Privacy Policy

Last updated: June 20, 2026

1. Information We Collect

Account Information: When you sign up, we collect your email address, name, and profile image via our authentication provider (Clerk).

Usage Data: We track generation requests, credit usage, and feature interactions to improve the Service and enforce usage limits.

Content: We temporarily store prompts, uploaded images, audio files, and generated content to provide the Service.

Social Account Connections: When you connect a social media account (LinkedIn, Facebook, Instagram, X, YouTube, TikTok, Bluesky, or Reddit), we receive and store an access token and a basic account identifier (such as your page, channel, or username) so we can publish the content you create to that account. Access tokens are encrypted at rest. We do not receive your social platform password.

Payment Information: Payment processing is handled by Stripe. We do not store your full credit card number.

2. How We Use Your Information

We use your information to: provide and improve the Service; process payments and manage subscriptions; enforce usage limits and prevent abuse; communicate with you about your account; and comply with legal obligations.

3. Data Retention

Generated content is stored for the duration of your account. Uploaded media is stored temporarily during generation. Account data is retained while your account is active and for 30 days after deletion. Credit transaction logs are retained for 2 years for financial compliance.

4. Data Sharing

We share data with: Clerk (authentication); Stripe (payments); fal and Replicate (image/video generation); Hedra (lip-sync generation); OpenAI (storyboard planning); Vercel (hosting and storage); the social platforms you connect (LinkedIn, Facebook, Instagram, X, YouTube, TikTok, Bluesky, Reddit — only to publish the content you choose); and Meta (advertising measurement, only where you have consented). We do not sell your personal data.

5. Social Media Connections & Limited Use

When you connect a social media account, we access it solely to publish the content you create or schedule within the Service to that account, at your request. We request the minimum permissions needed to publish (for example, uploading a video to your own YouTube channel, or posting to a Facebook Page you manage). We do not read, collect, or store content from these accounts beyond what is necessary to publish your posts and confirm the result.

Google Limited Use: The Service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the publishing feature you requested, we do not transfer it to others except as needed to provide the Service or as required by law, we do not use it for advertising, and no humans read this data except where necessary for security, to comply with the law, or with your consent.

You can disconnect any social account at any time in Settings, which deletes the stored access token for that platform. Disconnecting does not remove posts already published to the platform; you can remove those from the platform directly.

6. Your Rights

You have the right to: access your personal data; correct inaccurate data; delete your account and data; export your data; and opt out of non-essential communications. To exercise these rights, contact privacy@bestaimarketingsoftware.com — we verify and respond within 30 days.

7. Cookies & consent

We use essential cookies for authentication, billing, and security — these are always active and required for the service to function. We also use analytics and advertising cookies (including the Meta Pixel) to understand usage, improve the product, and measure our advertising. In the EU, EEA, and UK these stay off until you accept (GDPR opt-in); elsewhere they are on by default and you can opt out at any time via the cookie banner or the Cookie preferences link in the footer. We honor opt-out signals and do not sell your personal information.

8. Security

We implement industry-standard security measures including encryption in transit (TLS), encrypted storage for sensitive data, and regular security reviews. API keys and secrets are stored in encrypted environment variables.

9. Children

The Service is not intended for users under 18 years of age. We do not knowingly collect data from minors.

10. Changes

We may update this policy from time to time. We will notify you of material changes via email.

11. Contact

For privacy inquiries, contact privacy@bestaimarketingsoftware.com.