Privacy Policy

1. Information we collect

Account information: your name, email address and organisation details, managed through our authentication provider (Clerk).

Connected platform credentials: OAuth tokens for social platforms you choose to connect (Reddit, X, LinkedIn, Medium). These are encrypted with AES-256-GCM before storage and are used solely to publish and measure content on your behalf.

Usage and performance data: campaign configurations, content you create or approve, engagement metrics returned by connected platforms, and conversion events you report through our attribution API.

Technical data: log and diagnostic information needed to operate and secure the service.

2. How we use your information

To operate the service: generating content, publishing to your connected accounts at your direction, monitoring performance and attributing outcomes.

To keep you informed: transactional emails such as approval requests and account notices.

To improve reliability and safety: aggregate, de-identified analysis of system performance.

We do not sell your personal information.

3. AI processing

Content drafting and analysis use third-party AI providers (currently DeepSeek, OpenAI, Groq and Google). Campaign context you supply may be sent to these providers to generate content. We apply daily spend caps and do not permit providers to use your data for advertising.

AI-generated content is subject to a multi-layer safety review, and — unless you enable full autonomy — human approval before publication.

4. Service providers

We rely on vetted infrastructure providers to run Signal: Clerk (authentication), Neon/Railway (database hosting), Upstash (caching), Inngest (job processing), Resend (email) and the AI providers listed above. Each processes data only to provide their service to us.

5. Data retention and deletion

Campaign and analytics data is retained while your account is active. Operational logs are pruned on a rolling schedule (typically 90–365 days depending on record type).

You may disconnect platform credentials at any time, which deletes the stored tokens. To request full account deletion, contact us at the address below.

6. Security

Platform credentials are encrypted at the application layer before database writes. All traffic is served over HTTPS with strict transport security. Administrative actions are recorded in an audit log.

7. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export or delete your personal data. Contact us and we will respond within 30 days.

8. Changes and contact

We will post any material changes to this policy on this page. Questions or requests: hello@outboxcom.com.