Privacy Policy

How Huat handles information belonging to you and to the people who interact with your connected publishing accounts.

Last updated 21 October 2026.

Who we are

Huat is operated by 1UP! Sales AI Technologies Pte. Ltd., Singapore. You can reach us at ops@1upsalesai.com.

What Huat does

Huat connects to publishing accounts a business chooses: Instagram professional accounts, Facebook Pages, YouTube channels, and TikTok creator accounts. Huat publishes content the business gives us. On Instagram, it can also reply to comments and direct messages.

The business is the owner of that data. We process it on their instructions.

What we collect

From the business using Huat

• The account or Page ID, display name, approved scopes, and encrypted access and refresh tokens issued by Instagram, Facebook, YouTube, or TikTok when they connect.
• Content they ask us to publish: images, video, captions.
• The automation settings they configure: keywords, reply text, disclosure wording.

From people who interact with that business on Instagram

• The text of comments left on the business's posts, and of direct messages sent to it.
• The Instagram-scoped ID and username of the person who sent it.
• A record of any automated reply we sent, and whether the person asked to stop receiving them.

We do not collect email addresses, phone numbers, payment details or location from people who comment or message. We do not buy or receive personal data from anywhere else.

Why we hold it

Only to deliver the publishing or Instagram engagement service the business asked for and to obey each connected platform's rules. For example, we store a platform post ID to show its result and avoid creating the same public post twice.

We do not sell personal data. We do not use it to train models that serve anyone other than the business it belongs to. We do not share it with advertisers.

Google and YouTube data

If a business connects YouTube, Huat asks Google for permission to upload videos to the channel the business chooses and to read that channel's ID, name and picture, so the business can see where a video will go. If the business turns on YouTube comment replies, Huat also asks for permission to read comments on that channel's videos, to post the replies the business has set up, and to hold, approve or remove comments when the business asks.

Huat stores the channel's ID, name and picture; the IDs of videos Huat uploaded and their view, like and comment counts; and, where comment replies are on, the comments Huat read and the replies it posted. Huat does not read viewing history, subscriptions, playlists or contacts. It never sells this data, uses it for advertising, or combines it across businesses.

Huat's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google handles information under the Google Privacy Policy.

Cookies and device storage

Huat places a strictly necessary, secure session cookie in your browser after you connect an account. It lets Huat keep you signed in to the connected publisher for up to 30 days. Huat does not use advertising or analytics cookies. Google and YouTube may place, access, or recognise cookies or similar technology on your browser when you visit their consent pages or services; their use is governed by the Google Privacy Policy linked above.

Who we share it with

• Meta Platforms, Google/YouTube, and TikTok — only for a platform the business connects and asks Huat to publish to.
• Cloudflare — our hosting provider, which stores the data at rest.

Nobody else. We do not transfer personal data to any other third party.

How long we keep it

• Access tokens: until the business disconnects, or the token expires and is not renewed.
• YouTube: the channel's ID, name and picture are refreshed from YouTube at least every 28 days, and deleted if Huat cannot refresh them by day 30. Video IDs, view, like and comment counts, comments and reply records are deleted from Huat within 29 days. The video a business gives Huat to publish is that business's content, not data Huat received from YouTube, and is kept like any other media the business uploads.
• Instagram, Facebook and TikTok comment and message records: 24 months, then deleted.
• Opt-out records: kept indefinitely, because deleting them would mean we could start messaging someone again after they asked us to stop.

How your data is protected

Access tokens are encrypted at rest with AES-GCM. All traffic runs over HTTPS. Access to production data is limited to the people who operate the service.

How to have your data deleted

Four ways, all of which work:

1. If you are a business using Huat — disconnect the account from inside the app. Huat discards its stored token and stops new work. Disconnecting YouTube revokes Huat's access at Google and deletes stored YouTube API data within seven days. To request deletion of all remaining Huat records and media, email ops@1upsalesai.com; we complete requests within seven days. Deleting data from Huat does not delete any video or comment held by YouTube.
2. Through Google — revoke Huat's access from your Google Account connections. Huat then deletes stored YouTube API data within 30 days. To delete a video or comment held by YouTube, use YouTube itself.
3. If you commented on or messaged a business that uses Huat — email ops@1upsalesai.com with your Instagram username. We will delete your records and confirm within 30 days.
4. Through Instagram — remove Huat from your Instagram account's connected apps. Instagram notifies us and we delete your data automatically. You will be given a confirmation code and a link to check the status of that deletion.

Your rights

Under Singapore's PDPA, and under the GDPR where it applies, you may ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Write to ops@1upsalesai.com.

Children

Huat is a business tool and is not directed at anyone under 18.

Changes

If we change this policy we will update the date at the top and, where the change is significant, tell connected businesses directly.