Legal

Privacy policy

Effective 13 October 2026

This policy explains what personal information HookChat handles, why, where it is kept and for how long, and the choices you have.

Who we are

HookChat is a product of Jiffi Consultancy Pty Ltd ("Jiffi", "we", "us"), Unit 1/136 Cronulla St, Cronulla NSW 2230, Australia. We handle personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles. This policy covers HookChat only. The rest of what Jiffi does is covered by the Jiffi privacy policy.

What HookChat does

HookChat sits between Instagram and Messenger DMs and a business's own software. A business (our "customer") connects its Instagram and Facebook Page accounts through Meta's login. HookChat receives the DMs Meta sends for those accounts, stores them, delivers each one to the customer's endpoint as a signed webhook, and sends the customer's replies back through Meta. Replies go out only inside Meta's messaging windows: 24 hours, or 7 days for a named human agent.

What we collect

About the people who use HookChat

When you use the HookChat console or API, we hold:

• your email address, so we can send you sign-in links (there are no passwords);
• the workspaces you belong to and your role in each;
• audit records of actions taken in a workspace, such as creating a key or changing a webhook;
• details about each API key, but not the key itself: keys are stored as hashes and shown once;
• the webhook endpoint URLs you set.

About the people who message our customers

When someone sends a DM to a connected account, we process, for the customer:

• the page or app scoped ID Meta gives that person;
• message text, attachments (as links to files Meta hosts) and timestamps;
• the person's name, username and profile picture link, which we look up from Meta once per conversation;
• the Meta account IDs and handles of the customer's connected accounts.

For this message data, we act on the customer's behalf and follow its instructions. The customer decides what to do with it, and is responsible for its own privacy notices to the people it talks to. If you messaged a business and want to know how it uses your messages, ask that business. You can also contact us.

How we use it

We use personal information only to provide HookChat: to sign you in, run your workspace, receive and deliver messages, send replies, keep the service secure, fix problems, answer you when you write to us, and where the law requires or allows. We may email you about your account and the service.

We do not sell personal information.

Who we share it with

• Meta, where messages come from and where replies go. Meta handles them under its own terms and policies.
• Amazon Web Services, which hosts HookChat and sends our sign-in emails.
• The customer's own webhook endpoint, which receives a copy of each event wherever the customer hosts it.
• Anyone the law requires us to tell, such as a court or a regulator.

Where it is stored

HookChat stores and processes data in AWS Sydney (ap-southeast-2). Sign-in emails go through Amazon SES in the same region. The public website and docs are served through Amazon CloudFront's global edge network; those pages hold no customer data.

Some information goes outside Australia because of how the service works. Messages come from Meta and replies go back to Meta, including Meta Platforms in the USA. Each event copy goes to the customer's endpoint, wherever the customer hosts it.

How long we keep it

• Messages: 7 days after each one was sent, then they expire.
• Conversations, with the person's name and picture: 7 days after the last message, then they expire.
• Raw inbound events, as Meta sends them: 7 days, then they expire.
• Files sent from the console or the API: only until Meta has them, and at most 1 day.
• Delivery logs: 90 days. The event body each one carried: 7 days.
• Database backups: deleted or expired messages, conversations and delivery records can stay in them for up to 7 more days. Connected accounts, workspaces and users can stay in them longer, for recovery.
• Operational logs: up to 365 days.
• Audit records: retained, so a workspace keeps a record of who did what.
• Sign-in links: they expire after 15 minutes and work once.

These are the current periods, and they may change. Within them, message data can also be deleted under a deletion request or as the law requires. Disconnecting an account stops new messages and deletes its access token, but keeps its history for the rest of those periods, so a reconnect can pick it back up.

Deleting your data

If you connected an account to HookChat with Meta's login, you can remove the app in your Facebook or Instagram settings, or ask for your data to be deleted. Meta then tells HookChat. We erase the accounts you authorised and their conversations, messages and delivered copies. You get a confirmation code and a status page at https://hookchat.dev/data-deletion/status?code=…

A workspace owner can delete the workspace in the console settings, which deletes its accounts, tokens, conversations, messages and delivered copies. Raw inbound events are not stored per person or per workspace, so they are not erased one request at a time. They expire on their own within 7 days. How data deletion works.

Anyone can also email hello@jiffi.co to ask for access to, correction of or deletion of their information.

Cookies and local storage

The console uses two cookies, both strictly necessary: a sign-in session cookie that scripts on the page cannot read, and a cookie that protects your requests from being forged by another site. The docs remember the code language you pick in your browser's local storage. There are no analytics, advertising or tracking cookies on hookchat.dev.

Security

Meta access tokens for connected accounts are encrypted with AWS KMS and never shown to anyone. Disconnecting an account deletes its token and tells Meta to stop sending its messages. Our security page sets out the other controls in place today, and the limits: HookChat is in beta, and we do not hold a SOC 2 report or offer an uptime SLA.

Access, correction and complaints

To see the personal information we hold about you, or to correct it, email hello@jiffi.co. We may need to confirm who you are first, and the law lets us refuse in some cases. If you have a complaint about how we handled your information, write to us and we will deal with it as the Privacy Act requires. If you are not happy with the outcome, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

We may change this policy at any time by posting a new version here with a new effective date.

Contact

Jiffi Consultancy Pty Ltd, Unit 1/136 Cronulla St, Cronulla NSW 2230, Australia. Email hello@jiffi.co. See also our terms of service.