Privacy

Who is responsible

HiggsCat is operated by Top of the World Reizen, a sole proprietorship in the Netherlands. It is responsible for the personal data described on this page. Privacy questions and requests: meestierolff@gmail.com.

What we process and why

• Account. Your email address, the name you enter, sign-in links and your session. If you choose Google login, we receive your Google account identifier, name and email address, and keep the identifier linked to your HiggsCat account. We do not retain Google access or refresh tokens or request access to your Google files, contacts or videos. Used to create your account, sign you in and keep it secure.
• Your product and content. Product links, the public website or app-store text HiggsCat reads for you, the Product DNA you confirm, daily proposals, files you upload, saved creatives and Ready files. Used to provide the service you asked for.
• Billing. Stripe handles your payment details; HiggsCat does not receive your card number. We store the Stripe customer, subscription and invoice references, payment status and the resulting allowance. Used to provide the subscription and to keep the records bookkeeping law requires.
• Publishing. Only when you connect a social channel and approve a post: the channel connection, the media and caption you approved and the publication status.
• Waiting lists. If you join a waiting list for a later plan, your email address and the plan you chose.
• Security. IP addresses and request counts, used for rate limits and abuse prevention.

We do not sell personal data and do not use it for advertising.

Connected AI assistants (MCP)

If you connect an AI assistant such as ChatGPT or Codex, HiggsCat records the client identity, the brands and permissions you approve, hashed access and refresh credentials, and the authorization and operation records needed to secure the connection. The connected service receives the data returned by the tools you use within that scope: for example, brand names, stored previews and captions, publication status or separately authorized Growth context and research. Its handling of that data is governed by that service's privacy policy. HiggsCat receives the tool arguments sent for the requested action, not your full chat history.

You can revoke a connection in HiggsCat Settings. Revocation prevents further authorized access through that connection; it does not recall data already received by the assistant or delete already published posts. Authorization and operation records may remain with your account for security and reconciliation. Account deletion requests follow the process below.

Providers that process data for HiggsCat

• Vercel serves the public website and processes its cookieless visitor analytics.
• Railway hosts the application, database and private file storage on servers in the United States (US West).
• Stripe processes payments, invoices, tax calculation and the subscription portal.
• Brevo delivers sign-in emails.
• OpenAI generates the product dossier, daily proposals and captions from your product information.
• PostForMe publishes approved posts, only for channels you connect.
• Google authenticates you only when you choose Google login. Google processes that sign-in under its own privacy policy.
• Google Fonts serves the fonts on this site; Google receives your IP address when the fonts load.
• YouTube and TikTok load their players only when you open or play a trend reference in Viral.

Some of these providers process data outside the European Economic Area, including in the United States. Contact us for details about these transfers.

Website analytics

We use Vercel Web Analytics on the public website to understand visits, popular pages, referring websites and broad device, browser and country information. It does not use analytics cookies. We remove query strings and fragments from page URLs, do not track workspace pages or form input, and respect browser Do Not Track and Global Privacy Control signals. See Vercel’s analytics privacy information.

Cookies and browser storage

HiggsCat uses the first-party hc_session cookie to keep you signed in or to keep a visitor session. It lasts up to 30 days and cannot be read by page scripts. Temporary first-party cookies also bind OAuth sign-in and consent to the browser that started them. Your browser also keeps some workspace state on your device, such as the product link you entered and your current selection. HiggsCat uses no advertising or analytics cookies. YouTube or TikTok players may set their own cookies when you play a reference.

How long we keep data

Sign-in links expire after 15 minutes, Google sign-in handshakes after 10 minutes, and sessions after 30 days. Expired Google handshakes are removed in bounded batches during later sign-ins. The linked Google identifier is retained while your account exists. Your account, Product DNA versions and Ready files are kept while your account exists, including after a trial or subscription ends, so your files stay available. When you ask us to delete your account, we delete your account data, product information and files, except records we must keep by law, such as invoices and payment records under Dutch tax law.

Your rights

You can ask for access to, correction or deletion of your personal data, a copy of it, or restriction of, or objection to, its processing. Email meestierolff@gmail.com from the address you use for HiggsCat. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the authority in your country.

Changes

When this page changes, the date above changes with it.