Last updated: 2 November 2026
This Privacy Policy explains how Stonecast Financial LLC ("HypeAgent", "we", "us") collects, uses and shares personal data in HypeAgent: the web app at agent.hypeauditor.com, the HypeAgent MCP server at mcp.hypeauditor.com, the HypeAgent assistant on hypeauditor.com, and our websites, including hypeagent.io (together, the "Service").
HypeAgent is a brand of HypeAuditor. Both are operated by the same company under one privacy programme. The creator analytics shown in HypeAgent come from HypeAuditor's database, which is also described in the HypeAuditor Privacy Policy.
This policy is part of our Terms of Service. Words defined in the Terms have the same meaning here.
Controller: Stonecast Financial LLC, an Indiana limited liability company, 9165 Otis Ave., Suite 238, Indianapolis, IN 46216, USA.
Privacy contact and data protection officer: support@hypeauditor.com. Please put "Privacy" in the subject line.
EU representative (Article 27 GDPR): Y. Vasiliou & Co LLC, Pavlou Valdaseridi 2A, Floor 1, 6018 Larnaca, Cyprus, info@vasiliou.law.
| You are | Our role |
|---|---|
| A customer: you, or a member of your team, signed up for HypeAgent | Controller |
| A visitor to our websites | Controller |
| A creator whose public social media profile appears in HypeAgent | Controller |
| Someone who corresponds with a customer through HypeAgent, for example a creator replying to a brand's outreach | Processor, acting for the customer |
When we act as a processor, the customer decides why and how your data is used, and its own privacy notice applies. Please contact that customer first. If you write to us, we will forward your request to the customer and help them answer it.
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Account details: name, email address, profile photo, workspace and team membership. We sign you in with a one-time email code, with Google, or with your HypeAuditor account. Any password you set is stored only as a hash. | To create and run your account | Contract (Art. 6(1)(b)) |
| Sign in with Google: your name, email address, Google account ID and profile photo | To sign you in | Contract (Art. 6(1)(b)) |
| HypeAuditor account: if you are signed in to hypeauditor.com or link your HypeAuditor account, your HypeAuditor account ID, email, team, plan and balances, and an access token we use to act on your HypeAuditor account when you ask | To sign you in, show your HypeAuditor reports and balances, and run HypeAuditor actions you request | Contract (Art. 6(1)(b)) |
| Sign-up check: the domain of your email address, which we send to an email-validation provider | To block disposable inboxes used to farm free credits | Legitimate interest in preventing fraud (Art. 6(1)(f)) |
| Billing: plan, subscription status, invoices, billing country and your credit history. Stripe collects your card details; we never see or store full card numbers. | To charge you and keep accounting records | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Workspace content: your brands (website, social accounts, competitors), creator lists, campaigns, notes, tags, scout briefs, client reports, and your conversations with the HypeAgent assistant | To provide the Service | Contract (Art. 6(1)(b)) |
| Connected mailboxes: see section 4 | To run outreach from your own address | Contract (Art. 6(1)(b)) |
| MCP connections: the AI client's name and version, OAuth client ID, IP address, user agent and connection times. For each tool call: the tool, its arguments, status, duration, number of results and credits charged. If you or your AI client file a missing-capability report, its text. | To run the connection, charge credits, prevent abuse and improve the tools | Contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| Usage and device data: IP address, browser, device, pages viewed, clicks, product events, referrer and campaign (UTM) parameters, and error reports | To keep the Service working, find bugs and understand which features are used | Legitimate interest (Art. 6(1)(f)); consent where the law requires it for cookies |
| Communications: support requests, and service and product emails we send you | To help you and keep you informed about your account | Contract (Art. 6(1)(b)); legitimate interest for product news (Art. 6(1)(f)). You can unsubscribe from product news at any time. |
When you visit our websites, we collect your IP address, browser and device details, the pages you view, the referring page and campaign (UTM) parameters. We use them to count visits and to see which channels bring people to HypeAgent. Our legal basis is our legitimate interest in understanding our audience (Art. 6(1)(f)), or your consent where the law requires it.
HypeAgent helps brands find creators for paid collaborations. It shows the creator analytics in HypeAuditor's database, built from information that creators publish on Instagram, TikTok, YouTube, X (Twitter) and Twitch:
HypeAgent also records whether a customer has added a creator to a list or campaign, posts that mention the customer's brand, and the outreach history between that customer and the creator (see section 3.4). A creator's email address is shown to a customer only when the customer asks for it.
Legal basis: our legitimate interest, and that of brands, in finding creators for commercial collaborations (Art. 6(1)(f)). The data is information creators make public to build an audience and attract partnerships. We use only professional, publicly available information, and we do not process special categories of data about individual creators.
Notice: we cannot contact every creator individually, so under Article 14(5)(b) GDPR this policy serves as our notice.
Removal: a creator can ask us to correct or delete their data, or object to our use of it, by writing to support@hypeauditor.com with a link to the profile. HypeAgent and HypeAuditor use the same database, so one request covers both. We act within 72 hours of verifying the request. Removing copies from every system and cache can take up to one month.
When a customer contacts you through HypeAgent, we process your email address, name, the content and dates of your messages, and the terms discussed, such as rates and deliverables. We do this for the customer. AI models help the customer by classifying your replies and drafting answers. To stop receiving messages, reply to the sender or contact the brand directly. You can also write to us and we will pass your request on.
Connecting a mailbox is optional. You start it yourself, in Settings → Integrations.
What we ask Google for. When you connect Gmail, we ask Google for the following permissions:
gmail.send: to send the outreach messages you, or an agent working within your campaign settings, create, from your own address;gmail.readonly: to read incoming messages so that we can find replies from creators;userinfo.email and userinfo.profile: to identify the mailbox you connected.Sign in with Google uses only your basic profile (name, email address and photo), not your mailbox.
What we read and store. When you connect a mailbox, we fetch incoming messages from the previous 30 days, up to 100 messages. After that, we check regularly for new incoming messages. For each message, we store the sender, recipients, subject, body, date, and Gmail message and thread IDs. We then check the sender's address against the creators in your campaigns and in HypeAuditor's creator data.
How we use it. Messages from a creator appear in your campaign inbox. AI models analyse them to classify the reply (for example interested, quoted a rate, or declined) and to draft your answer. Messages from other senders are not shown in HypeAgent and are not sent to AI providers. We never delete, label or change anything in your mailbox.
Who we share it with. We share Google user data only:
We do not sell Google user data, and we do not use it for advertising. Our staff do not read your messages except:
No model training. We do not use Google user data to develop, improve or train generalised or non-personalised AI or machine learning models.
Security. Data travels over encrypted connections (TLS). Access tokens and mailbox credentials are encrypted at rest, and access is limited to the systems and staff who need it.
Retention and deletion.
Limited Use. HypeAgent's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Other mailboxes. If you connect a mailbox by IMAP and SMTP instead, we store its server settings and credentials encrypted, and we read and use your messages in the same way as described above.
HypeAgent uses AI models from OpenAI, Anthropic and TypeSafe. We send them only what a feature needs, such as:
These providers process data on our behalf under their API terms, which do not allow them to train their models on it. We do not use your workspace content or Google user data to train generalised AI models.
HypeAgent does not make decisions about anyone that produce legal or similarly significant effects solely by automated means (Article 22 GDPR). Its scores and suggestions help customers decide. The customer remains responsible for the decision.
AI clients you connect. When you use HypeAgent through an AI client such as Claude, ChatGPT or Cursor, our tools send their results to that client. The AI client and its provider then handle that data under their own terms and privacy policy, not ours.
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only as described here.
Our service providers, who process data on our behalf under written contracts:
| Provider | What for |
|---|---|
| HypeAuditor (the same company) | Creator data, sign-in with HypeAuditor, linked HypeAuditor accounts, and matching email senders to creators |
| DERFIT ENTERPRISES LIMITED (Cyprus) | Database administration |
| Amazon Web Services, Hetzner Online, DigitalOcean | Hosting and storage in Germany |
| NASA2 LLC (Armenia) | Technical support |
| OpenAI, Anthropic, TypeSafe | AI features (section 5) |
| Sign in with Google; the Gmail API when you connect a mailbox | |
| Stripe | Payments and invoices |
| Sentry | Error monitoring |
| PostHog, Amplitude, Ripples | Product and website analytics |
| Postmark, Amazon SES, Resend, HelpMate | Delivering service and product emails |
| MailRook | Checking the email domain at sign-up |
| Slack | Internal notifications to our team |
Others:
Our databases are hosted in Germany. Technical support is provided from Armenia under the EU Standard Contractual Clauses. Some service providers above are based in the United States. Where data leaves the EEA or the UK for a country without an adequacy decision, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, where the provider is certified, the EU–US Data Privacy Framework.
We protect personal data with technical and organisational measures. Data in transit is encrypted with TLS. Access tokens and mailbox credentials are encrypted at rest. Passwords are stored only as hashes. Our servers are hosted in secured data centres in Germany. Access is role-based and limited to those who need it, and our systems are monitored. If a personal data breach affects you, we will notify you and the competent authority as the law requires. No system is completely secure, so if you think your account has been compromised, write to support@hypeauditor.com at once.
Depending on where you live, you can ask us to:
You can also:
To use these rights, write to support@hypeauditor.com. We may need to confirm your identity first. We answer within one month, or within three months for complex requests, in which case we will tell you why. Customers can also change or delete much of their data directly in the app.
If you live in California or another US state with a consumer privacy law, this section applies to you as well.
What we collect:
The sources and purposes are described in section 3.
Selling and sharing. We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about you.
Your rights. You may ask to know what we collect and how we use it, to get a copy, to correct it and to delete it. We will not discriminate against you for using these rights. Send requests to support@hypeauditor.com. An authorised agent may send a request for you. We will verify the request and answer within 45 days.
We use:
We do not use advertising cookies. You can block or delete cookies in your browser settings. The Service still works without analytics cookies.
HypeAgent is a service for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children under 16. If you believe a creator profile in HypeAgent belongs to a child, write to support@hypeauditor.com and we will remove it.
We will tell you about material changes by email or in the app before they take effect. The date at the top shows when this policy last changed.
Stonecast Financial LLC, 9165 Otis Ave., Suite 238, Indianapolis, IN 46216, USA, support@hypeauditor.com.