Privacy Policy
Hyperval is a marketplace connecting brands with creators — influencers, photographers, clippers, editors, and streamers. This policy explains what personal information we collect, why we collect it, who we share it with, and what control you have over it.
If you have questions about anything here, contact us at admin@hyperval.app.
1. Who we are
Tsireledzo Nemushungwa, trading as Hyperval, of 26 Quinine Road, Kempton Park, Gauteng, South Africa, is the responsible party (data controller) for the personal information described in this policy.
Contact for privacy matters: admin@hyperval.app
2. Information we collect
Information you give us
| Data | Why we collect it |
|---|---|
| Username and email address | To create and secure your account, and to contact you about your account |
| Password | To authenticate you. Stored only as a bcrypt hash — we cannot read your password |
| Account type (influencer, brand, photographer, clipper, editor, streamer) | To show you relevant opportunities and route platform permissions |
| Biography and location | Displayed on your public profile so others can find and assess you |
| Profile and portfolio images | Displayed on your public profile |
| Gigs, applications, and messages | To operate the marketplace and let you communicate with other users |
Information from connected social accounts
If you choose to verify your Instagram account, we receive from Instagram: your account ID, your username, your account type, and your follower count. We store the result of that verification only.
We do not retain the access token issued during that process. It is used once, at the moment of connection, and discarded. We cannot access your social account afterwards, post on your behalf, or read your messages. Connecting is entirely optional, and you can ask us to remove a verification at any time.
Information collected automatically
- IP address — used to rate-limit sign-in and registration attempts, which protects all users against brute-force attacks. Retained for a maximum of 60 minutes.
- Authentication token — stored in your browser's local storage to keep you signed in. This is not a tracking cookie and is not shared with third parties.
- Server logs — technical records of errors and requests, used to keep the service working.
We do not use advertising cookies, third-party analytics trackers, or cross-site tracking of any kind.
3. Automated analysis of your biography
To help buyers find relevant creators, we send the text of your public biography to OpenAI, which returns a standardised category (for example TECH, GAMING, or FASHION) that we display on your profile.
Only your biography text is sent. Your name, email address, and other identifying details are not included. This analysis produces a display label only — it has no legal or similarly significant effect on you, and you can remove it by clearing your biography.
4. Legal basis for processing
We process your personal information because:
- It is necessary to provide the service you signed up for — your account, profile, gigs, and messages.
- You have consented — social account verification, which is optional and revocable.
- We have a legitimate interest — security, fraud prevention, and rate limiting.
- We are required to by law — where retention or disclosure is legally mandated.
5. Who we share information with
We do not sell your personal information. We share it only with the service providers required to operate Hyperval:
| Provider | Purpose | What they receive |
|---|---|---|
| Supabase | Database and file storage | All account and content data |
| OpenAI | Biography categorisation | Biography text only |
| Resend | Transactional email (password resets) | Email address |
| Meta / Instagram | Account verification, if you opt in | Only what is needed to complete the connection you initiate |
| Render | Application hosting | Technical request data |
Hyperval does not currently process payments and does not collect payment or card details. If that changes we will update this policy and notify registered users before the change takes effect.
Anything you put on your public profile — your username, biography, location, portfolio, verified follower counts, and posted gigs — is visible to other users and to the public. Your email address is never shown publicly.
6. Where your information is stored
Your data is stored on servers in the European Union. Some of our service providers process data in other countries; where that happens, we rely on the safeguards those providers have in place for international transfers.
7. How long we keep it
- Account data — for as long as your account exists.
- Password reset tokens — 15 minutes, then automatically deleted.
- Rate-limiting records — up to 60 minutes.
- Messages and gigs — for as long as your account exists, subject to routine cleanup of stale records.
When you delete your account, we permanently delete your profile, gigs, applications, messages, portfolio items, uploaded images, and social verifications. This cannot be undone.
8. Your rights, and how to delete your data
You have the right to:
- Access the personal information we hold about you.
- Correct anything inaccurate — most fields are editable directly in your profile settings.
- Delete your account and all associated data, from your account settings, at any time.
- Withdraw consent for social verification, without affecting the rest of your account.
- Object to or restrict certain processing.
- Complain to your data protection regulator if you believe we have mishandled your information.
To exercise any of these, email admin@hyperval.app. We respond within 30 days.
9. Security
Passwords are hashed with bcrypt and are never stored or transmitted in readable form. Sessions use signed tokens. All traffic is encrypted in transit. Sign-in attempts are rate-limited. Access to production systems is restricted.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulator as required by law.
10. Children
Hyperval is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will remove it.
11. Changes to this policy
If we make material changes, we will update the date at the top of this page and notify registered users by email before the changes take effect.