Privacy Policy

1. Who this policy covers

It covers everyone who visits re-hook.co, checks whether they qualify, buys a Re-Hook package, connects an Instagram account, or books a call with us. We are the organization responsible for your personal information (the “controller” under laws that use that term). Re-Hook is a service for businesses and professional creators. It is not directed at anyone under 18, and we do not knowingly collect information from anyone under 18.

2. What we collect

Information you give us

• Qualification form: your Instagram handle, name, email address and phone number.
• Purchase: your name, email, billing details and order history. Card details are entered into a checkout operated by our payment processor, Whop. We never receive or store your full card number. With your checkout we receive a reference to your saved payment method, which lets us charge an add-on you choose with one click. We cannot see the card behind that reference.
• Working with us: the videos you choose, your approvals of hooks and edits, and messages you send us by email, phone, text or on a call.
• Booking: the name, email, phone number and time you enter into our booking calendar.

Information we collect about your Instagram account

• Before purchase, from your public profile: when you submit the qualification form we look up the public profile for the handle you entered and read your follower count, whether the account is public or private, and the type and date of your most recent public posts. This is information anyone can see on Instagram. We use it only to decide whether the service is a fit.
• After purchase, with your permission: if you connect your account through Instagram’s own login, Instagram gives us access to your profile details (username, account type, follower count), your posts and reels, performance insights (views, reach, likes, comments, shares, saves) and audience insights, and the ability to publish reels to your account. We never see your Instagram password. We do not read or send direct messages, and we do not read, post or moderate comments.

Information collected automatically

• Server and security logs: IP address, browser type, pages requested and timestamps, kept by our hosting provider to run and protect the site.
• Browser storage: we keep your Instagram handle, name, email, an enquiry reference and the result of your qualification check in your browser’s session storage, so checkout can be pre-filled and your order found after you pay. It is cleared when you close the tab. We do not set advertising cookies. The embedded checkout (Whop) and booking calendar (GoHighLevel) are provided by third parties that may set their own cookies under their own policies.

3. How we use it, and our legal bases

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not use it to make decisions with legal or similarly significant effects by automated means alone: the qualification check applies two simple published rules (audience size and recent posting), and you can ask a person to review the outcome by emailing privacy@re-hook.co.

4. Information from Instagram and Meta

Information we receive through Instagram’s login is used only to provide the service you bought: selecting and measuring your content and publishing the reels you approve. We do not sell it, lend it, use it for advertising, or use it to build profiles unrelated to your order. Nothing is published to your account without your approval of the hooks first, and trial reels are not placed on your main grid.

Your access token is encrypted at rest and is never written to logs. You can disconnect Re-Hook at any time in Instagram under Settings, then Apps and websites. When you disconnect we stop all access immediately, delete the stored token, and delete the Instagram information we hold about your account, keeping only the minimum order and accounting record the law requires.

5. Who we share it with

We share personal information only with service providers that help us run Re-Hook, under terms that limit them to that purpose:

We may also disclose information to professional advisers, to a buyer or successor if the business is sold or reorganized (under the same protections), and where the law requires it or it is needed to protect someone’s rights or safety.

6. Where your information is processed

We are based in Canada. Our service providers process information in Canada, the United States and other countries, where courts and authorities may be able to access it under local law. Where the law requires a transfer mechanism, such as for information from the European Economic Area or the United Kingdom, we rely on the standard contractual clauses or an equivalent safeguard offered by the provider.

7. How long we keep it

• Enquiries that do not become orders: up to 24 months after your last contact with us, or until you ask us to delete them.
• Orders, payments, refunds and the records behind the guarantee: seven years, to meet tax and accounting obligations.
• Instagram access token and account information: while your order is active. Deleted when you disconnect, when you ask, or within 90 days of your last delivery, whichever comes first.
• Performance figures for your reels: kept with your order record; any use as public proof needs your separate permission.
• Server logs: for the limited period set by our hosting provider.

8. How we protect it

Traffic to the site is encrypted with TLS. Instagram tokens are encrypted at rest with AES-256. Database connections are encrypted and certificate-pinned. Payment card data is handled only by our payment processor. Secrets are kept in a dedicated secret store, and access is limited to the people who need it to deliver your order. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify you and the relevant regulator as the law requires.

9. Your rights and choices

Depending on where you live, you have some or all of these rights:

• to know what we hold about you and get a copy of it;
• to have inaccurate information corrected;
• to have your information deleted;
• to withdraw consent, including to marketing, at any time;
• to object to or restrict certain uses, and to data portability;
• not to be discriminated against for exercising a right;
• to complain to your privacy regulator.

To use any of them, email privacy@re-hook.co. We verify the request using the email address or order on file and answer within 30 days. There is no charge.

Deleting your information

Email privacy@re-hook.co with the subject “Delete my data” from the address you used with us, or remove Re-Hook in Instagram under Settings, then Apps and websites, which sends us a deletion request automatically. We delete your Instagram token and account information, your enquiry record and your contact record, and confirm when it is done. We keep only what the law requires us to keep, such as the accounting record of a payment.

Email, phone and text messages

We contact you because you asked us to check your account or because you bought from us. Marketing messages are sent only with your consent. Every email has an unsubscribe link; reply STOP to any text to stop texts. Message and data rates may apply. Opting out of marketing does not stop messages needed to deliver an order you placed.

Regional notes

• Canada: we follow PIPEDA and applicable provincial law, and Canada’s anti-spam legislation (CASL) for commercial electronic messages. You may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.
• European Economic Area, United Kingdom and Switzerland: the legal bases in section 3 apply. You may complain to your local data protection authority.
• California and other US states: we do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for purposes that require a right to limit. The categories we collect are identifiers, commercial information, internet activity, and account information from Instagram, for the purposes in section 3.

10. Links and third-party services

The site embeds a checkout from Whop and a booking calendar from GoHighLevel, and links to Instagram. Those services run under their own privacy policies, which we encourage you to read. Re-Hook is not affiliated with, endorsed by or sponsored by Instagram or Meta Platforms, Inc.

11. Changes to this policy

When we change this policy we update the effective date at the top. If a change materially affects how we use information we already hold about you, we will tell you by email before it takes effect.