and profile picture. Used to identify the connected account inside Hiddin.
• user.info.profile: Your TikTok username (@handle). Shown on the connected card so you can see which account is linked.
• user.info.stats: Your follower count, following count, likes count and video count. Follower and video counts are shown in the app and feed your Hiddin Score.
• video.list: Like, comment and share counts of your last 20 public videos. Used only to compute your average engagement rate.

We do not post content on your behalf. We do not store your TikTok credentials. You can disconnect your TikTok account at any time in Hiddin (Settings → Social Media → TikTok → "Disconnect"); we then revoke the token and delete the stored TikTok data.

4. Instagram Integration (Instagram API with Instagram Login)

When you connect your Instagram Business or Creator account to Hiddin, we access the following data via the Instagram API (Business Login for Instagram):

• instagram_business_basic: Your Instagram username, profile picture, account type (Business/Creator), follower count, media count and the engagement of your recent posts. Used to display your verified influencer profile inside Hiddin.
• instagram_business_manage_insights: Reach over the last 28 days, follower change over the last 30 days and the cities and countries of your followers. Used to calculate your "Hiddin Score" (0–100) which restaurant owners see when browsing the influencer marketplace. Restaurants never see raw insight data — only the aggregated score.

5. Hiddin Score and Automated Decision-Making

Hiddin calculates a Hiddin Score (0–100) for each influencer profile, which determines visibility in the restaurant search marketplace. The score is calculated using the following parameters and weightings:

• Engagement Rate: 30%
• Follower Count: 20%
• Local Reach: 20%
• Lead Quote (conversion rate): 20%
• Fake Follower Ratio: 10%

This is an automated individual decision under Article 22 of the GDPR. Influencers with a score below 40 are not shown in the restaurant search. You have the right to request manual review of your score by a Hiddin staff member. Requests are processed within 14 days, and you will receive a detailed explanation of the reasoning. Contact fabian@hiddin.app to request a review.

6. Facebook Page Integration (Facebook Login for Business)

When you connect a Facebook Page you manage to Hiddin, we access the following data via the Meta Graph API:

• pages_show_list: The list of Facebook Pages you manage, so you can pick the Page to connect.
• pages_read_engagement: The Page's follower and like counts and the engagement of its recent posts. Used to calculate your Hiddin Score.

What we do NOT do (Instagram and Facebook): We do not post on your behalf, we do not read your DMs, we do not access your contacts, we do not manage ads on your account. We do not sell your data to third parties.

Storage & Refresh: Access tokens are encrypted (AES-256-CBC) and stored only on our EU-hosted backend. Insights are refreshed on demand ("Refresh") and cached on our servers. Tokens can be revoked at any time.

Disconnect: You can disconnect your Instagram account or Facebook Page at any time inside Hiddin (Settings → Social Media → "Disconnect") or via your Facebook Settings → Apps and Websites → Hiddin → Remove. We then permanently delete all Instagram and Facebook data within 30 days, as confirmed by our Data Deletion Callback.

7. YouTube Integration (YouTube Data API)

Hiddin uses YouTube API Services. When you connect your YouTube channel to Hiddin (Settings → Social Media → "Connect with YouTube"), you sign in with Google and grant the read-only scope youtube.readonly. We then access the following data via the YouTube Data API:

• Your channel title, custom URL and thumbnail. Used to show the connected channel inside Hiddin.
• Your channel statistics: subscriber count, video count and total view count. Used to calculate your Hiddin Score.
• Like, comment and view counts of your most recent videos. Used only to compute your average engagement rate.

We do not upload, edit or delete videos, we do not read comments' contents or private data, and we do not post on your behalf. Restaurants only see the aggregated Hiddin Score, never your raw YouTube data.

Google API Services User Data Policy: Hiddin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting your YouTube channel you also agree to the YouTube Terms of Service; Google's handling of your data is described in the Google Privacy Policy.

Storage & Refresh: Google access and refresh tokens are encrypted (AES-256-CBC) and stored only on our EU-hosted backend. Channel statistics are refreshed on demand ("Refresh") and cached on our servers for up to 30 days.

Disconnect: You can disconnect your YouTube channel at any time inside Hiddin (Settings → Social Media → YouTube → "Disconnect"); we then revoke the token and delete the stored YouTube data. You can also revoke Hiddin's access in your Google Account security settings.

8. Legal Basis for Processing

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Hiddin service
• Legitimate interests (Art. 6(1)(f) GDPR): Fraud prevention, platform security, analytics
• Consent (Art. 6(1)(a) GDPR): Newsletter subscriptions, marketing cookies, social media connections
• Legal obligation (Art. 6(1)(c) GDPR): Tax records, invoicing

9. How We Use Your Data

• Providing and improving the Hiddin platform
• Matching influencers with restaurant campaigns
• Processing payments and payouts
• Sending transactional emails (password reset, payout notifications, invoices)
• Sending newsletter campaigns (only with explicit double opt-in consent)
• Fraud prevention and platform security
• Legal compliance and tax obligations

10. Data Sharing

We share your data only with:

• Stripe: Payment processing (USA — Standard Contractual Clauses apply)
• Resend: Email delivery (EU — based in EU, GDPR-compliant)
• Anthropic: AI-powered features (USA — Standard Contractual Clauses apply)
• OpenAI: Voice transcription (USA — Standard Contractual Clauses apply)
• Wise / PayPal: Payouts to influencers (EU/USA — Standard Contractual Clauses apply)
• Meta Platforms: Analytics and advertising (USA — Standard Contractual Clauses apply)

We never sell your personal data to third parties.

11. Data Retention

• Account data: Retained for the duration of your account + 3 years after deletion
• Invoice and payment data: 10 years (Spanish tax law requirement)
• Newsletter subscriptions: Until you unsubscribe or request deletion
• Server logs: 90 days

12. Your Rights

Under GDPR and LOPDGDD, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain types of processing
• Restriction: Request restricted processing

To exercise your rights, contact us at fabian@hiddin.app or use our Data Deletion Request page.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es

13. Cookies

We use the following cookies:

• Essential: Required for the platform to function (session, authentication)
• Analytics: Anonymous usage statistics to improve the platform (only with consent)
• Marketing: Meta Pixel for advertising measurement (only with consent, Pixel ID: 808552888395713)

14. Signing in with Apple and Google

You can sign in to Hiddin with an email address and password, with your Apple ID ("Sign in with Apple"), or with your Google account. When you sign in with Apple or Google, we receive your name and email address and an identifier that lets us recognise your account. We never receive a password.

If you choose Apple's "Hide My Email" option, we only receive the relay address Apple generates. The legal basis is Art. 6(1)(b) GDPR (performance of a contract: providing your account). Apple's and Google's own processing is governed by their privacy policies: Apple and Google. You can revoke the connection at any time in your Apple or Google account settings.

15. Hosting and Processors

Our servers are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in their Nuremberg data centre. Hetzner processes the data solely on our behalf.

We also use the following service providers. Each receives only the data required for its task:

• Stripe – credit top-ups and card payments.
• PayPal – payouts to influencers, super-influencers and scouts.
• Wise – payouts by bank transfer.
• Resend – delivery of our emails, including newsletters to guest contacts.
• Anthropic – analysis of images and text for newsletter creation and design checks.
• Expo – delivery of push notifications (see section 18).
• Sentry – logging of technical errors to keep the service stable.
• api.qrserver.com – generation of QR code images. Only the link contained in the code is transmitted, never names or email addresses.

Where a provider is located outside the EU, transfers are covered by the European Commission's Standard Contractual Clauses. We conclude data processing agreements under Art. 28 GDPR with all providers.

16. Reviews

On the explicit instruction of a restaurant, we report individual Google reviews to Google for assessment. For this we process the publicly visible details of the review – its text, star rating, the reviewer's displayed name and the date – together with the reason the restaurant gives us.

This data comes from the publicly accessible business profile, not from accounts we maintain. We keep it only while the report is being processed and delete it afterwards. The legal basis is Art. 6(1)(f) GDPR (the restaurant's legitimate interest in having potentially inadmissible reviews examined). Google alone decides whether a review is removed.

17. Advertising via Meta

On request we set up and manage advertising campaigns on Meta (Facebook and Instagram) for a restaurant. We process the restaurant's details about the offer, budget and target area, together with its ad account identifier.

Audiences are defined by location, age and interests. We do not transfer guest contacts, email addresses or customer lists to Meta, and we do not build Custom Audiences from your data. Campaign figures (reach, clicks, cost) are retrieved from Meta in aggregate and shown to the restaurant. The legal basis is Art. 6(1)(b) GDPR in relation to the restaurant. Meta is independently responsible for processing within its own systems; see the Meta Privacy Policy.

18. Push Notifications

If you use our app and allow notifications, your device generates a random identifier (push token) which we store in order to alert you to new guest contacts, payouts or messages. Delivery runs through Expo and the systems operated by Apple and Google.

The token is not linked to a person and carries no content. The legal basis is your consent, Art. 6(1)(a) GDPR. You may withdraw it at any time by turning notifications off in your device settings or in the app; we then delete the token.

19. Contact

For any privacy-related questions:
Email: fabian@hiddin.app
Address: WEEBEE DESIGN, S.L., Calle Gremi de Fusters 33, Local 6, 07009 Palma de Mallorca, Spain