Privacy Policy

1. Data controller

The data controller is Márton Donát e.v. (registered office: Hungary, 2040 Budaörs, Ibolya utca 51-53. building: A; tax number: 91557281-1-33; registration number: 61402755; EU tax number: HU91557281). Contact: [email protected].

2. What data we collect and process

To provide the Service, we collect and process the following types of data:

• Personal identification data: Full name and email address provided during registration and profile management.
• Account data and authentication tokens: Access tokens for connected platforms (Facebook, Instagram, TikTok, YouTube, X). These are encrypted (AES-256) and used only for authorized actions.
• Social media content and metadata: Posts, images, videos, descriptions, and performance metrics (likes, comments, reach) from connected accounts for analysis and content generation.
• User-uploaded content: Images, videos, and audio files (for transcription/analysis) uploaded by you. We use Cloudflare R2 for secure storage.
• Billing information: Processed by Stripe. We store only the Stripe customer ID and subscription status; we never see or store your full card details.
• Usage data: Anonymized data about feature usage and performance via Vercel Analytics and Speed Insights.
• AI-generated content: Generated brand identities, content roadmaps, ideas, images, and videos, including logs of generation tasks.

3. How we use your data

We use your data for the following purposes:

• Service delivery: To maintain your account and provide AI-driven marketing tools. Legal basis: Contract performance (GDPR Art. 6(1)(b)).
• AI functionality: To process your content through AI models for generation and analysis. Legal basis: Contract performance (GDPR Art. 6(1)(b)).
• Billing: To manage subscriptions and comply with tax laws. Legal basis: Legal obligation (GDPR Art. 6(1)(c)).
• Communication: For system updates and (with consent) newsletters. Legal basis: Consent (GDPR Art. 6(1)(a)) or Legitimate interest (GDPR Art. 6(1)(f)).

4. AI Processing and Transparency

In compliance with the EU AI Act, we provide transparency regarding our AI operations: AI Providers: We use third-party AI providers including OpenRouter (for various models like Perplexity, Gemini), OpenAI (GPT series), Google (Veo), and AssemblyAI (transcription). Data Usage for Training: While we use official Enterprise-grade APIs that typically do not use data for training by default, you expressly acknowledge and agree that third-party AI providers may, in accordance with their own terms and policies, use the data you provide and the resulting generated content to train and improve their models. We do not have direct control over the internal data practices of these independent providers. Human Oversight: Users are encouraged to review all AI-generated content before publishing. Our system acts as an assistant; the final decision to publish remains with the human user. Labeling: Content generated entirely by AI on our platform should be identified as such by the user when required by law or platform policies.

5. Data sharing and third parties

We share data with verified sub-processors to operate the Service:

• Infrastructure: Supabase (Database/Auth), Cloudflare (Storage/DNS), Vercel (Hosting/Analytics).
• AI Services: OpenRouter, OpenAI, AssemblyAI, Google (Cloud AI).
• Payments: Stripe, Inc.
• Communication: ZeptoMail (Zoho) for transactional emails.

Data may be transferred outside the EEA (e.g., to the USA). We ensure protection via Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework.

6. Data security

We use industry-standard encryption (SSL/TLS for transit, AES-256 for sensitive tokens) and strict workspace isolation to ensure your data is accessible only to authorized users within your organization.

7. Your rights

Under GDPR, you have the right to access, rectify, erase, or restrict processing of your data. You also have the right to object to automated individual decision-making that has legal or significant effects. Since our AI serves as a creative assistant and does not make final binding decisions about you, it typically does not fall under Art. 22 GDPR, but we maintain human-in-the-loop controls regardless.

8. Account deletion

You can request account deletion in your settings. We delete personal data within 30 days, except for billing records we must keep for 8 years for tax compliance (Hungarian Act C of 2000 on Accounting).

9. Cookies and Tracking

We use essential cookies for authentication and performance cookies (Vercel) for analytics. You can manage cookie preferences through your browser.

10. Legal Remedies

Please contact us first at [email protected] to resolve issues. You have the right to lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9-11. www.naih.hu.

11. Contact

Márton Donát e.v. Registered office: Hungary, 2040 Budaörs, Ibolya utca 51-53. building: A Email:

[email protected]