Privacy Policy

Last updated: October 3, 2026

1. Information We Collect

Account Information: When you sign up, we collect your email address, name, and profile image via our authentication provider (Clerk).

Usage Data: We track generation requests, credit usage, and feature interactions to improve the Service and enforce usage limits.

Content: We temporarily store prompts, uploaded images, audio files, and generated content to provide the Service.

Social Account Connections: When you connect a social media account (LinkedIn, Facebook, Instagram, X, YouTube, TikTok, Bluesky, or Reddit), we receive and store an access token and a basic account identifier (such as your page, channel, or username) so we can publish the content you create to that account. Access tokens are encrypted at rest. We do not receive your social platform password.

Voice Input: Wherever you see a microphone button, including talking with the in-app assistant, speech is converted to text by your web browser's built-in speech recognition. Depending on your browser, that audio may be sent to the browser maker's speech service (for example, Google for Chrome) under that company's own privacy terms. We never receive or store your audio, only the text that appears in the box. Spoken replies from the assistant are produced by your browser on your device. Voice is always optional; you can type instead.

Payment Information: Payment processing is handled by Stripe. We do not store your full credit card number.

2. How We Use Your Information

We use your information to: provide and improve the Service; process payments and manage subscriptions; enforce usage limits and prevent abuse; communicate with you about your account; and comply with legal obligations.

3. Data Retention

Generated content is stored for the duration of your account. Uploaded media is stored temporarily during generation. Account data is retained while your account is active and for 30 days after deletion. Credit transaction logs are retained for 2 years for financial compliance. Affiliate click and page-view records are retained for 24 months and are deleted with the account that owns them — see section 6.

4. Data Sharing

We share data with: Clerk (authentication); Stripe (payments); fal (image/video generation); Hedra (lip-sync generation); OpenAI (storyboard planning and the in-app assistant); Vercel (hosting and storage); the social platforms you connect (LinkedIn, Facebook, Instagram, X, YouTube, TikTok, Bluesky, Reddit — only to publish the content you choose); and Meta (advertising measurement, only where you have consented). If you use the Affiliate Profit Engine, clicking one of your tracking links sends the visitor on to the affiliate destination you chose; that destination is a third party whose own privacy practices apply once the visitor arrives. We do not sell your personal data.

5. Social Media Connections & Limited Use

When you connect a social media account, we access it solely to publish the content you create or schedule within the Service to that account, at your request. We request the minimum permissions needed to publish (for example, uploading a video to your own YouTube channel, or posting to a Facebook Page you manage). We do not read, collect, or store content from these accounts beyond what is necessary to publish your posts and confirm the result.

Google Limited Use: The Service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the publishing feature you requested, we do not transfer it to others except as needed to provide the Service or as required by law, we do not use it for advertising, and no humans read this data except where necessary for security, to comply with the law, or with your consent.

You can disconnect any social account at any time in Settings, which deletes the stored access token for that platform. Disconnecting does not remove posts already published to the platform; you can remove those from the platform directly.

6. Affiliate Profit Engine & link tracking

If you use the Affiliate Profit Engine, the Service creates first-party tracking links on your behalf (for example bestaimarketingsoftware.com/go/abc123). When someone clicks one of your links, we record that the click happened so you can measure your own campaigns, and then redirect them to the affiliate destination you configured.

What we record about a click. The time; which of your links, campaigns, and offers it belongs to; the visitor's country (country only, never a city or precise location); a device class (mobile, tablet, desktop); a browser family (for example “Chrome”); and the origin of the referring site (for example https://example.com, never the full URL). We also record a session key, described below.

What we deliberately do not record. We do not store the visitor's IP address. We do not store their full user-agent string. We do not store the full referring URL. We do not use cross-site tracking cookies, device fingerprinting, or any identifier that follows a visitor to another website.

The session key. To connect a click to the page view that follows it, we generate a session key: a one-way cryptographic hash of the visitor's IP address, their browser identifier, a server-side secret, and the current date. It cannot be reversed to recover an IP address, it is different on every site and every day, and it is useless for identifying anyone. It exists so that one visitor's journey through one campaign on one day can be counted once instead of twice.

Who is responsible for what. You decide which links to create and where to publish them. For the visitors who click your links, you act as the data controller and we act as your processor: we collect this information on your instructions, use it only to give you your own campaign analytics, and never use it for our own advertising, never combine it across our customers, and never sell it. If you publish affiliate links to an audience in a jurisdiction with its own notice requirements, meeting those requirements is your responsibility — see our Terms of Service.

Retention. Click and page-view records are retained for 24 months so that year-over-year campaign comparisons are possible, and are deleted when the account that owns them is deleted. Aggregated daily totals carry no visitor-level information.

Affiliate transactions. Where you record a sale, commission, or refund — by hand or by importing a report from an affiliate network — we store the amounts, the currency, the date, and any reference the network gave you. We do not receive or store your affiliate network passwords, and we do not receive payment-card details for these transactions.

7. Your Rights

You have the right to: access your personal data; correct inaccurate data; delete your account and data; export your data; and opt out of non-essential communications. To exercise these rights, contact privacy@bestaimarketingsoftware.com — we verify and respond within 30 days.

8. Cookies & consent

We use essential cookies for authentication, billing, and security — these are always active and required for the service to function. We also use analytics and advertising cookies (including the Meta Pixel) to understand usage, improve the product, and measure our advertising. In the EU, EEA, and UK these stay off until you accept (GDPR opt-in); elsewhere they are on by default and you can opt out at any time via the cookie banner or the Cookie preferences link in the footer. We honor opt-out signals and do not sell your personal information.

9. Security

We implement industry-standard security measures including encryption in transit (TLS), encrypted storage for sensitive data, and regular security reviews. API keys and secrets are stored in encrypted environment variables.

10. Children

The Service is not intended for users under 18 years of age. We do not knowingly collect data from minors.

11. Changes

We may update this policy from time to time. We will notify you of material changes via email.

12. Contact

For privacy inquiries, contact privacy@bestaimarketingsoftware.com.