Privacy, in
plain English.

1. Website visits and enquiries

This public website has no visitor accounts or contact forms. Email links open your email application. When you contact us, we receive the address, message and attachments you choose to send. We use them to respond to your enquiry, discuss a project and manage the resulting relationship.

Hostinger hosts the website. Requests to the hosting service include technical information such as an IP address, requested URL and browser information. Hosting and error logs may be used for delivery, reliability and security. Their retention and backup settings have not been verified as part of this policy update; we do not promise a fixed deletion period.

Our contact address uses Namecheap email forwarding and a receiving email service. Those providers process correspondence in delivering and storing it. Please do not send passwords, access tokens, identity documents, financial records or tenant applications in an initial enquiry.

2. Cookies and Umami analytics

We use Umami, an open-source, privacy-friendly analytics tool that we run ourselves on a server we control, to understand visits and improve the website. Our implementation records page views, clicks on email, package, navigation, Instagram, Facebook and sister-site links, interest in service pages, missing-page paths and page-speed measurements. Earlier versions of the website recorded video starts and 75% playback milestones; those events may remain in historical analytics. The current site’s videos play from our own website with the browser’s built-in player and no video analytics.

Umami processes page and referrer URLs, browser, operating-system and device information, and approximate country information. Its tracker does not use cookies and respects your browser’s Do Not Track setting. Umami does not store visitor IP addresses in its database; ordinary server logs on the analytics server may contain them for security. We do not configure named visitor profiles or send enquiry messages, email contents, client records or social comments as analytics properties.

The site does not set advertising or tracking cookies, and does not embed Instagram or Facebook feeds, plugins or the Meta Pixel. Fonts and images are served with the site. If you use the light or dark switch, your choice is saved in your browser so the site remembers it; it is not sent to us. Following an Instagram or Facebook link opens that service, where its own policies apply. For details about Umami’s processing, see Umami’s documentation.

Analytics data stays on our own server and is not sold or shared with advertisers. We have not set an automatic deletion period for it. Because website events are not linked to your name or email by our implementation, we may not be able to identify a particular visitor’s events from an email address alone.

3. Our social-channel information

This policy covers information we handle for @whatmakesitrun (What Makes It Run) and @whatmakesitclick (What Makes It Click), including their shared Meta developer app Video Studio and Instagram app Video Studio-IG. These names identify the apps for privacy purposes; the planned direct integration is for our own channels, not client video projects.

Current direct Instagram access is limited to testing. Only @whatmakesitclick (What Makes It Click) has been connected for testing and had its token validated. @whatmakesitrun (What Makes It Run) has not been connected. A local read-only test retrieved one post and caption, and requested comments; that sample returned no comments. The supplied test did not save the retrieved data to files or upload it to the application. Only a screenshot of success messages and the zero-comment count was shared.

The manual comment workflow is already in use. Separately from that API test, authorised users can supply comments or screenshots for reply preparation. The application saves comment authors or handles, conversation text, relevant history and reply drafts. Video titles, scripts and channel context can be used to make a draft relevant. Reply-generation files and job or usage records can also be retained.

We use this information to understand comments on our own channels, prepare responses and keep track of that work. A saved or AI-generated draft is not evidence that a reply was published.

Planned, not currently verified or deployed: automated replies, direct social publishing, insights/analytics syncing and webhooks. If enabled later, these functions could process connected-account identifiers and profile information, posts and captions, comment and reply identifiers and text, publishing records, and insights made available by Meta. We will update this policy to reflect actual processing before presenting those functions as active. Direct messages are deferred; client video projects are excluded from this planned integration.

4. AI-assisted replies and service providers

The manual comment workflow uses an external AI provider to prepare reply drafts. The provider used depends on the selected setting.

Information sent to the selected provider can include the comment text, relevant conversation history, video context and any submitted comment screenshot. Screenshots may contain visible handles or other information included in the image. AI is used to interpret the supplied material and suggest a reply; its output can be inaccurate and needs human review.

Information is processed by the services needed for the relevant activity: Hostinger for website hosting; our own Umami analytics server for website analytics; Namecheap and the receiving email service for correspondence; Meta/Instagram for social access; application hosting and backup services for saved workflow data; and the selected external AI provider for reply assistance. These services do not all receive every category of information.

Provider storage, retention and data-use terms depend on the service and account settings. We have not verified all of those settings and do not claim that information is never shared, never retained by providers or never used for training.

5. Who can access information

Within the manual comment application, access is restricted to administrators and authorised users with the relevant comment and channel/project permissions. Hosting, administration, email and backup access are separate from those application permissions.

The current list of authorised people and all server or backup access holders has not been verified for this policy update. We therefore do not claim that only the operator can access all stored information. Service providers may process the information supplied to them to carry out the relevant service.

6. Retention, deletion and disconnection

Enquiry correspondence is kept as needed to respond, manage the relationship and meet applicable obligations. There is no verified single retention period for all of the information described here.

Saved manual conversations and drafts do not have a verified automatic expiry. The current conversation-delete action removes the conversation from the active database and its associated temporary screenshot, if present. It retains job and usage records and does not comprehensively remove related generation files, provider records or backups.

A complete personal-data deletion procedure still needs to be established. Backup retention and deletion-request handling have not been verified. We do not promise immediate deletion, a fixed completion deadline or removal from all backups.

Automatic deletion on Instagram disconnection is not implemented. Removing an app’s permission is different from deleting information already received or manually supplied. Do not treat disconnection or conversation deletion as confirmation that every copy has been erased.

See our data-deletion instructions for the contact route, the information needed to identify a request and the current limits.

7. Access, correction and deletion requests

Account owners, commenters and people who contact us can email hello@whatmakesitrun.com to request access to, correction of or deletion of information about them. You do not need an account on this website to make a request.

Include only enough information to locate the relevant record: your Instagram handle, whether it relates to @whatmakesitclick or @whatmakesitrun, and the post/comment link if applicable, or the email address and approximate date of an enquiry. Explain what you want accessed, corrected or deleted. Verification may be needed to avoid disclosing or changing someone else’s information. Do not send a password, access token or identity document with the initial request.

Ask for written confirmation of what was located, what was changed or removed, and what remains. The limitations in section 6 apply; the existence of this contact route is not a claim that a complete automated deletion process is available.

8. Separate client systems

Client tools and tenant-document workflows are separate deployments, not part of this public website or our planned own-channel social integration. For client-hosted systems, the client controls its records, authorised users and retention requirements. Connected AI, email and hosting providers are agreed for each project.

If a client organisation holds your information in one of its tools, contact that organisation first. It can direct any technical assistance required from us. We do not publish client or applicant records as portfolio content.

9. Who operates these services

Nur Islam, operating as What Makes It Run, is the common operator of What Makes It Run, What Makes It Click and both channels covered by this policy. For privacy questions or requests, use the contact email above. Website-specific information for Click is available in its website privacy notice; the social-channel practices described here are shared.

10. Changes and questions

We will update this page when the practices it describes change, including before launching new social-processing features. The effective date appears at the top. Questions about this policy can be sent to hello@whatmakesitrun.com.