Privacy Policy

This policy explains what SupaPush collects, why we collect it, who we share it with, and what you can do about it. It covers the website and the product.

1. What we collect

Account data. Your email address, name and, if you sign in with Google, the basic profile Google returns. We use it to identify you, to let teammates see who did what, and to email you about your account.

Connected social accounts. When you connect an account we store the access token that platform issues, plus the public profile details needed to display it — handle, display name, avatar. We do not receive or store passwords for those platforms.

Your content. Posts, drafts, captions, uploaded images and video, labels and comments you write or schedule through the Service.

Performance data. Metrics we retrieve from connected platforms about posts you published — reach, engagement, follower counts.

AI inputs and outputs. Prompts you submit and the text, images or video generated from them.

Billing data. Subscription status, plan and invoice history. Card details are handled by our payment provider and never reach our servers.

Usage and device data. Pages visited, features used, IP address, browser and approximate location, plus server logs. We use this to operate the Service, diagnose faults and understand what people use.

2. Why we can use it

• To perform our contract with you — running the product you signed up for: publishing your posts, showing your inbox, billing you.
• Legitimate interests — keeping the Service secure, preventing abuse, fixing bugs, and improving what we offer.
• Consent — for marketing email and any non-essential analytics, which you can withdraw at any time.
• Legal obligation — keeping the records we are required to keep, such as for tax.

3. Who we share it with

We do not sell your personal data, and we do not share it for anyone else's advertising. We do use service providers who process data on our behalf:

• cloud hosting and database providers, to run and store the Service;
• our payment provider, to take payments and manage subscriptions;
• an email provider, for transactional and (if you opted in) marketing email;
• AI model providers, to generate the output you request from your prompts;
• the social platforms you connect — we send them exactly what you asked us to publish.

Each is bound to use the data only to provide their service to us. We may also disclose data where the law requires it, or to protect our rights or someone's safety.

4. Where data is processed

Our providers may process data in countries other than yours. Where personal data leaves its home jurisdiction, we rely on the safeguards the law provides for such transfers, such as standard contractual clauses.

5. How long we keep it

We keep account data and content for as long as your account is open. When you delete your account we delete or anonymise your personal data, except where we must keep records for legal or accounting reasons. Disconnecting a social account deletes the token we held for it.

Backups are retained on a rolling basis and are overwritten in the normal cycle.

6. Security

Data is encrypted in transit and at rest. Social tokens and API tokens are encrypted and scoped to a single workspace. Access to production data is limited to the people who need it. No system is perfectly secure, but if a breach affects your data we will notify you as the law requires.

7. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, object to or restrict how we use it, receive a portable copy, and withdraw consent. Most of this you can do yourself in Settings; for anything else, email us and we will action it.

You can unsubscribe from marketing email using the link in any such email, without affecting service email about your account.

8. Cookies

We use cookies that are necessary to keep you signed in and to keep the Service secure. We use a small number of analytics cookies to understand usage; these are not used for advertising and you can decline them without losing functionality.

9. Children

The Service is not intended for children, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will remove it.

10. Changes

We will update this policy as the product changes. If a change is significant we will tell you by email or in the product before it takes effect.

11. Contact

Privacy questions, or to exercise any right above: [email protected].