SocialH4ck LLC

Privacy Policy

Last updated: October 29, 2026

Español English

1. Data controller

The public site is https://www.bunxt.com and the application is https://app.bunxt.com.

2. Scope

This policy covers:

• the website www.bunxt.com and the BUNXT application;
• accounts of agencies, freelancers, and their authorized users;
• WhatsApp Business Platform / Cloud API, Facebook, and Instagram integrations, plus Google and TikTok when a customer connects them;
• the platform’s AI, CRM, content, and ads features.

It does not cover third-party sites we link to, or processing that Meta, a customer, or an end user does on their own outside BUNXT.

3. Controller and processor

SocialH4ck LLC is the controller of account, billing, security, and product-usage data.

When an agency connects its own WhatsApp Business account and processes messages with its contacts, that agency is the controller of those end-user data and SocialH4ck LLC acts as a processor (service provider) to provide the messaging, CRM, and automations the agency configures. The agency must have a legal basis and, where required, the opt-in WhatsApp demands.

Meta Platforms, Inc. processes WhatsApp, Facebook, and Instagram data as an independent controller under its own policies.

4. Data we process

4.1 Account, usage, and billing

• Name, email address, company, and workspace or brand details.
• Sign-in credentials. Passwords are stored in protected form by the authentication provider; we do not see them in clear text.
• Product settings, invited users, and activity records needed to operate the account.
• Subscription status, billing country, and payment identifiers. The payment provider processes the full card number; we do not store it.

4.2 WhatsApp Business Platform / Cloud API

If a customer connects the WhatsApp Business Platform (Cloud API), we receive and send data through Meta’s API and webhooks in order to provide the inbox, automations, templates, and CRM.

Through the API we may also send Meta, depending on what the customer configures:

• outbound session messages and template messages, including the recipient phone number and template parameters;
• media the customer uploads in order to send;
• status actions, such as marking a message as read, when that feature is enabled.

We do not sell this data. We do not let third parties use it for their own advertising. The customer decides whom they message and must follow Meta’s messaging policies. Those duties are in the Terms of Service.

4.3 Facebook, Instagram, and other sign-in

If a person signs in or connects assets with Facebook or Instagram (including Pages, professional accounts, ad accounts, and WhatsApp Business Accounts), Meta shares the data that person authorizes. That can include:

• Meta user ID, name, email address, and profile photo, if Meta provides them;
• identifiers and names of Pages, Instagram accounts, ad accounts, and WhatsApp Business Accounts the person authorizes;
• granted permissions and the access tokens needed to keep the connection active.

We use that data for sign-in, to publish or manage the connected assets, and for WhatsApp messaging. We keep access tokens only while the connection remains active.

If the customer connects Google or TikTok, we receive the account identifier and the name, email, or other profile data that provider shares, plus the permissions granted, only for that connection.

4.4 Artificial intelligence

When a customer uses an AI feature (for example, drafting an ad, suggesting a WhatsApp flow, or generating content), we send the AI provider the text required for that request. We do not send WhatsApp history to the AI provider unless the customer uses a feature that needs that content.

4.5 Technical data and cookies

We may process IP address, browser type, device, access times, and technical logs to keep the service secure and to diagnose errors.

On www.bunxt.com we do not use third-party advertising cookies. The site may use browser local storage to remember interface preferences. The application uses cookies or tokens that are strictly necessary for the authenticated session. Meta, the payment provider, or another connected service may set its own cookies when a user interacts with that service.

5. Purposes

• Create and administer the account, workspaces, and permissions.
• Provide WhatsApp messaging, automations, CRM, content generation, and ads management that the customer turns on.
• Process subscriptions and payments.
• Provide support and operational notices about the account.
• Protect the platform, prevent abuse, and comply with Meta’s policies and applicable law.
• Improve reliability using aggregated or de-identified data.

6. Legal bases

Where the GDPR or an equivalent law applies, we rely on:

• Contract (GDPR Article 6(1)(b)): providing BUNXT, including the messaging the customer configures.
• Legitimate interests (GDPR Article 6(1)(f)): security, fraud and abuse prevention, and service improvement, balanced against the person’s rights.
• Consent (GDPR Article 6(1)(a)): where an optional feature requires it, and for WhatsApp messages that depend on the opt-in the customer must obtain.
• Legal obligation (GDPR Article 6(1)(c)): accounting, tax, and valid requests from an authority.

The agency customer is responsible for informing its contacts and for collecting opt-in before messaging them on WhatsApp.

7. Who we share data with

We share personal data only with parties that need to process it to provide BUNXT:

• Meta Platforms, Inc. (WhatsApp Business Platform / Cloud API, Facebook, and Instagram). This is required to send and receive messages, sign in, and manage assets the customer connects. Meta is an independent controller of its own processing.
• OpenAI, our AI provider, when the customer uses a feature that generates text or configures flows with AI.
• Stripe, to charge subscriptions. We do not store the full card number.
• Google (Firebase Authentication), to authenticate account access, and Google OAuth if the customer connects Google.
• TikTok, only if the customer connects that integration.
• Railway, the hosting provider for the infrastructure that serves BUNXT.
• Public authorities, when an applicable law requires us to disclose information.

These providers act as processors or as independent controllers, depending on the case. We do not sell personal data, and we do not share WhatsApp data with advertisers for their own use.

8. International transfers

SocialH4ck LLC is in the United States. Meta, the AI provider, the host, and the payment processor may process data in the United States and in other countries where they operate. If data leaves the European Economic Area, the United Kingdom, or Switzerland, we use recognized safeguards, such as Standard Contractual Clauses, where the applicable law requires them.

9. Retention

• Account and configuration data: for as long as the account is active and for up to 30 days after closure, unless a verified deletion request requires a shorter period.
• WhatsApp content and media: while the customer keeps the account connected. Deleted or anonymized within 30 days after account closure or a verified deletion request.
• Backups: up to 90 days, then overwritten or deleted.
• Technical security logs: up to 12 months.
• Billing records: up to 7 years, where accounting or tax law requires it.
• Social access tokens: until the customer disconnects the integration or the account is deleted.

We may keep the minimum necessary for longer if a legal duty, a dispute, or a security investigation requires it.

10. Data deletion

To request deletion of your data, including WhatsApp data and Facebook or Instagram login data, use the Data deletion page (https://www.bunxt.com/en/data-deletion).

Email wrojas@socialh4ck.com with the subject “Data deletion request”. That page explains what to include, how we verify the request, the 30-day response time, what we delete, and which billing records we keep because the law requires it.

11. Your rights

Depending on the person’s country, they may request:

• access to their data and a copy;
• correction of inaccurate data;
• erasure;
• restriction of, or objection to, processing based on legitimate interests;
• portability of data they provided and that we process under a contract or consent;
• withdrawal of consent, without affecting earlier processing;
• not to be subject to a decision based solely on automated processing that produces legal effects, where that rule applies. BUNXT’s AI features assist the customer; they do not make legal decisions about people.

To exercise these rights, email wrojas@socialh4ck.com. We may ask for information to confirm identity. If an agency customer controls the data (for example, a message that agency sent), we may direct the request to that agency and will assist as their processor.

If you are in the European Economic Area, the United Kingdom, or another country with a data-protection authority, you may lodge a complaint with that authority. You can also write to us first.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are used in U.S. state privacy laws.

12. Security

We use technical and organizational measures appropriate to the risk: encryption in transit (TLS), access controls on production systems, separation of credentials, and limits on which staff can view customer data. No system is impossible to breach. If an incident affects personal data, we will notify as required by law.

13. Children

BUNXT is a service for businesses and agencies. It is not directed to anyone under 18, and we do not knowingly collect data from children under 13. If you believe a child has given us personal data, email wrojas@socialh4ck.com and we will delete it.

14. Changes

If we change this policy, we will post the new version on this page and update the “Last updated” date. If a change is material, we will give notice by email or in the product when that is reasonable. Continued use after the effective date means acceptance of the updated policy, except for rights that cannot be waived.

15. Contact

Privacy and data deletion:

See also the Terms of Service.