Privacy Policy

1. Introduction

Social Post Generator ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered social media content generation service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Verified email and, when supplied by Apple or Google, name and profile image, plus your business name. Email sign-in stores a keyed code hash and bounded attempt/expiry metadata, not the code.
• Business Profile: Industry, target audience, brand voice preferences, business description
• Payment Information: Subscription and payment status from Stripe. Stripe handles payment-method details.
• Content Inputs: Information you provide to generate content (product descriptions, promotions, etc.)
• Communications: Messages sent through our contact form or support channels
• Public Share Links: A caption, visual and business details copied from a post you choose to share publicly
• Historical Programme Records: Deployments predating the removal of the referral programme may retain payout and commission records while their financial and legal retention requirements are reviewed. The current application does not create new records or attribution cookies.

2.2 Automatically Collected Information

• Usage Data: Features used and content generated; optional analytics is collected only after consent
• Consent-Gated Analytics: Browser/device, page-view and traffic-source information collected by Google Analytics only after you accept analytics
• Security and Operational Data: IP address, timestamps, rate-limit/security events and the action or route involved
• Error Data: In production, Sentry receives a scrubbed error class, application source and stack location. Request/user payloads, dynamic messages and local variables are removed; Session Replay and performance tracing are disabled.
• Cookies: Session and preference cookies (see our Cookie Policy)

3. How We Use Your Information

We use your information to:

• Provide the Service: Generate AI content tailored to your business
• Personalization: Learn your brand voice and improve content relevance
• Process Payments: Handle subscription billing securely
• Communication: Send service updates, respond to inquiries, provide support
• Improvement: Analyze usage patterns to enhance our Service
• Security: Detect and prevent fraud or unauthorized access
• Legal Compliance: Meet our legal and regulatory obligations

4. AI Processing of Your Data

Social Post Generator uses artificial intelligence to generate content. Here's how your data is handled:

• Input Processing: Your business information is processed by our AI to generate relevant content
• External AI Processing: Business information, website extracts, prompts, and generated content may be sent to the AI providers needed to produce the requested output. Review generated claims before publishing and do not submit secrets or sensitive personal information.
• Prompt Boundaries and Review: Website and visitor-supplied material is marked as untrusted before model submission, and generated output remains a draft that you must review before publishing.

5. Information Sharing

We do not sell your personal information. We may share information with:

• Service Providers: Stripe (payments), Apple and Google (identity), Google Cloud (storage and AI/Search services), Anthropic (text AI), Runware (image generation), Resend (email), Inngest (background jobs), Sentry (scrubbed error monitoring), and Google Analytics when you consent to optional analytics
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

6. International Data Transfers

The providers listed above may process data outside your country of residence. Contact us for current information about provider locations and the transfer safeguards that apply to your account.

7. Your Rights

Depending on your location, you may have the following rights:

GDPR Rights (EU/EEA)

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to certain types of processing
• Withdraw Consent: Revoke previously given consent at any time

POPIA Rights (South Africa)

• Access to your personal information
• Correction of inaccurate information
• Deletion of unnecessary information
• Object to processing of your information
• Withdraw consent for direct marketing
• Lodge a complaint with the Information Regulator

To exercise these rights, contact us at info@socialpostgenerator.app

8. Data Retention

We retain your data for as long as necessary to provide the Service:

• Active Accounts: Data retained while your account is active
• After Subscription Cancellation: Account data remains available while the account stays open. Use the account deletion request if you want the purge process to begin.
• Deletion Requests: Account access ends when a deletion request is accepted. Account data enters the daily purge queue after the 90-day retention period; queue volume may add processing time. Export data before requesting deletion if you need a copy.
• Public Share Links: A draft you choose to share remains public while your account stays open and is removed when you request account deletion. Legacy anonymous demo results enter the daily cleanup after 30 days. A short-lived share handoff cookie lasts 30 minutes.
• Contact Messages: The application does not store message content in its database; Resend and the support mailbox receive the message and confirmation copy. Their retention is governed separately.
• Audit and Provider Records: Some audit records may be retained for security, rights or financial evidence; linked email, IP and details are scrubbed during account purge. Providers may retain independent records under their own approved obligations.
• Historical Programme Records: Any records left by the retired referral programme are not used for new attribution. Their retention, export, anonymisation or deletion requires an operator-approved financial and legal decision.

9. Data Security

Current application safeguards include:

• HTTPS/TLS for data in transit
• Authenticated access controls for account data
• Encrypted storage of two-factor authentication secrets
• Security headers and rate limits on sensitive endpoints

No online service can guarantee absolute security. Please report suspected account or data issues through the contact details below.

10. Children's Privacy

Social Post Generator is not intended for users under 18 years of age. We do not knowingly collect information from children. If we become aware of such collection, we will delete it promptly.

11. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to review their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or prominent notice on our Service. The "Last updated" date indicates when changes were last made.

13. Contact Us

For privacy-related inquiries or to exercise your rights: