Privacy Policy

1. What we collect

• Account data: your name, email address, and password (stored as a salted hash, never in plain text).
• Workspace & brand data: whatever you enter about your organization and brands — brand voice, target audience, products, uploaded logos/photos — so our AI can generate content grounded in your actual facts instead of inventing claims.
• Connected social accounts: when you connect a Facebook Page, Instagram Business account, or LinkedIn Page, we store an encrypted access token and basic account identifiers (page name, ID) needed to publish on your behalf and read back engagement metrics. We never see or store your Facebook/LinkedIn password — authentication happens entirely through Meta's/LinkedIn's own OAuth login.
• Content you create: AI-generated and manually written posts, images, and their publishing history.
• Billing data: plan, subscription status, and invoice records. Card/payment details themselves are handled entirely by our payment processor (Razorpay) — they never pass through or get stored on our servers.
• Usage & security logs: login/logout events, IP address and browser user-agent at the time of security-relevant actions (sign-in, connecting/disconnecting a social account), kept for 365 days and then automatically deleted.
• Link-click analytics: if you generate a tracked link, we record clicks against a salted, one-way hash of the visitor's IP address — never the raw IP itself — so we can show unique-vs-repeat click counts without being able to identify the visitor.

2. Why we collect it

Strictly to run the service you signed up for: generating on-brand content, publishing it to the social accounts you explicitly connected, showing you analytics, billing your subscription, and keeping the platform secure. We do not sell your data, and we do not use your brand or content data to train third-party AI models beyond the single API call needed to generate your content.

3. Who we share it with

Only the third-party services required to actually provide the feature you're using:

• Meta & LinkedIn — to publish posts and read metrics for the accounts you connect, via their official APIs only.
• AI providers (OpenAI, and Anthropic where configured) — your prompt and relevant brand context are sent to generate text/image content; these providers process it under their own API data-use terms and do not receive your login credentials.
• Razorpay (and Stripe, where configured) — to process subscription payments.
• Our hosting provider — to run the servers and database the app runs on.

We never sell personal data to advertisers or data brokers.

4. Your controls

• Disconnect a social account any time from Brands → Social Accounts → Disconnect. This immediately and permanently deletes the stored access token — we can no longer access that account afterward.
• Delete your whole workspace from Team → Danger Zone (workspace owners only). This revokes every connected social credential and removes your brands, content, and workspace data.
• Request full account deletion — see our Data Deletion page for exactly how.

5. Data retention

We keep security/audit logs for 365 days and detailed post-performance history for 180 days before automatic deletion (we always keep a post's latest known metrics, just not the older snapshots). Workspace/brand data is kept as long as your account is active, or until you request deletion.

6. Contact

Questions about this policy or your data: postkaroai@breval.co.in.