Privacy Policy v1

# Privacy Policy Last updated: June 12, 2026 WHAT WE COLLECT. Account data (name, email, password hash), workspace content (creatives, briefs, brand profiles, uploads), connected social account tokens (encrypted at rest), billing data (processed by Stripe — we never store card numbers), usage and log data, and cookies needed for login and preferences. HOW WE USE IT. To operate the Service: generating content (your briefs and brand profile are sent to our AI providers solely to fulfil your requests), publishing to accounts you connect, billing, support, security and service emails. We do not sell personal data and we do not use your content to train AI models. PROCESSORS. We use service providers including AI providers (e.g. OpenAI; HeyGen for avatar video), Stripe (payments), cloud storage/CDN, and email delivery — each receives only what is necessary. RETENTION. Account data is kept while your account is active. You can export your data (Security page → Download my data) or request deletion; deletion requests are honoured within 30 days, subject to records we must keep by law. YOUR RIGHTS. Depending on your region (GDPR/CCPA), you may access, correct, export, delete, or object to processing of your data. Use the in-app tools or contact us. SECURITY. Encryption in transit and at rest for secrets, role-based access, audit logging. No system is perfectly secure; notify us immediately of any suspected breach of your account.