Privacy Policy

Last updated August 2026

What we collect

• Your account details: name, email address, and a hashed password.
• Material you give us to learn from: links you add, files you upload, and the text extracted from them.
• Social account connections: the access tokens issued by each platform, plus your public profile details such as handle, display name, avatar, and follower count.
• Content the service produces for you, your feedback on it, and the engagement figures the platforms report back.

How social account data is used

Access tokens are used for exactly two things: publishing the posts you approve, and reading the performance of posts we published. We do not read your inbox, your private messages, or content we did not publish.

Tokens are encrypted at rest with AES-256-GCM and are decrypted only for the duration of a single API call. They are never written to logs, never shown in the interface, and never shared with third parties.

Who else sees your data

• The AI provider that generates content processes your brand material and drafts. It does not train on it.
• The social platforms you connect, when publishing to them at your instruction.
• Nobody else. We do not sell data and we do not use it for advertising.

Keeping and deleting data

Your data is kept while your account is active. Disconnecting a social account deletes its tokens immediately. Deleting a workspace deletes its content, uploads, learned material, and analytics.

To delete everything, use Settings, or email us and we will action it within 30 days. If you remove the app from Facebook or Instagram, Meta notifies us and we delete the associated tokens automatically.

Your rights

You can request a copy of your data, correction of it, or its deletion at any time. Contact the address below.

Contact

privacy@cmoai.app