Privacy Policy

1. Scope

This policy applies to visitors, guest buyers, and sellers who use hibiku. It covers information handled through the marketplace, connected X accounts, Stripe Checkout, and Stripe Connect. X and Stripe process information under their own privacy policies when you use their services.

2. Information hibiku collects

Visitors and guest buyers

• Ad copy, selected seller, offer or list-price amount, and booking status.
• Checkout details returned by Stripe, such as email, billing identity, PaymentIntent and Checkout identifiers, payment status, and limited payment-method details.
• Device and usage data needed to operate and secure the Service, such as IP address, browser, request time, route, and diagnostic or fraud signals.

Payment-card numbers are entered into Stripe Checkout and are not stored by hibiku.

Sellers

• X account identifiers and profile information made available through X, such as handle, display name, profile image, follower information, and connected-account status.
• X OAuth access and refresh credentials for the scopes tweet.read, tweet.write, users.read, and offline.access.
• Listing price, offer floor, category, availability, and notification preferences.
• Stripe Express account identifier and onboarding, capability, transfer, and payout status. Stripe—not hibiku—collects the seller's full identity-verification and bank details.
• Booking history, publication identifiers and URLs, transfer records, account actions, and security or audit events.

3. How information is used

Hibiku uses information to:

• display ad spots and route buyer submissions to the selected seller;
• create card authorization holds and track their capture, cancellation, or expiry;
• publish accepted copy as a clearly disclosed ad on the seller's X account;
• enforce one active booking per seller and run the 24-hour post integrity watch;
• make separate transfers to eligible Stripe Express accounts;
• prevent fraud, abuse, unauthorized access, and policy violations;
• provide support, troubleshoot errors, keep records, and comply with legal obligations; and
• understand and improve the reliability and usability of the Service.

4. When information is shared

• Between marketplace participants. Sellers receive the submitted ad copy, amount, booking type, and limited buyer information needed to evaluate and fulfill an offer. Buyers see seller listing and public X profile information.
• With X. Hibiku sends accepted copy, disclosure text, and authentication data needed to publish and manage the sponsored post.
• With Stripe. Hibiku sends transaction, account, and booking details needed for guest Checkout, manual capture, fraud prevention, Connect onboarding, separate transfers, disputes, and payouts.
• With infrastructure providers. Hosting, database, logging, security, and communications providers may process information only to provide services to hibiku.
• For safety and legal reasons. Information may be disclosed when reasonably necessary to comply with law, respond to valid legal process, protect people or the Service, investigate fraud, or enforce agreements.
• In a business transaction. Information may transfer as part of a financing, merger, acquisition, reorganization, or sale, subject to appropriate safeguards.

Hibiku does not sell personal information or use it for cross-context behavioral advertising.

5. Legal bases

Where applicable law requires a legal basis, hibiku processes information to perform the requested marketplace service and its contracts, pursue legitimate interests in operating and securing the Service, comply with legal obligations, and act on consent where consent is the appropriate basis. Consent may be withdrawn, but that does not affect earlier processing.

6. Retention

Information is kept only as long as reasonably necessary for the purposes described here, including completing bookings, maintaining payment and tax records, resolving disputes, preventing fraud, enforcing agreements, and satisfying legal requirements. Retention periods vary by data type and obligation. X credentials are removed or made unusable when the connection is revoked, except for limited records required for security, compliance, or dispute resolution.

7. Security

Hibiku uses administrative, technical, and organizational safeguards designed to protect information, including restricted access and protected handling of authentication credentials. No online service can guarantee absolute security. Users should protect access to their X, Stripe, email, and device accounts and promptly disconnect integrations they no longer use.

8. Choices and rights

Sellers can change listing preferences, pause a listing, and disconnect X through seller settings, subject to an active booking. Depending on location, a person may have rights to access, correct, delete, restrict, or receive a copy of personal information, or to object to certain processing. Requests may require identity verification, and some information may be retained where the law permits or requires it.

Privacy questions or rights requests can be submitted through the operator contact channel made available with the Service. A person may also complain to their local data-protection authority.

9. International processing and children

Hibiku and its providers may process information in countries other than the user's own, with protections required by applicable law. The Service is not directed to children, and hibiku does not knowingly collect personal information from anyone who is not legally eligible to use the marketplace.

10. Changes

This policy may be updated as the Service or legal requirements change. The effective date will be revised when a new version takes effect. Material changes will be communicated through the Service when required.