Effective date: 10 September 2026
This policy explains what personal data Hookshift collects, why, who it is shared with, and what you can do about it. It is written to be read, not to be survived.
Estanislao Fusion Gustav-Gull-Platz 4 8004 Zurich Switzerland
support@hookshift.co
Estanislao Fusion operates hookshift.co and the Hookshift service, and is the controller of the personal data described here under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU and UK General Data Protection Regulation.
Hookshift is a tool for testing creative variants of short video. You connect an Instagram professional account, upload video, supply hook text, and Hookshift renders variants and, if you ask it to, publishes them to your own account as Instagram trial reels and reads back their performance.
Everything Hookshift does with your Instagram account is done on your instruction, to your own account. It does not act on any other account, and it does not read, collect or store data about accounts other than yours.
Account data. Your email address and, if you provide one, your name. Created when you sign up.
Instagram data. When you connect Instagram, Hookshift receives and stores:
Hookshift collects metrics only for reels it published for you, plus your account-level follower count. It does not collect metrics for the rest of your content, and it does not collect data about your followers as individuals.
Content you upload. Video files, hook text and captions you provide, and the rendered variants Hookshift produces from them. If you enable subtitles, an automatic transcript of the speech in your video.
Payment data. Payments are processed by Polar, which acts as merchant of record and is the seller for your purchase. Hookshift receives from Polar a customer identifier, your plan, its status, and the country and VAT information Polar needs to invoice you. Hookshift never receives or stores your card number.
Technical data. IP address, browser type, pages requested and timestamps, kept in server logs. Error reports, which may incidentally contain the above, when something in the service fails.
| Purpose | Legal basis |
|---|---|
| Providing the service you signed up for: rendering, scheduling, publishing, reporting | Performance of a contract |
| Billing, invoicing and tax compliance | Contract, and legal obligation |
| Keeping the service secure, diagnosing failures, preventing abuse | Legitimate interest in a service that works and is not abused |
| Automatic transcription for subtitles | Performance of a contract, at your request when you enable it |
| Responding to your support requests | Contract, and legitimate interest |
| Retaining invoices and business records | Legal obligation under Swiss law |
Hookshift does not use your data to train machine learning models, does not sell it, and does not use it for advertising.
If you turn on subtitles, the audio of your video is transcribed automatically. This happens on Hookshift's own infrastructure. The audio is not sent to a third-party transcription service, and the transcript is stored with your video and deleted with it.
Hookshift uses the following processors. Each has access only to what its function requires.
| Processor | Function | Location |
|---|---|---|
| Fly.io | Application hosting and database | EU and US |
| Cloudflare | Video and file storage (R2), DNS, website hosting | Global |
| Polar | Payment processing as merchant of record | US |
| Meta Platforms | Instagram publishing and metrics, at your instruction | US |
| Sentry | Error monitoring | US |
Your data is also disclosed where the law requires it, and to professional advisers bound by confidentiality.
Some of these processors are in the United States. Those transfers rely on the European Commission's standard contractual clauses and, for transfers out of Switzerland, the Swiss addendum to them.
| Data | Retention |
|---|---|
| Instagram access token | Deleted immediately when you disconnect Instagram or delete your account |
| Uploaded video and rendered variants | While your account is active, then 30 days after deletion, then permanently erased |
| Publication records and reel metrics | While your account is active, then 30 days after deletion |
| Account and contact data | 30 days after you delete your account |
| Invoices and payment records | 10 years, as Swiss commercial law requires |
| Server logs | 30 days |
| Error reports | 90 days |
The 30 day window exists so that an accidental deletion can be undone. It is not a grace period during which anything is done with your data.
Uploaded video and rendered variants are stored in private Cloudflare R2 buckets. They are not publicly listable and not publicly readable.
When a variant is published, Instagram must fetch the file from a URL. Hookshift generates a signed, single-purpose link that expires within minutes and is not indexed or shared. No other file of yours is reachable through it.
Hookshift sets one cookie, which keeps you logged in. It is strictly necessary for the service to function and cannot be turned off without logging you out.
There are no advertising cookies, no third-party analytics, and no tracking pixels. This is why the site does not ask you to accept cookies: there is nothing to consent to.
You can ask to access your data, correct it, delete it, receive a portable copy of it, restrict how it is used, or object to processing based on legitimate interest. Write to support@hookshift.co and you will get an answer within 30 days.
Most of this you can also do yourself: the settings page lets you disconnect Instagram, export your data, and delete your account. See the Data Deletion Instructions page.
If you think your data has been handled improperly, you can complain to the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch). If you are in the EU or UK, you can complain to your national supervisory authority instead.
Access tokens are encrypted at rest. All traffic uses TLS. Access to production systems is limited to Estanislao Fusion and protected by multi-factor authentication. Backups are encrypted.
No service can promise it will never be breached. If a breach affects your personal data and presents a high risk to you, you will be told promptly, along with what happened and what to do.
Hookshift is a business tool and is not offered to anyone under 18. It is not directed at children, and no data is knowingly collected from them.
If this policy changes in a way that materially affects you, you will be notified by email at least 14 days before the change takes effect. The effective date at the top always reflects the current version.
support@hookshift.co Estanislao Fusion, Gustav-Gull-Platz 4, 8004 Zurich, Switzerland