Privacy Policy

The data controller is the operator of OHAnano:

• Company name: OHANA Group Kft.
• Registered office: Vércse utca 14., 6726 Szeged, Hungary
• Company registration number: 06-09-026560
• Tax number: 28983970-2-06
• E-mail (also for privacy matters): info@ohanagroup.hu

The same company runs the campaigns: the agency whose team sees your data in OHAnano and the operator are one and the same. We are not required to appoint a data protection officer; we handle privacy questions at the address above. Our hosting providers are listed in the Legal notice (Impresszum).

Influencers registered on OHAnano, the contact persons of our client brands, and our team. We collect no data about visitors of our public pages: there is no analytics and no advertising tracking. OHAnano may only be used by people aged 18 or over; if we learn that we process the data of someone younger, we delete it without delay.

• Account and profile: e-mail address, password (stored only as an irreversible hash), name, date of birth (to check your age) and, if you provide them, phone number, bio and profile picture. Purpose: running your account and keeping in touch; legal basis: performance of your contract with us (GDPR Art. 6(1)(b)) — the service cannot be used without them.
• Questionnaire: your answers about your interests and your content, so we can recommend you for suitable campaigns — legal basis: performance of the contract. Answering the health-related questions (such as food intolerance) is optional and only possible with your separate, explicit consent (GDPR Art. 9(2)(a)); if you withdraw it, we delete these answers immediately.
• Campaigns: the status of your invitations and participation, the links, IDs and times of the content you submit, their statistics and preview images. Legal basis: your campaign participation (performance of the contract); for data received from the platforms, your consent.
• Shipping address, if you take part in a campaign with a product sample: the recipient's name, address and phone number, to ship the product — legal basis: performance of the contract.
• Social media data, if you connect your accounts (details in section 4). Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time by disconnecting your accounts. It is voluntary, but without at least one connected account you cannot be selected for campaigns.
• Records of consents and deletion requests: when you consented to which version of a text, when you withdrew consent, and how we handled your deletion requests — legal basis: legal obligation (GDPR Art. 6(1)(c) and Art. 7(1)).
• Brand contacts: the client brand's name and the contact person's name and e-mail address. We receive these from the brand and use them to send candidate lists and campaign reports; legal basis: our contract with the brand and our legitimate interest in keeping in touch (GDPR Art. 6(1)(f)).
• Technical data: a log of our team's actions (who changed what, when, from which IP address), the delivery log of our e-mails, and our service providers' short-lived request logs (IP address, browser, time, requested address). Purpose: security and traceability; legal basis: our legitimate interest (GDPR Art. 6(1)(f)).

We send e-mails only as part of the service (such as confirmations, invitations and notifications) — no newsletters or advertising. We make no decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (GDPR Art. 22): who is selected for a campaign is always decided by a person — our agency team or the brand.

Connecting is voluntary and always happens on the platform's own login page — OHAnano never sees your password. We only ask for read-only permission: we never post, comment, send messages or change anything on your behalf. For each platform we request only the permissions below and retrieve only the data listed here:

• Instagram — professional (Business or Creator) account, via Instagram Login, no Facebook Page needed. Permissions: instagram_business_basic, instagram_business_manage_insights. Your account ID, username, name, account type and profile picture; your follower, following and post counts; the list of your posts, reels and currently live stories, so you can pick your campaign content; the statistics of the content you submit to a campaign (views, reach, likes, comments, shares, saves; for stories: views, reach, replies, shares).
• Facebook Page — via Facebook Login for Business. Permissions: pages_show_list, pages_read_engagement, read_insights. The list of Pages you manage, so you can choose which one to connect; the Page's name, username, category, picture and follower count; the Page's posts; the views, reach, reactions, comments and shares of the post you submit to a campaign.
• TikTok — Login Kit and Display API. Permissions: user.info.basic, user.info.profile, user.info.stats, video.list. Your profile (ID, display name, username, profile picture, bio, profile link, verified badge); your follower, following, like and video counts; the list of your public videos (title, cover image, link, publish time, duration) with their statistics (views, likes, comments, shares). On TikTok's authorisation screen you may grant only some of the permissions; we then access only those.
• YouTube — via Google sign-in, with a single read-only permission: https://www.googleapis.com/auth/youtube.readonly. Your channel's ID, name, custom URL and picture; your subscriber, video and total view counts; the list of your uploaded videos (title, thumbnail, publish time, duration — videos of 60 seconds or less are marked as Shorts) with their public statistics (views, likes, comments).

We fetch the list of your posts and videos only so that you can choose from it; we do not store it. For content you submit to a campaign we store its link, time, statistics and — where the platform provides one — its preview image. Account data is fetched when you connect and refreshed daily, so you can also follow how your follower count changes. The platforms' access keys (tokens) are stored encrypted, on the server only, and used only for these requests while the account is connected.

We use this data so that you can see your own numbers on your dashboard and in your media kit, choose which of your content belongs to a campaign, our agency can recommend you for suitable campaigns, and a report on the numbers of your campaign content can be prepared for the brand (section 6). We use it for no other purpose: we do not sell or license it; we do not transfer it to advertising platforms, data brokers or information resellers; we do not use it for advertising (including targeted ads and retargeting), to build profiles or databases for other purposes, to assess creditworthiness, for surveillance, or to create or train artificial intelligence or machine learning models; and we do not use it for discrimination or eligibility decisions (such as housing, employment, insurance or credit). For our own operational statistics we use data only in aggregated form that cannot be linked to a person.

The data is seen in OHAnano by you and, to organise campaigns, by our agency team — this is the service itself, and it is what you consent to when you connect. Beyond that, team members may access the data only for security reasons (to investigate a bug or abuse), to comply with the law, or in aggregated form. If OHAnano ever wanted new data from the platforms, or to use existing data for a new purpose or in a new way, we would first update this policy, notify you and ask for your consent again.

The data comes from the platforms, and part of it (such as your public profile) is also public. The platforms are independent controllers of the processing in their own systems and have their own policies (Meta, TikTok, Google). We receive the Meta data of users in the European Economic Area from Meta Platforms Ireland Ltd., and TikTok data from TikTok, as an independent controller. If we stopped using a platform's developer services, we would delete all data obtained from it, including from backups; at Meta's request we promptly delete or update Meta data.

OHAnano is an independent service: it is not endorsed or sponsored by, or affiliated with, Instagram, Facebook, TikTok or YouTube.

OHAnano uses YouTube API Services. By connecting your YouTube account you agree to be bound by the YouTube Terms of Service (youtube.com/t/terms); Google's handling of data is described in the Google Privacy Policy (google.com/policies/privacy).

We request a single read-only permission (youtube.readonly) and access only the data listed in section 4. We store YouTube data in our database in the European Union (Frankfurt), show it in OHAnano to you and our agency team, and include the numbers of the video you submit to a campaign in the campaign report for the brand whose campaign you take part in (section 6). All restrictions in section 4 apply to Google user data too, and we require our employees, agents and successors to comply with the Google API Services User Data Policy.

We keep the statistics (views, likes, comments, subscriber count) while your channel is connected. Non-statistical data (such as video titles and thumbnails, or the channel name) is refreshed or deleted within 30 days. If you disconnect your channel in OHAnano, we revoke the access at Google immediately and delete the data downloaded from YouTube within 7 days; if you revoke access in your Google account, or the connection expires and cannot be refreshed, within 30 days.

You can also revoke access at any time in your Google account's security settings: myaccount.google.com/permissions. Data stored in your browser is described in section 9, and our contact details are in section 13.

With our client brands — only as far as their campaigns require:

• During candidate selection the brand sees, through a confidential link that is valid for at most 14 days and can be revoked at any time, your name, your connected accounts (platform, username, follower count) and your content categories — not your contact details, address or questionnaire answers.
• After a campaign the brand receives a report (PDF) on the content you submitted to its campaign: your name and username, the links and numbers of the content, with the time they were retrieved. We send the report by e-mail, with a download link valid for 7 days.
• For campaigns with a product sample, once you accept, we may pass your shipping details (name, address, phone number) to the brand or courier sending the product.

With our processors, who work on our behalf, on our instructions and under written data processing agreements:

• Supabase (Supabase Pte. Ltd.) — database, sign-in and file storage; the data is stored in the European Union (Frankfurt).
• Vercel Inc. — running the website and server-side functions (in Frankfurt) and delivering pages through Vercel's global network.
• Resend — sending our system e-mails.

Some of our providers also operate outside the European Union (in the United States and in Singapore); where they access data from there, the safeguard is the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses (SCCs) — we send you a copy on request. We share data with authorities only where the law requires it. In a sale or merger of the company, we would transfer data received from the platforms only with your prior, explicit consent. There are no other recipients: we use no analytics, advertising or tracking provider.

• Social media data: as long as the account is connected.
• Disconnecting in OHAnano: we revoke the access at the platform immediately (where the platform allows it), delete the access keys immediately, and delete all data downloaded from that platform — profile data, follower history, statistics, post preview images — within 7 days.
• Revoking on the platform, or an expired connection: if you revoke access on the platform's side, or the connection expires and cannot be refreshed, we delete this data within 30 days at the latest.
• The link of a post you submitted to a campaign — and which of your accounts it belongs to (platform, username) — is kept after disconnecting, because it proves that you completed the campaign task; we keep it until claims arising from the campaign expire (generally 5 years).
• YouTube: non-statistical data (such as titles, thumbnails, the channel name) is refreshed or deleted within 30 days.
• Campaign reports (PDF): deleted 30 days after they are generated — earlier if the data of an influencer included in them has to be deleted.
• Account, profile and campaign data, questionnaire answers: until your account is closed; when the account is deleted, within 30 days. Health-related answers are deleted immediately when you withdraw your consent.
• Shipping address: 1 year after the campaign is closed.
• Records of consents and deletion requests: 5 years after the account is deleted (accountability).
• Logs: our team's action log for 1 year, the e-mail delivery log for 90 days, our providers' request logs for at most 90 days.

Our database runs in the European Union (Frankfurt), and every connection is encrypted (HTTPS). The platforms' access keys are encrypted with AES-256-GCM and stored separately; they never reach the browser. Row-level access control is enforced in the database: as an influencer you see only your own data, our team members have access according to their role, and all their actions are logged. Passwords, access keys, addresses and health data must never be written to logs.

Our team members are bound by confidentiality and by the platforms' developer policies. In the event of a personal data breach we act as the GDPR requires: where necessary we notify the Hungarian supervisory authority (NAIH) within 72 hours, we notify you if the risk is high, and we also inform the affected platforms (Meta, TikTok, Google).

We use no tracking, analytics or advertising cookies, so there is no cookie banner either; no third party serves content or ads in OHAnano or places cookies on your device. We store in your browser only what the service needs:

• sb-…-auth-token cookie — keeps you signed in (until you sign out, at most 400 days);
• ohanano_oauth_state and ohanano_oauth_pending cookies — protect the account-connection flow against forged requests (10 minutes);
• ohanano.installHint.dismissed in the browser's local storage — remembers that you hid the tip about installing the app.

The installable app stores only the “no internet connection” page on your device. Because these are needed for the service to work, they do not require consent under section 155(4) of the Hungarian Electronic Communications Act (Act C of 2003). If we ever introduced a cookie that is not strictly necessary, we would ask for your consent first.

You can ask for information about and a copy of your data, ask us to correct it (you can also edit your profile yourself), to delete it or to restrict its processing, and ask us to hand it over in a machine-readable format or transmit it to another provider. You can withdraw your consent at any time, as easily as you gave it: for social media data by disconnecting your accounts, for health-related data in Settings. Withdrawal does not affect the lawfulness of earlier processing.

Send your request to info@ohanagroup.hu; it is free of charge. We reply within one month at the latest — for complex requests this may be extended by two months, which we will tell you about within the first month. If we have doubts about your identity, we may ask you to confirm from your registered e-mail address. Within five years of a user's death, the person they designated or, failing that, a close relative may exercise their rights (section 25 of the Hungarian Privacy Act).

You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, Falk Miksa utca 9–11., 1055 Budapest; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; naih.hu), and you can also go to court: in Hungary you may bring the case before the regional court (törvényszék) of your place of residence or stay. We suggest you write to us first — we can resolve most questions quickly.

• In OHAnano: Kezdőlap (Home) → Platformjaim (My platforms) → Leválasztás (Disconnect). We end the connection immediately (and revoke the access where the platform allows it) and delete the downloaded data within 7 days.
• On Facebook or Instagram: in your settings, remove OHAnano under “Apps and websites” and request the deletion of your data. Meta notifies us automatically: we end the connection immediately, you receive a confirmation code and can follow the status of your request at ohanano.hu/adatvedelem/torles; we delete the downloaded data within 30 days.
• On TikTok and in your Google account: revoke access among TikTok's app permissions, or at myaccount.google.com/permissions; we then delete the data within 30 days.
• By e-mail: at info@ohanagroup.hu you can request the deletion of your entire account: we delete the data downloaded from the platforms within 7 days and the rest of your data within 30 days, except what we must keep by law or to defend legal claims (such as the links of the posts you submitted to campaigns).

Deletion affects only the data stored by us: your content on Instagram, Facebook, TikTok and YouTube remains unchanged.

Every version of this policy has a version number and an effective date; we send previous versions on request. We notify you of material changes in OHAnano or by e-mail before they take effect. We would use data received from the platforms for a new purpose or in a new way, or request access to new data, only after updating this policy and obtaining your renewed consent.

For privacy questions, requests or complaints — including those about the platform connections — contact us at: info@ohanagroup.hu. By post: OHANA Group Kft., Vércse utca 14., 6726 Szeged, Hungary. This policy is also available in Hungarian (Adatkezelési tájékoztató); if the two versions differ, the Hungarian version prevails.