Privacy & consent policy

What we store

Account details, workspace content (briefs, prompts, generated media, exports), social connection metadata and an audit log of actions. OAuth tokens for connected social accounts are encrypted at rest and never sent to the browser.

Retention and deletion

Workspace owners set a retention window for generated media. Deleting a persona, campaign or connection removes its files and records asynchronously and logs completion. Deleting a workspace removes everything it contains.

Providers

Prompts and reference images are sent to the generation providers you configure (for example Replicate and Anthropic) to produce media. Exported videos are fetched by Instagram or TikTok from a time-limited delivery link only when you publish.

Consent records

For digital-twin personas we record who attested consent, when, the subject name and your ownership note. We may ask for the underlying consent document.