Privacy Policy & Applicant Notice
Version: October 18, 2026 · Effective when published on this website.
1. Who we are and what this covers
UpperStatus, Inc., operating HartBeat OS, is responsible for the website and Score Keeper processing described here. This notice covers visitors, prospects, applicants, contributors and authorized social-account managers. Separate customer agreements address business data processed through deployed appliances and other paid services. External platforms have their own privacy policies. A description of a planned integration does not mean it is connected or approved.
2. Information and purposes
| Information | Examples | Purpose |
|---|---|---|
| Inquiries and registrations | Name, email, phone, business, goals, plan interests, webinar choices and correspondence | Respond, provide requested information, administer registrations and support |
| Applications and contributions | Experience, résumé, skills, availability, portfolios, submitted work, licenses, agreements and review records | Evaluate applications, administer agreements and document rights and decisions |
| Connected account identity | Provider account identifiers, display name, avatar, username and profile link; additional profile fields only when needed and authorized | Identify the authorized account and label its scoreboard accurately |
| Social measurements and public media | Follower, following, like and public-video totals; public video IDs, titles, timestamps, links or thumbnails, and available view, like, comment and share counts | Display authorized profiles and videos, report measurements, compare valid baselines and investigate errors |
| Connection and evidence records | Access/refresh tokens, granted scopes, expiry information, authorization records, collection times, metric definitions, response hashes and limited non-secret evidence | Maintain authorized connections, refresh access, verify measurements and honor withdrawal |
| Technical and preference data | IP address or abuse-prevention hashes, browser details, access logs, session identifiers, visitor counts, appearance preferences and player interactions | Operate the website, maintain preferences, measure use, prevent abuse and troubleshoot |
We receive data from you, authorized representatives, connected providers following authorization, service providers supporting the website, and public references you supply. We do not request passwords, government ID, financial account details or sensitive medical information in ordinary inquiries or initial applications.
3. TikTok and other social integrations
When the TikTok connection is available, Login Kit handles authorization and the Display API supplies permitted profile, account-statistics and public-video data. The intended read-only scopes are user.info.basic, user.info.profile, user.info.stats and video.list. The authorization screen identifies the permissions actually requested; data availability depends on granted permissions and provider approval. We do not collect your TikTok password, direct messages, private videos, payment details or the identities of individual followers through this integration. Comment counts do not mean comment text is collected.
We use connected-platform data only for the authorized service, its security and support, and applicable obligations. We do not sell or rent this data, use it for cross-context behavioral advertising, or train general-purpose AI models on it. We do not use access tokens for unrelated functions. Access tokens and private connection records are not public scoreboard content.
4. What is public
The HartBeat OS public scoreboard reports HartBeat’s own approved business measurements, account references and observation times. Public videos or links may be shown where authorized. For any other connected account, we require a separate, informed publication choice before making identifiable account data public. Connecting an account alone is not consent to publish all retrieved data. Public information may be indexed or copied by visitors; removing it from our website cannot guarantee removal of copies controlled by others.
Applications, résumés and private contact information are not public Hall of Fame content. We do not publish an applicant’s name, portrait or work merely because they apply. Public recognition requires separate permission. Ownership of assigned work does not transfer ownership of a person’s identity.
5. Recipients and service providers
Authorized personnel and contractors receive access appropriate to their work. Hosting, database, email, storage, scheduling, webinar and CRM providers may process information to deliver the functions you use. Professional advisers, authorities and other recipients may receive necessary information for compliance, valid legal process, fraud prevention, disputes or safety. A lawful business transfer may involve records with appropriate safeguards and notice. Service providers are to process information for authorized purposes subject to appropriate confidentiality and security requirements. Publicly approved scoreboard content is visible to site visitors.
We do not sell or rent applicant contact lists or disclose applications for cross-context behavioral advertising. Optional career or promotional communications require the applicable choice; withdrawal does not prevent a requested service response.
6. Cookies, embedded services and communications
The site can use session and security cookies, local appearance preferences, visitor counting and media-player features. Third-party content such as market tickers, social embeds, videos, scheduling or App Suite portals can receive technical information when loaded or visited and may set their own cookies. A link to a third party does not give HartBeat control over its processing.
You can adjust browser storage and cookie settings, although some functions may stop working. Optional tracking and legally required consent or opt-out signals must be honored for the deployment concerned. To ask about tracking or exercise an applicable opt-out right, contact us below. Promotional messages include the applicable unsubscribe mechanism; you can also contact us to withdraw optional communication choices.
7. Retention, withdrawal and deletion
We keep identifiable information only as long as needed for the stated purpose or a valid legal, security or records obligation. Connection credentials are needed only while a connection is authorized. On a verified disconnection or deletion request, we stop scheduled collection for that account and remove or revoke its stored credentials as applicable. We delete associated identifiable social data and public displays unless a specific legal obligation requires limited retention. Requests are handled by our team; this policy does not imply that an automated deletion service has already been implemented.
Historical social snapshots are retained while needed for the authorized scoreboard and comparable growth history, subject to withdrawal, platform requirements and deletion rights. Inquiries are reviewed for deletion or de-identification after 24 months without meaningful activity. Application and employment-related records are retained for applicable statutory periods and any necessary claim or legal hold. Essential signed agreements and provenance evidence may be retained while needed to establish rights. Security and request-handling records are limited to a documented need.
We aim to complete verified social-data deletion requests within 30 days, or sooner where applicable rules require. If a lawful extension or exception applies, we explain it. Copies in restricted backups may persist until their ordinary replacement cycle; they are not used to reactivate a deleted connection, and deletion must be reapplied if a backup is restored. Limited records needed to demonstrate that we honored a request may remain. See Data Deletion Instructions for the request route. Deletion from HartBeat does not delete your original social account or posts.
8. Rights and lawful processing
You may request access, correction, deletion, withdrawal of optional consent or information about our handling. Depending on applicable law, you may also have portability, restriction, objection, advertising opt-out, authorized-agent or appeal rights, and the right to complain to a relevant regulator. We verify requests proportionately, explain exceptions and respond within applicable legal periods without penalizing protected rights. We do not require a password or token to make a request.
Where a legal basis is required, processing relies as appropriate on requested services or contractual steps, consent for optional connections and uses, legitimate interests in secure operation and relevant business communications where those interests do not override your rights, or legal obligations. Withdrawal does not change the lawfulness of prior processing. This notice does not assert that every privacy statute applies to every interaction.
9. Security, locations and human oversight
We use measures appropriate to the processing, including restricted administrative access and separation of private credentials from public website content. No service can guarantee absolute security. Provider-hosted website and scoreboard processing may occur in the United States and other service-provider locations; it is not a promise of local-only appliance storage. Where required, appropriate safeguards must apply to international transfers.
Human reviewers are responsible for hiring and recognition decisions. Authorized AI assistance does not permit submitting private applications to unrestricted consumer AI tools or training general-purpose models on applicant identities without a separate lawful, informed permission. Contribution licenses do not override personal-data protections.
10. Children and changes
Social-account connection functions are intended for adults aged 18 or older. We do not knowingly solicit personal information from children under 13 through this website. If you believe a child has supplied personal data, contact us so we can investigate and remove it as required. Minors’ applications require a separately approved process.
This version adds Score Keeper account access, public display, retention and deletion disclosures. We will identify later revisions, provide appropriate notice of material changes and obtain new permission where required. A revised notice does not retroactively authorize a previously undisclosed use.
Privacy, support and policy requests: legal@hartbeatos.com. Include your account handle and request, but never send passwords, API tokens or identity documents by ordinary email.