Privacy Policy

1. Who this policy covers

MUSE9 Social Hub helps businesses manage social accounts, publish content and respond to customers in a unified inbox. This policy covers people using MUSE9 and people whose messages, comments or media reach a business through an account connected to MUSE9.

Service operator: ISMART9 TRADING CO., LTD (operating MUSE9 Social Hub, official websites https://hub.ismart9.com and https://ismart9.com).
Privacy contact: home@ismart9.com.

Each connected business chooses how it uses customer information for its own services. Contact that business about its products, orders and customer records. Contact ISMART9 TRADING CO., LTD (the MUSE9 operator) about information processed by MUSE9. Social platforms also handle information under their own policies.

2. Information we process

• Accounts: name, email, preferences, workspace and brand memberships, team roles, authentication records and sessions.
• Social connections (TikTok, Meta/Facebook, Messenger and Telegram): platform account, Creator/Business account and Page identifiers, display names, avatars and available profile information, granted OAuth scopes (including TikTok Login Kit user.info.basic, TikTok Content Posting API video.publish and video.upload, and TikTok Business Messaging and Comments), creator posting-info metadata (privacy options, comment/duet/stitch availability, maximum video duration), and encrypted access/refresh credentials needed for the connection.
• Conversations: messages, comments, replies, sender identifiers and available names or profile images, timestamps, delivery status, images, videos, voice recordings and documents across connected channels including TikTok Business Messaging and Comments, Facebook/Messenger and Telegram. Forwarded content may include information about other people.
• Business work: drafts, scheduled posts, uploaded media, TikTok publication settings (privacy level, commercial content disclosures, interaction toggles), brand knowledge, business website information, internal notes, assignments and approved AI guidance.
• AI and operations: prompts, relevant conversation context, transcripts, media observations, generated answers, review decisions, feedback, usage counts, errors and audit records.

The information available depends on enabled features, platform permissions and what users or businesses provide.

3. How information is used

MUSE9 uses information to authenticate users, enforce workspace and brand access, connect authorized accounts (including TikTok, Meta/Facebook and Telegram), query creator publishing capabilities, display conversations and media, publish or upload videos and posts, send replies, manage team collaboration and provide AI assistance. Operational records support delivery checks, troubleshooting, abuse prevention and service improvement.

When enabled by a business, the AI agent can draft or send customer replies and respond to relevant social comments. Businesses can route conversations to their human support team.

4. AI and business knowledge

AI features may process the current message, relevant conversation history, business knowledge and selected media. Voice can be transcribed, images analyzed and video summarized to help answer a customer. The agent may consult a business website or connected profile information for relevant products and links.

Depending on the feature and configuration, processing can use a local service or an external AI provider, including Google Gemini or OpenAI. Relevant text, media or derived information may be sent to that provider. Local processing does not mean every feature stays on the device: social delivery and configured cloud services require external processing.

Authorized team feedback can be stored as brand-specific guidance after the applicable review or confirmation. This improves future answers for that brand; it is not the same as retraining a model. Provider retention and model-improvement practices depend on the service and account terms in use. MUSE9 does not make a blanket promise that every provider has zero retention or never uses submitted data for model improvement.

AI can make mistakes. Customers can ask for a human, and businesses remain responsible for reviewing their knowledge and handling consequential decisions.

5. Who can receive information

• Authorized members of the relevant workspace or business, subject to their permissions.
• Connected social platforms, including TikTok (via TikTok Login Kit, Content Posting API and Business Messaging/Comments APIs), Meta/Facebook (including Messenger) and Telegram, to authenticate accounts, receive and deliver content, and operate the authorized connection.
• Configured infrastructure and service providers for hosting, databases, file storage, authentication and AI processing.
• The business’s configured support destination. A Telegram support-team handover can include the customer question, identifying context, a transcript or relevant media, and a draft answer.
• Appropriate recipients where required by applicable law or necessary to investigate abuse or protect the service and its users.

Public posts and public comment replies are visible under the platform’s visibility rules. Internal notes and training feedback are intended for authorized team use; confirmed customer replies are delivered to customers. Service providers may process information in countries different from yours.

6. Storage, retention and protection

Records can be held in MUSE9 databases, private media storage, the device running MUSE9, and relevant provider systems. Browser storage can retain drafts, assistant chat history and preferences. Clearing browser storage does not delete server or platform records.

MUSE9 uses authentication, workspace and brand authorization, AES-256-GCM encrypted server-side credentials and restricted media access. No service can guarantee absolute security.

There is no single automatic deletion period for all MUSE9 records. Retention depends on the active service purpose, business configuration and applicable requirements. Deletion requests must be reviewed and fulfilled across relevant records. Necessary legal, security or audit records may be retained where justified. Backups and third-party systems can have separate retention processes; relevant limitations will be explained when handling a request.

7. Your choices, account deletion and data requests

In-app self-service account deletion: Signed-in users can delete their MUSE9 Social Hub account directly inside the mobile or web app by going to Menu / Settings → Data & Privacy → Delete account → Request account deletion. Submitting a deletion request immediately revokes active sessions and places the account in a 7-day recovery window (during which the account can be restored via Restore account / Open account recovery), after which personal account credentials, profile details, preferences, and session tokens are permanently erased.

Web and email deletion or access requests: You may also request account deletion, data access, correction, or customer data removal without using the app by emailing home@ismart9.com or visiting Account & Data Deletion (https://hub.ismart9.com/data-deletion.html). Limited information may be needed to verify that a request relates to your records. Never send passwords, login codes or access tokens.

Signed-in users can download their available personal account export in Menu / Settings → Data & Privacy → Export personal data. This is a personal account export, not a complete export of every customer conversation. Disconnecting a social account (such as TikTok, Facebook, Instagram or Telegram) stops its use by MUSE9 and revokes stored OAuth tokens, but does not by itself delete historical workspace records or content already sent to a platform. You can also remove MUSE9’s access through the connected platform’s app or business-integration settings (including TikTok Settings and Privacy → Security and permissions → Apps and services permissions).

8. Updates

This policy may be updated when the service or its data practices change. The published page will show its effective or updated date. Material changes should be brought to affected users’ attention through an appropriate service notice.