Hitscript is operated by KABD Consulting LLC, 8206 Louisianna Blvd, Albuquerque, NM 87113, United States (“we”, “us”). We are the controller of the personal data described in this policy. You can reach us at hello@hitscript.co.

This policy applies to https://hitscript.co and the Hitscript application. It is written for customers in the United States, the European Union, the United Kingdom and Switzerland; the sections on GDPR rights apply to you where that law applies.

We collect only what the product needs to work:

• Account data: name, email address, a hashed password (never the password itself), and, if you sign in with Google, the identifier and profile name Google shares with us.
• Product data you enter: product URLs, product descriptions, brand names, market language, and the settings you choose for research and scripts.
• Generated data: research dossiers, quotes gathered from public web pages, strategies, scripts, native ads, image concepts and their versions.
• Billing data: your plan, credit ledger, and the Stripe customer and subscription identifiers. Card numbers are entered on Stripe’s pages and never reach our servers.
• Production requests: email, phone number, brand, spend band and notes you submit through the production form.
• Usage data: which features you use (for example exports, hook swaps, page views inside the app), timestamps, and technical logs such as IP address and browser type used for security and rate limiting.

Research runs read publicly available web pages such as Reddit threads, forums, question-and-answer sites and competitor pages, and quote short passages from them. We store the quote, its source URL and the platform name so every claim in a dossier can be traced. We do not build profiles of the people who wrote those posts, we do not store their account names beyond what is visible in the public thread, and we do not contact them. If you are the author of a quoted post and want it removed from a customer’s dossier, email us with the URL.

• To provide the service: run research, generate scripts, store your library, bill your plan, send transactional email (sign-in links, receipts, password resets, verification).
• To keep the service safe: rate limiting, abuse detection, security logs.
• To improve the product: aggregated usage statistics. We do not use your product data, dossiers or scripts to train models, and we do not sell any data.
• To answer production requests you submit.

We use a small number of providers under data processing terms:

• Railway (hosting and database, United States).
• Anthropic (language models that write dossiers and scripts). Prompts contain your product data and public quotes; Anthropic does not use API data to train its models.
• Apify (retrieval of public Reddit content).
• Stripe (payments and subscriptions).
• Resend (transactional email).
• Google (optional sign-in).

Some of these providers are in the United States. Where GDPR applies, transfers rest on standard contractual clauses or the EU–US Data Privacy Framework.

Account and product data stay as long as your account exists. Deleting your account in Settings removes your brands, products, research runs, quotes, scripts and credit ledger immediately; billing records required by tax law are kept for the statutory period. Security logs are kept for 90 days. Production requests are kept until the conversation is closed and for 12 months after.

You can access, correct, export and delete your data at any time. Most of this is available in the app: Settings shows your profile and lets you delete the account; exports are one click on every script. For anything else, email hello@hitscript.co and we answer within 30 days.

Where GDPR or UK GDPR applies you also have the right to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority. Our legal bases are contract (providing the service), legitimate interest (security, product improvement) and consent (marketing email, which we only send if you opt in).

California residents: we do not sell or share personal information as defined by the CCPA. You may request the categories of data we hold and their deletion at the address above.

We set a session cookie so you stay signed in and a cookie that remembers your language. We do not use advertising cookies or third-party analytics trackers on the marketing site or in the app.

Data is encrypted in transit (TLS) and at rest by our hosting provider. Passwords are hashed with bcrypt. Access to production systems is limited to the operator. If we learn of a breach affecting your data we will notify you without undue delay.

Hitscript is a business tool and not directed at anyone under 18. We do not knowingly collect data from minors.

We will post changes here and, for material changes, email account holders. The date at the top tells you the current version.