Privacy policy
Last updated 17 September 2026
Hetu is operated by MLJ Tech Labs (“we”). This policy explains what we collect when you use Hetu, why, and how to remove it.
What we collect
- Account: your email, name, and sign-in provider (Google or email link).
- Instagram data you authorise through Instagram's login: your professional account profile, posts, and their insights. If you enable the inbox, comments and messages.
- Content you create in Hetu: ideas, drafts, captions, media you upload, and scheduling choices.
- Billing: subscription status from our payment provider. We never see or store card details.
- Usage: which features you use and basic device information, to keep the service working and improve it.
How we use it
- To analyse your account and generate recommendations, plans, and drafts. Only the data needed for a task is sent to our AI providers; message contents are never used for content generation.
- To publish posts you approve, through Instagram's official API.
- To send you emails about your account: a welcome when you join, reminders about your trial, receipts and payment problems, a note when Instagram needs reconnecting, and invitations when someone adds you to a workspace. We do not send marketing email, and there is currently no way to switch these off — they are the ones we would have to send you anyway.
Who we share it with
These are the companies that process data on our behalf, under contract. We do not sell your data, and we do not share it with anyone else.
- Supabase — database, file storage and authentication.
- Vercel — hosting for the app and this website.
- Anthropic — the AI models that write your plans, scripts and captions, and, if you enable the inbox, that read each comment and message once to sort it and draft a reply.
- Google — sign-in, if you choose "Continue with Google". Google sees only that you signed in to Hetu.
- Razorpay — payments in India. Mailjet — our email.
- PayPal — payments outside India.
- A separate AI host may run short classification tasks, such as labelling the format of a post. It is used only if configured for your deployment, never for your captions or messages, and we will name it here before that changes.
Instagram data
When you connect Instagram we ask for five permissions, and use each one for one thing: instagram_business_basic to identify the account and keep its username and profile picture current; instagram_business_manage_insights to read your posts and their reach, views, saves, shares and follower figures; instagram_business_content_publish to publish posts you have approved, at the time you scheduled; instagram_business_manage_comments to read comments on your posts and send the replies you write; and instagram_business_manage_messages to read direct messages people send you and send the replies you write. We ask for all five on the single Instagram consent screen when you connect, and you can decline any of them — the features that need one stop working and nothing else does.
Access tokens are encrypted at rest and used only to perform the actions you asked for. You can disconnect Instagram at any time in Settings, which revokes our access; removing Hetu inside Instagram does the same. Disconnecting stops all access immediately and cancels anything waiting to publish, but it does not by itself delete what we already read — ask for deletion if that is what you want. A deletion request sent through Instagram removes everything we obtained from that account and the analysis built on it, and deleting your workspace removes all of it within 7 days.
People who write to you
If you enable the inbox, we hold what other people send you: the text of their comments and messages, their Instagram username and account id, and when they wrote. We hold it so that you can read and answer it in Hetu, on the same basis you already hold it in Instagram — they chose to write to you.
We do not build profiles of these people, do not use their words to train anything, and do not use them for content generation. Each comment or message is read once by our AI provider to sort it and draft a reply for you to approve, and that is the only place it goes.
Inside your workspace, only owners and managers can open the inbox. Members with other roles cannot read your comments or messages at all.
If someone deletes a message in Instagram, Instagram tells us and we clear what it said straight away — the line stays in the thread, marked as deleted, so the conversation still reads as a conversation. If someone who wrote to you wants their message removed another way, ask us and we will remove it.
Retention and deletion
The contents of comments and messages are kept for 90 days, then removed: the words and any attachments go, while who wrote and when stays, so a conversation still reads as a conversation. Everything else is kept for as long as your workspace exists. Request deletion in Settings → Delete workspace, or see our data deletion page. Deletion completes within 30 days, and normally within 7. A copy can survive in our hosting provider’s database backups for up to 14 days after that, before it rolls off.