Privacy Policy
Last updated: 26 October 2026. This policy covers the Herrald engagement inbox ("Herrald", "we").
Who we are
Herrald is a hosted inbox that helps publishers answer comments and direct messages sent to their social media pages and websites. Herrald is operated by the publisher's workspace Owner's organisation (the "Publisher"). Contact: the email address shown on the Publisher's own website; for Herrald itself, privacy@ at the domain this page is served from.
What we collect
- From connected platforms (Facebook Pages, Instagram professional accounts, YouTube channels, X accounts, and the Publisher's own websites and apps): public comments, direct messages sent to the Publisher, the commenter's platform user id, display name and avatar URL, timestamps, and the platform's identifiers for the post or thread.
- From workspace members: name, email address, password hash, two-factor settings, sign-in times and IP addresses, and every action taken in Herrald (the audit log).
- From people who request early access on the public site: the email address you enter, the page and plan you asked from, and when you asked and confirmed. Nothing else, and no tracking.
- From people who vote for a network on the public site: which network, the page you voted from and when. Your vote is counted once by a random identifier kept in your browser session, stored only in scrambled form; we record no name, address or IP address with it.
- Technical data: request ids, error reports and performance traces with personal data removed.
We do not collect payment card data. We do not access platform data beyond the permissions each Owner grants when connecting an account.
Why we use it
To display comments and messages to the Publisher's team, to suggest or send replies on the Publisher's behalf, to hide or moderate abusive content, to keep an audit trail, to keep the service secure, and to write to people who asked for early access about their access. Automated replies are only sent for categories the Publisher has enabled; every automated reply is labelled in the audit log.
Automated processing and AI
Message text is sent to Anthropic's Claude models to classify it (for example "question", "appreciation", "complaint") and, where the Publisher allows it, to draft a reply in the Publisher's voice. Anthropic is a sub-processor and does not use this data to train its models. Messages that indicate a crisis are never answered automatically; they are routed to a human and excluded from any example sets.
Sub-processors
| Provider | Purpose | Region |
|---|---|---|
| DigitalOcean | Hosting, managed database, object storage | US |
| Cloudflare | DNS, TLS, web application firewall | Global edge |
| Anthropic | Message classification and reply drafting | US |
| Sentry | Error reporting (no message content, no personal data) | US |
| Better Stack | Logs and uptime monitoring (identifiers only, secrets masked) | EU/US |
| Resend | Transactional email to workspace members and to people who request early access | US |
| Twilio | SMS security alerts to Owners (critical events only) | US |
Retention
Closed conversations and their messages are deleted 180 days after they are closed (30 days for YouTube data, per the YouTube API Services policies; a Publisher may choose any value of 30 days or more). Raw platform payloads are kept 30 days, unsent drafts 90 days, sign-in sessions 7 days, and the audit log 2 years. A deleted workspace is purged 7 days after the Owner's request; the audit log survives without message content. An early-access request nobody confirms is deleted after 30 days; a confirmed one is kept until access is offered or you ask us to remove it.
Security
Platform tokens are encrypted with per-workspace keys (XChaCha20-Poly1305 envelope encryption); every database query is scoped to one workspace by row-level security; passwords are hashed with Argon2id; Owners and Admins must use two-factor authentication; all traffic is TLS; every change is recorded in an append-only audit log.
Your rights
- Commenters and message senders may ask the Publisher to delete their data from Herrald; the Publisher can do so from the conversation. Removing Herrald's access in your Facebook or Google account settings revokes the Publisher's token, and Herrald's data-deletion endpoint (
/webhooks/meta/data-deletion) honours Meta's deletion requests. - Workspace members can export the workspace (Owners/Admins), revoke access, and request deletion of their account.
- People who requested early access can remove their address at any time with the link in our email, or by writing to the address above.
- Depending on where you live you may have rights to access, correct, delete or port your data, or to object to processing. Contact the Publisher or the address above.
Platform-specific statements
YouTube API Services. Herrald uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service and the Google Privacy Policy. Herrald stores YouTube comment data for at most 30 days, refreshing or deleting it within that window, uses it only to display and reply to comments on the connected channel, and never sells it or uses it for advertising. You can revoke Herrald's access at any time from the Google security settings.
Meta Platform. Herrald uses Facebook and Instagram data under the Meta Platform Terms solely to provide the inbox to the Page or account owner. Data is not sold, not used for advertising, and not shared with third parties other than the sub-processors above. You can remove Herrald in your Facebook settings; the Publisher can also disconnect it at any time.
Changes
We will post changes here and update the date above. Material changes are announced to workspace Owners by email.