Privacy Policy

1. Information We Collect

Personal Information: Name, email address, phone number, and other details you provide when contacting us or using our Services.

Usage Data: IP addresses, browser type, pages visited, and other data collected through cookies and analytics tools.

2. How We Use Your Information

We use your information to:

• Provide and improve our Services

• Respond to inquiries and customer support requests

• Send marketing communications (you can opt out anytime)

• Analyze website traffic and user behavior

3. Sharing Your Information

We do not sell your personal information. We may share it with third-party service providers who assist in operating our Site and Services, but only as necessary.

4. Cookies and Tracking

We use cookies to enhance your experience and collect analytics data. You can disable cookies through your browser settings, but some features of the Site may not function properly.

5. Security

We take reasonable measures to protect your personal information, but no online transmission is completely secure. Use our Services at your own risk.

6. Your Rights

You may request access, correction, or deletion of your personal data by contacting us at info@hol.com.np.

7. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be posted on our Site.

8. House of Legends Publishing Workspace and Google User Data

This Privacy Policy also applies to HoL Social Media Manager, House of Legends’ social media publishing workspace, available at so.hol.com.np. The workspace uses YouTube API Services to connect a YouTube channel, display its profile, and upload videos that you choose to publish or schedule. It also connects Facebook Pages, Instagram professional accounts and TikTok for publishing, as described in Sections 13 to 15. House of Legends is responsible for this application and its handling of your data.

When you connect YouTube through Google OAuth, we request https://www.googleapis.com/auth/youtube.readonly to identify and display your channel, and https://www.googleapis.com/auth/youtube.upload to upload videos on your behalf. The read-only permission can authorize broader YouTube account access, but our current application reads your channel profile; it does not retrieve your viewing history, subscriptions, playlists, or existing video library. We do not request Gmail, Google Drive, Google Contacts, or Google Calendar access, and we do not receive your Google password.

We access and store the channel ID and the channel profile returned by YouTube, including its title, description, custom URL or handle, thumbnail image URLs, and other metadata included in the channel snippet. We also store Google OAuth access and refresh tokens, granted scopes, token expiry information, and connection timestamps. For uploads, we process the video file and post text you provide, use that text to create the video title and description, and store the returned YouTube video ID, link, and publishing status. Your workspace login email and password are provided directly to us, not obtained from Google.

9. How We Use and Share Google User Data

We use Google user data only to provide or improve the publishing features visible in the workspace: showing the connected channel, refreshing its profile and authorization, and uploading videos immediately or at the time you schedule. Refresh tokens allow scheduled publishing without requiring you to reconnect for every upload. The general marketing and website analytics purposes described above do not apply to data obtained through Google APIs.

Channel profile information and posts are visible to authorized members of the workspace where you add the channel. Google receives the video and metadata when you publish to YouTube. Cloudflare hosts our application and processes database records and uploaded media on our behalf. Uploaded media can be fetched by anyone who has its media URL so that publishing platforms can retrieve it; do not upload files that must remain confidential. Other social platforms receive a post or media only when you select them as publishing destinations, not merely because you connect YouTube.

We do not sell Google user data or share it with advertising platforms, data brokers, or information resellers. We do not use it for targeted advertising, credit assessments, or lending. We do not use Google API data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. Human access to Google user data is limited to your affirmative permission for specific data, necessary security investigation, legal obligations, or aggregated internal operations permitted by Google policy.

House of Legends' use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google and YouTube handle data under the Google Privacy Policy.

10. Protection and Storage

The publishing workspace uses HTTPS for data in transit. Google OAuth access and refresh tokens are encrypted with AES-GCM before being stored in our database; encryption keys and provider credentials remain server-side. Channel profile fields and publishing records are stored as application records rather than encrypted OAuth tokens. Access to workspace records requires an authenticated session and workspace membership. These safeguards reduce risk, but no system is completely secure.

11. Retention, Disconnecting, and Deletion

We retain Google authorization tokens only for as long as needed to provide the features you authorize while your connection remains active. We will refresh or delete cached YouTube API data, including channel profiles and returned video metadata, within 30 calendar days of storage or the last refresh. We will periodically verify that authorization remains valid and remove cached data that is no longer needed or cannot be refreshed under a valid authorization. Drafts, post text, and media you upload directly are retained to provide your workspace until you delete them or request their removal; they are separate from data retrieved through Google APIs.

Use Disconnect for YouTube in the workspace Connections screen to stop access and remove the stored OAuth connection. We will revoke the Google token immediately and delete Google user data obtained under that authorization, including cached channel profiles and returned YouTube metadata, as soon as possible and within 7 calendar days. You can also revoke access through Google account security permissions. We will periodically reconfirm authorization and delete associated Google API data as soon as possible and no later than 30 calendar days after revocation through Google account settings.

Disconnecting YouTube does not delete videos already published on YouTube or the drafts and media you supplied directly to the workspace. Deleting a workspace post does not itself delete a published YouTube video. Manage published videos in YouTube. To request deletion of stored Google user data, uploaded media, or your workspace account, email info@hol.com.np with your workspace account email and the records you want removed. Do not send passwords or access tokens. We will verify your identity as needed and delete stored data related to you as soon as possible and within 7 calendar days of your deletion request or account closure. Where applicable law requires retention of specific records, we will explain that requirement and restrict retained records to that legal purpose. Deletion from our workspace does not delete data held by Google or YouTube.

12. Changes to Google Data Use and Privacy Contact

If we change the Google data we request or the purposes for which we use it, we will update this policy, notify affected users, and obtain any required additional consent before the new access or use begins. For questions or complaints about the publishing workspace or Google user data, contact info@hol.com.np.

13. Meta: Facebook and Instagram Connections

You may connect Meta to publish to Facebook Pages and linked Instagram professional accounts you are authorized to manage. We request pages_show_list to list eligible Pages, pages_read_engagement to access Page metadata needed by the integration, pages_manage_posts to publish Page content, instagram_basic to identify linked Instagram professional accounts, and instagram_content_publish to publish Instagram content. These permissions can authorize broader platform data access; our current integration uses them for account discovery, profile display, publishing, and checking publication results. We do not request access to your private messages, personal Facebook timeline publishing, or advertising accounts.

We access your Meta account identifier and display name, eligible Facebook Page IDs, names, usernames and Page access tokens, and linked Instagram account IDs, names, usernames and profile image URLs. We store the Meta connection identifier, display name, encrypted access token, token expiry and connection timestamps, and cache the profile identifiers, names, handles and image URLs for channels you add to a workspace. Page access tokens are processed server-side for Page selection and publishing. When you publish, we send your selected text, images, videos or media URLs to Meta and process the returned post or media IDs, processing status and Instagram permalink where available. We store publishing IDs, links, status and errors for your workspace history.

We use this data to show the accounts you can select, display their profiles, and publish the posts you request immediately or at your scheduled time. Meta processes information it receives under the Meta Privacy Policy.

14. TikTok Connections

You may connect TikTok using Login Kit and publish through its Content Posting API. We request user.info.basic to read your basic account profile and video.publish to post content to the account you authorize. We access and store your TikTok open_id and union_id where returned, display name, avatar URL and returned basic profile metadata, together with encrypted access and refresh tokens, granted scopes, expiry information and connection timestamps. We also access the creator publishing settings and restrictions returned by TikTok, including allowed visibility options, to check whether publishing is permitted.

When you publish or schedule content for TikTok, we send TikTok the selected media URL and the text and publishing settings associated with that post, and we store the returned publishing identifier, status and errors. This data is used to display the connected account, maintain authorization, and submit the posts you request. The current integration does not request your TikTok messages, contacts, follower statistics or existing video library. We do not receive your TikTok password. TikTok handles data under the TikTok Privacy Policy applicable to your region.

15. Meta and TikTok Data Protection, Sharing, and Deletion

The general marketing and website analytics purposes in Sections 1 to 4 do not apply to data obtained through Meta or TikTok APIs. We use that data only to provide and support the publishing features you authorize. We do not sell it, disclose it to data brokers or information resellers, use it for targeted advertising, or use it to train generalized artificial intelligence or machine learning models. Authorized workspace members can view channel profiles and posts in their workspace. Provider tokens are processed server-side and are not displayed as workspace content.

We protect these connections using HTTPS, authenticated workspace access, and AES-GCM encryption of stored OAuth tokens in our database. Cloudflare hosts our application and processes database records and media on our behalf. Meta or TikTok receives content and media URLs when you select that platform as a publishing destination. A connected provider does not receive another provider's account data merely because both are connected. Uploaded media is accessible to holders of its media URL so that the selected platform can retrieve it. We may disclose information where necessary to meet legal obligations or investigate security incidents, subject to the applicable platform rules.

We retain Meta and TikTok tokens only while needed for an authorized active connection. We refresh or delete cached platform profile data within 30 calendar days. When you disconnect Meta or TikTok in the workspace, we remove the stored connection tokens, revoke the platform authorization, and delete data obtained under that connection, including cached account profiles and platform metadata, as soon as possible and within 7 calendar days. The same 7-calendar-day deletion deadline applies after we learn that authorization has been withdrawn through the platform. This includes data held in our cache and database, and matches our YouTube workspace-disconnection deletion deadline. Disconnecting Meta affects both Facebook and Instagram features that depend on that connection. You may also remove access through the connected-app or business-integration settings provided by Meta or TikTok.

To request deletion of Meta or TikTok data, including remaining cached records, or to close your workspace account, email info@hol.com.np with your workspace account email, the connected platform and the records to remove. We will verify your identity as needed and delete stored data related to you as soon as possible and within 7 calendar days, subject to specific legal retention requirements that we will explain. These are our service commitments; the Google-specific provisions above continue to apply to Google data. Disconnecting does not delete content already published to Facebook, Instagram or TikTok, or drafts and media you supplied directly. Manage published content on the relevant platform; deletion requests for data held by that platform must be made there.