I'm Hop. This page explains what data I use, why, and how you can delete it, with no small print. It covers this site (hopbot.io), the Hop web app and the Hop bot on Telegram. Hop is in beta.
Who is responsible
The data controller is Daniel Galron, who runs Hop.
Address: Yehuda Halevi 9, Herzliya, Israel.
Contact: contactdanielgalron@gmail.com
This site (hopbot.io)
This site sets no cookies, runs no analytics or tracking pixels and loads nothing from third parties: fonts are served from the site itself.
It is hosted by Vercel. Like any web host, Vercel processes technical data about each visit (IP address, browser, the page requested) to serve pages and protect them from abuse.
What data Hop processes
- Your account: your email (it identifies your account; you sign in with a single-use link, no password), your language, your time zone and your plan (Basic or Pro).
- Your TikTok and Instagram accounts: the @handle you add and its public data: posts, captions, date, duration, views, likes, comments, shares, saves (TikTok only), followers, the sound used and the public video files. I only read what is public and never ask for your password.
- What Hop takes from your videos: frames, the transcript (made on Hop's own server, no third party) and labels such as format, hook, on-screen text and whether music plays.
- What you tell me: your answers when you start (what your account is about, goals, how much you can film, promotion budget and currency), your chat messages, what I remember about you (you see and delete it under «Lo que Hop sabe»), your tasks, your plan, your tests and the promotions you log (goal, days, budget, countries). Never payment details.
- Telegram: your chat ID, your messages and button taps, and the videos you send me for review (including web uploads over 20 MB).
- Hop Pro (Windsor): private metrics you authorise me to read, such as average watch time, organic reach, retention by second (TikTok) or skip rate (Instagram), and aggregated audience data as percentages: age, gender, countries and cities.
- Technical data: your session (stored hashed), counters that limit abuse and each person's daily AI spend.
I also process public data about other people, only to advise you:
- Comments on your posts: the commenter's username, the text, the date and likes. Each comment is labelled (kind, tone, whether it deserves a reply and whether it shows interest in buying or hiring).
- Niche radar: public videos in your niche that are doing well (author, caption, numbers and link). Their files are downloaded to label the format and deleted right after.
Why, and on what legal basis
- Providing the service you ask for (daily list, video reviews, ideas, plan, tests, alerts, web app): performance of a contract (GDPR Art. 6(1)(b)).
- Reading third parties' public comments and videos to advise you: legitimate interest (Art. 6(1)(f)) in helping you with your own audience. I only use public content on your posts or from searches of your niche.
- Security, usage limits and cost control: legitimate interest.
- Reviewing the quality of AI answers (run logs): legitimate interest.
I don't sell data, show ads or send marketing emails. Hop does not train AI models of its own on your data.
My advice is generated automatically, but it makes no decisions with legal effects on you: you decide what to do with it. You can object to any processing based on legitimate interest.
Providers that process data
To work, Hop sends these providers only the data each task needs:
| Provider | What for | What data |
|---|---|---|
| Anthropic (Claude) | Chat, ideas, scripts, reviews, weekly summary; web searches; fallback comment labelling | Your messages and the video data, comments, transcripts and labels each answer needs |
| Google (Gemini API) | Describing your videos (format, hook, on-screen text, music) | Video files: your posts, the drafts you send for review and niche-radar videos |
| Telegram | Sending and receiving bot messages | Your chat, messages and the videos you send. Your use of Telegram is also covered by its own policy |
| Treg (treg.to) | Reading public TikTok and Instagram data through providers such as AnyAPI and Crawl4AI | Your @handles, post links and searches of your niche |
| TypeSafe (Jev) | Labelling comments | The text of each comment |
| Windsor.ai | Hop Pro only: reading your private metrics | The read-only access you authorise in Windsor |
| Langfuse Cloud (EU region, Frankfurt) | Logs of each AI run, to review quality and cost | Your messages and the data used in that run |
| Google Fonts | Hop web app only: loading its typefaces | Your IP address and browser data when the page loads |
| Vercel | Hosting this site | Technical visit data |
During the beta, Hop's server (database and video files) runs on infrastructure the controller operates. Before the public launch it will move to a cloud host, and I'll update this page.
Once billing exists, payments will be processed by Stripe, and this policy will be updated then.
Transfers outside the EEA
Some providers, such as Anthropic and Google, are based in the United States, so your data may be processed outside the European Economic Area.
The controller is in Israel, which has an EU adequacy decision. Hop uses these providers as a paying customer, under their business terms; for transfers outside the EEA it relies on the standard contractual clauses and data processing agreements included in those terms, where the provider offers them.
How long data is kept
- Everything tied to your account is kept until you delete it. There is no automatic deletion for inactivity.
- Sign-in links: valid for 20 minutes and removed one day after they expire.
- Web session: 30 days, or until you sign out.
- Usage-limit counters: 2 days.
- Telegram connection link: valid for 1 day. Large-video upload link: single use, 24 hours.
- Niche-radar videos: the file is deleted right after labelling.
- Langfuse logs: kept until deleted, and I delete them on request.
- If you block the bot, Hop disconnects your Telegram the next time it tries to message you.
How to delete your data
In the web app, Ajustes → «Borrar mis datos» (type BORRAR to confirm). It deletes at once: your account, connected accounts, posts and numbers, videos and files, messages, tasks, plan, tests, stored comments, the Telegram connection, the Windsor link inside Hop, your sign-in links and your session.
What that button does not do:
- It does not revoke Windsor's access: do that from your Windsor account.
- It does not erase the history in your Telegram app: you can delete the chat yourself.
- It does not delete Langfuse logs: ask me through the contact channel and I'll delete them. Nor copies that providers keep under their own terms.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. You can correct a lot yourself under «Lo que Hop sabe» and Ajustes, and delete everything from Ajustes. For anything else, write to me through the contact channel.
You can also complain to the data protection authority of the country where you live or work.
Contact: contactdanielgalron@gmail.com
Cookies and storage
hopbot.io uses none. The Hop web app uses only what it needs, so there is no banner:
| Name | Type | What for | Duration |
|---|---|---|---|
| hop_session | Necessary cookie | Keeping you signed in | 30 days or until you sign out |
| theme | Local storage | Remembering the light or dark theme you chose | Until you clear it |
| hop-sidebar | Local storage | Remembering whether you collapsed the sidebar | Until you clear it |
No analytics or advertising cookies. The Hop web app loads its typefaces from Google Fonts, so your browser contacts Google when you open it.
Children
To use Hop you must be at least 13 (the TikTok and Instagram minimum) and also at least the age of digital consent in your country (14 in Spain). For paid plans you must be 18, or have the consent of a parent or guardian.
Security
Each person can only read their own data (row-level security in the database). Sign-in links and sessions are stored as hashes, not in plain text. The bot only talks in private chats, so your numbers never show in a group. Provider keys live on the server and are never sent to the AI.
Changes
If I change something important, I'll say so in Telegram or the web app before it applies. The date above shows the latest version.