Data Deletion

Effective date: April 16, 2026

This page explains how to request deletion of your personal data and your store's data from Hepto. We comply with GDPR Article 17 (right to erasure), Shopify's GDPR requirements, and Meta Platform Terms on user data deletion.

1. What gets deleted

On request, we permanently delete the following:

• Your account record (name, email, company, website).
• Your shop's connection records (Shopify, Meta, TikTok, Pinterest, Google, YouTube, Snapchat tokens).
• All generated creatives (text, images, video) tied to your shop.
• All performance metrics, audit log entries, and usage counters tied to your shop.
• Cached images and video files stored in our object storage.

We retain anonymised, aggregated statistics (e.g., total number of creatives generated platform-wide) that cannot be traced back to you.

2. How to request deletion

2a. Shopify merchants

Uninstalling the Hepto app from your Shopify store triggers Shopify's shop/redact webhook, which we honour by deleting your shop's data within 30 days. You do not need to contact us separately.

2b. Direct request (any user)

Email hello@hepto.ai with the subject line "Data deletion request". Include:

• The email address associated with your account.
• Your Shopify store domain (if applicable).
• Any connected social accounts you want us to disconnect.

We respond within 72 hours and complete deletion within 30 days. We may ask you to verify your identity before we process the request.

2c. Meta (Facebook / Instagram) users

If you connected a Facebook or Instagram account to Hepto and want the connection removed along with any cached Meta data, email the address above. You can also remove Hepto from your connected apps in your Facebook or Instagram settings, which will trigger our token revocation handler.

3. What we cannot delete

We cannot delete:

• Content you have already published to third-party platforms (Instagram posts, TikTok videos, etc.). You must delete those from the respective platform.
• Records we are legally required to retain (e.g., invoices for tax purposes — retention period defined by applicable law).
• Copies held by third-party sub-processors after we have issued the deletion instruction; they are contractually obliged to delete on the same timeline but we cannot verify their internal systems directly.

4. Timelines

• Acknowledgement: within 72 hours of request.
• Completion: within 30 days of verified request.
• Confirmation: we email you confirming deletion is complete.

5. Contact

Questions about data deletion or this page: hello@hepto.ai.