Privacy Policy

Last updated: 1 October 2026

This policy explains how High Tech Websites (a California corporation, 5600 Mowry School Rd, Ste 190, Newark, CA 94560, USA — “we”, “us”) collects, uses, stores and deletes information when you use our client portal at portal.hightechwebsites.com and our services. Questions: hightechwebsites@gmail.com or (510) 556-3620.

Who this covers

Our customers are businesses who hire us to manage their online presence. When a customer connects a third-party business account (such as Google Business Profile, a Facebook Page, or an Instagram professional account) to our portal, we act as that customer’s service provider for the data we access on their behalf.

Information we collect

Account information

• Business name, contact name, email, phone, website, and the plan you choose, provided during onboarding.
• Requests, approvals, messages and notes you create in the portal.

Connected platform data (Facebook & Instagram)

If you connect Facebook/Instagram using Facebook Login, Meta issues us an access token and we access only what the permissions you approve allow:

• public_profile — your name, to show which account is connected.
• pages_show_list — the list of Facebook Pages you manage, so you can choose one.
• pages_read_engagement — read a selected Page’s details and content.
• business_management — confirm your management of the Page.
• instagram_basic — read the Instagram professional account linked to your Page (its id and username).
• pages_manage_posts / instagram_content_publish — publish only the specific posts you approve in the portal. We never post without your in-portal approval.

We store the Facebook Page id and name, the linked Instagram account id and username, and the access token needed to act on your behalf. We do not collect your Facebook password, your private messages, or your friends list.

Connected platform data (Google, including YouTube)

If you connect a Google account, we access only the scopes you approve on Google’s own consent screen:

• Google Business Profile (business.manage) — read and update the business locations you manage, so we can keep your listing accurate and publish only the posts you approve.
• YouTube upload (youtube.upload) — upload a video to your YouTube channel. Used only for a video you choose and approve in the portal. We never upload without your in-portal approval.
• YouTube read-only (youtube.readonly) — read your channel’s name and id, so the portal can show which channel is connected and confirm that an upload succeeded.

We store the Google account email address, the connected channel or location id and name, and the OAuth refresh token needed to act on your behalf. We do not access your Gmail, Drive, Calendar, contacts, or YouTube watch history, and we do not request those scopes. If you connect Google Analytics, Google Ads or Search Console, the same principles apply.

Limited Use. High Tech Websites’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically: we use Google user data only to provide and improve the features you connected it for; we do not transfer it to third parties except as necessary to provide those features, for security purposes, or to comply with applicable law; we do not use it for advertising or for serving ads; and we do not allow humans to read it, except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.

How we use it

• To operate the portal: show your connected accounts, prepare changes and content, and publish only what you approve.
• To keep your listings and profiles accurate and to report on performance.
• We do not sell your data, and we do not use platform data for advertising or share it with unrelated third parties.

How we store and protect it

We apply the following protections to all customer data, and specifically to sensitive data such as OAuth access and refresh tokens:

• Encryption in transit. All traffic to the portal and to every platform API is carried over HTTPS (TLS 1.2 or higher). Plain HTTP requests are permanently redirected to HTTPS, and the portal sends an HTTP Strict Transport Security header so browsers refuse to downgrade the connection.
• Encryption at rest. Data is stored in access-controlled cloud infrastructure (Vercel and Vercel-managed storage) and is encrypted at rest by the provider. Credentials and tokens are additionally held as sensitive, write-only secrets that cannot be read back out of the configuration once set.
• Tenant isolation. Every stored record is scoped to the customer organisation that owns it, and that scope is resolved on the server from a signed session — never from a business identifier supplied by the browser. One customer’s data cannot be reached from another customer’s account.
• Tokens never reach the browser. Access and refresh tokens are used only in server-side code. They are not embedded in pages, in client-side JavaScript, in URLs, or in logs.
• Least privilege. We request only the scopes each feature needs, and we drop a scope when the feature no longer needs it. Administrative access to production systems is limited to named personnel of High Tech Websites who need it to operate the service, through individually authenticated accounts.
• Deletion on disconnect. Disconnecting a platform in the portal deletes the stored token and its binding immediately, which also ends our ability to act on that account.
• No sale, no advertising use. We do not sell customer or platform data, do not use it for advertising, and do not share it with unrelated third parties.

If we ever become aware of a breach affecting your connected-account data, we will notify you at the contact address on your account without undue delay.

Retention

• Connected-account tokens and identifiers are retained while the connection is active. When you disconnect a platform in the portal, the stored token and its binding are deleted immediately.
• Account and request records are retained for the life of your account and for a reasonable period afterward for legal and accounting purposes, then deleted.

Revoking access

• In the portal: Connections → the platform → Disconnect. This deletes the stored token and binding.
• On Facebook/Instagram: Facebook → Settings & privacy → Settings → Business integrations → remove “Hightech Growth Hub”.
• On Google: myaccount.google.com/permissions.

Deleting your data

See our User Data Deletion Instructions. You can also email hightechwebsites@gmail.com and we will delete your data and revoke stored tokens.

Changes

We will update this page when our practices change and revise the date above.