Hookr

    Privacy Policy

    GDPR-compliant

    Last updated: August 2026
    Applies to: https://hookr.media and all subpages

    This is a convenience translation. In case of discrepancies, the German version of this policy is authoritative.

    1. Controller

    Richi AI
    Owner: Yves-Marcel Richel
    Homburger Landstr. 851
    60437 Frankfurt am Main
    Germany

    Email: info@richi.solutions
    Website: https://www.richi.solutions

    2. Data protection contact

    For all data protection inquiries, please contact:
    Email: info@richi.solutions

    3. Use of artificial intelligence and automation

    Hookr's core function is AI-supported video analysis. The video you provide by link or upload is processed using artificial intelligence (AI) and automated workflow systems to produce a Viral Score, per-dimension ratings and improvement suggestions.

    This involves, among other things:

    • AI-supported video and content analysis
    • Automated workflows orchestrating the analysis (including n8n)
    • Comparison against a corpus of publicly discovered viral videos
    • Data analysis and optimization of platform performance

    AI systems are used exclusively to provide and improve the service. No fully automated decision-making with legal or similarly significant effects on users takes place (Article 22 GDPR).

    4. Categories of processed data

    Depending on how you interact with our website, we may collect the following data:

    • Account data (email address for registration and sign-in)
    • Videos you provide (via public link or file upload) and the analysis results generated from them (Viral Score, per-dimension ratings, recommendations)
    • Technical and usage data (IP address, browser type, device, operating system, pages visited)
    • Communication data (messages submitted via forms or email)

    5. Legal basis of processing

    Processing is based on the following legal bases under the GDPR:

    • Article 6(1)(a) - Consent
    • Article 6(1)(b) - Performance of a contract or pre-contractual measures
    • Article 6(1)(f) - Legitimate interest (e.g. analysis, automation and optimization)

    6. Hosting and technical infrastructure

    Our website is hosted by Vercel; for technical reasons this involves processing visitors' IP addresses. For the backend, database, authentication and file storage we use Supabase. These providers operate under GDPR-compliant data processing agreements and provide appropriate safeguards pursuant to Article 46 GDPR.

    7. Third-party service providers

    To provide, analyse and improve our services, we use third-party platforms:

    • Vercel (website hosting; processes visitor IP addresses)
    • Supabase (database, authentication, file storage, edge functions)
    • Google (AI analysis via Gemini)
    • Railway (hosting of our self-operated analysis workflows)
    • Apify (retrieval of public TikTok/Instagram video data for the analysis corpus)
    • Resend (transactional email delivery)

    All integrations are GDPR-compliant and limited to the necessary processing operations.

    8. Cookies and tracking

    This website uses cookies to ensure technical functionality and to improve the user experience. Users can manage or withdraw their consent at any time via the cookie settings or their browser settings. Cookies are stored on the basis of legitimate interest (Art. 6(1)(f) GDPR) or explicit consent (Art. 6(1)(a) GDPR).

    9. Data storage and security

    All data is stored only for as long as necessary for the intended purpose or as required by law. We use SSL/TLS encryption and take comprehensive organisational and technical measures to protect personal data against unauthorised access, manipulation or loss.

    10. International data transfers

    Some third-party providers may process data outside the EU/EEA. In such cases, data is transferred only where appropriate safeguards (e.g. standard contractual clauses) exist pursuant to Articles 46-49 GDPR.

    11. Your rights

    You have the right to:

    • Access your personal data (Art. 15 GDPR)
    • Rectification of inaccurate data (Art. 16 GDPR)
    • Erasure of data ("right to be forgotten") (Art. 17 GDPR)
    • Restriction of processing (Art. 18 GDPR)
    • Object to processing (Art. 21 GDPR)
    • Data portability (Art. 20 GDPR)
    • Lodge a complaint with the competent supervisory authority

    Supervisory authority (Frankfurt am Main):
    The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
    Postfach 3163, 65021 Wiesbaden, Germany
    https://datenschutz.hessen.de

    12. Video analysis (Viral Check)

    Hookr's core function is the analysis of a video you provide. The Viral Check requires no access to your social media accounts; Hookr connects to an account only if you explicitly connect it (section 14).

    Providing a link

    If you provide a public video URL (e.g. TikTok or Instagram), we process that URL to retrieve the publicly accessible video for analysis.

    Providing an upload

    If you upload a video file, it is stored temporarily in a private storage bucket, used exclusively to perform the analysis, and automatically deleted immediately afterwards. We do not permanently store your uploaded video file.

    Analysis results

    The results generated from the analysis (Viral Score, per-dimension ratings and recommendations) may be stored in association with your account so your checks can be shown to you. They are not sold to third parties. The service providers listed in section 7 are used to generate the results.

    13. Research corpus of public videos

    To build a benchmark for the coaching recommendations, we maintain a research corpus of publicly accessible TikTok and Instagram videos. The persons covered (creators) are third parties and not necessarily Hookr users.

    Sources. The corpus is populated in two ways: through automated, periodic discovery of public videos, and through users submitting a public video for analysis or explicitly contributing it as a reference video. In both cases, only publicly accessible material is processed.

    What is stored. For each video we store only publicly available minimal data: the platform and the technical video identifier, public metrics (e.g. views, likes, comments, shares, follower count at the time of capture), hashtags, language, duration and music identifier, plus an automatically generated analysis of the public video written in our own words. Not stored: the video file, full transcripts, the video URL, the creator's handle or name, and the caption. Once the one-time metric maturation is complete, the video identifier is additionally replaced by a cryptographic one-way hash; from that point on, a corpus entry can no longer be resolved to the video or creator it refers to. No link is stored to the person who submitted or contributed a video.

    Purpose. Building and maintaining a comparison corpus against which user-submitted videos are scored and coaching recommendations are generated. No decision is made about the creator; their video serves solely as a reference data point.

    Legal basis. Legitimate interest in providing and improving the analysis service (Art. 6(1)(f) GDPR). As the data originates from public sources and individually notifying every creator would be disproportionate (Art. 14(5)(b) GDPR), this notice serves as the compensating measure.

    Retention. Corpus entries are kept only as long as they are required for the benchmark. If a video is no longer publicly available on the platform, the entry is marked stale and removed as part of a regular, automated deletion run.

    Objection and erasure. Affected creators can object to the processing at any time and request removal of their content at info@richi.solutions. Please include the links of the videos concerned: since we store neither URLs nor handles, we can locate entries only via the video identifier derivable from a link (including its hashed form). We remove the videos concerned together with their analysis from the corpus and, via a suppression list, prevent re-ingestion of the reported videos and of future videos from the same account.

    14. Connected social accounts

    You can connect your own TikTok, Instagram (professional account) or YouTube account to Hookr. This is optional and happens only after you have explicitly granted access on the platform's own sign-in page (OAuth). Access is read-only: Hookr never publishes, edits or deletes anything on your behalf.

    What we read. Your profile data (account identifier, username, display name, profile picture, follower and video counts), the list of your own videos (identifier, link, title, description, thumbnail, publication date, duration) and their performance figures as the platform reports them (for example views, likes, comments, shares, saves, reach, average watch time and, for YouTube, the audience retention curve from YouTube Analytics). For videos we analyse, the analysis result is stored with your account as well.

    Purpose and legal basis. The data is used solely to coach your own videos with real figures and to show their development over time. The legal basis is your consent (Art. 6(1)(a) GDPR), given by granting access on the platform; the coaching feature itself is provided under our contract with you (Art. 6(1)(b) GDPR). You can withdraw your consent at any time by disconnecting the account in Hookr or by revoking access at the platform (see below).

    Storage and deletion. Access tokens are stored in encrypted form and are never shown to you or to third parties. The data is refreshed once a day. It is deleted immediately when you disconnect the account or delete your Hookr account, and automatically if it could not be refreshed for 30 days (for example because you revoked access at the platform). Instagram additionally notifies us when you remove Hookr in your Instagram settings; we then delete the connection and confirm this on a status page. We do not compute derived figures from platform data and do not pass it on to third parties.

    Contribution to the research corpus. When you connect an account you choose whether your public videos may join the research corpus described in section 13. This is switched on by default; you can switch it off before connecting and at any later time, with effect for the future. A contribution never contains data read through the platform's interface: the corpus entry is built later, at a random point in time, exclusively from the publicly visible video and its public figures, exactly like an entry found by our automated discovery, and without any link to you or your account. A contributed entry therefore cannot be traced back to you and is not removed when you disconnect; as the creator you can request its removal via the route described in section 13.

    Third parties. The platforms are independent controllers of your account there; their privacy policies apply to the platform side of the connection: TikTok, Google (YouTube), Meta (Instagram).

    Google and YouTube. The YouTube connection uses YouTube API Services. By connecting a YouTube account you also agree to the YouTube Terms of Service. Hookr's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The Google Privacy Policy applies. You can revoke Hookr's access to your Google account at any time in your Google security settings; stored YouTube data is deleted when you disconnect and in any case after 30 days without a refresh.

    Revoking access. Instagram: Settings, Apps and websites, remove Hookr. TikTok: Settings and privacy, Security and permissions, Apps and services, remove Hookr. Google: the link above. Disconnecting inside Hookr revokes our access at TikTok and Google automatically; Instagram offers no revocation interface for apps, so we delete the stored data at once and you remove the app in your Instagram settings.

    15. Data deletion

    You can have the data we store about you deleted at any time:

    • Uploaded videos: deleted automatically immediately after the analysis. No action is required on your part.
    • Full account deletion: you can delete your entire Hookr account in the profile settings. Alternatively, contact us at info@richi.solutions. Your account and the associated analysis results will be removed.

    Deletion requests are processed promptly, usually within 24 hours.

    16. Updates to this policy

    We may update this privacy policy to reflect new legal or technological developments. The current version is always available on this page.