Privacy Policy

Information we collect

• Account name, email address, role, a one-way password hash, session identifier, and policy-acceptance timestamp/version. Enrollment checks an age range without storing a birth date or age range.
• Client and location names, business contact details, addresses, websites, branding, custom fields, social profile identifiers and credentials needed for integrations.
• Post text, schedules, uploaded images/videos/files, RSS content, publishing results, connected-account information, engagement analytics, and audience-demographic summaries supplied by connected services.
• Website/content inputs and prompts submitted to AI tools, generated outputs, invitations, saved/scheduled reports, and API-access metadata.
• Contact and support messages, attachments, privacy/legal requests, and a hash of an email address when a marketing opt-out is recorded.
• Operational request metadata such as IP addresses, request paths, status, timing, and errors. Our API request logger does not copy response bodies, but error/support processing can contain submitted details.

Why we use it

We use information to authenticate accounts, enforce permissions, publish and schedule content, provide AI generation and analytics, send requested reports and service notifications, answer support/legal requests, prevent abuse, and maintain the service. Legal bases depend on your jurisdiction and relationship with us, including providing an agreed service, legitimate operational/security interests, legal obligations, and consent where required.

Service providers and sharing

Hosting, database/storage, publishing, email, and AI providers process information necessary for the features you use. Publishing through AyrShare sends content and relevant account data to that provider and the selected social networks. AI requests may be processed by Google Gemini or Anthropic Claude; do not send unnecessary sensitive data. Postmark delivers service/support emails and, if enabled, marketing email. See our provider and resource inventory. Authorized team members and client/location users can access data within their assigned permissions. Published posts are subject to the selected network's own policies.

Providers may process information in other countries. Applicable contractual and transfer safeguards must be considered in the service agreement. This notice does not guarantee a particular processing country.

External payments and billing

The operator uses these external billing services: Stripe; FreshBooks (payments processed by Stripe). Payment and invoice information is processed by the selected provider under its own privacy notices. This application does not collect full payment-card details or synchronize subscription records from those services.

Cookies, analytics, and email tracking

We use an essential, HTTP-only login-session cookie with a seven-day rolling lifetime and local preferences such as theme. The app does not currently initialize visitor analytics, session replay, advertising pixels, or external font services. Optional tracking is not enabled. Email open and link tracking are explicitly disabled by the application. Social-account engagement analytics are a requested product feature, not a visitor-tracking pixel.

Any future optional analytics/replay/pixel integration must obtain the required consent before loading and exclude form, chat, payment, health, and other sensitive inputs. Consent to the Terms is not consent to optional tracking.

Retention and security

Account and business content are retained while needed to operate the service and meet applicable contractual/legal obligations. Sessions expire after inactivity; reset links have a limited lifetime. Request and consent records may be retained to document compliance and resolve disputes. Deletion requests are reviewed and identity/authority verified before action; third-party posts, provider records, and backups may require separate handling. We do not promise immediate deletion from every provider.

We use password hashing, protected sessions, role/client/location access checks, and transport encryption through hosting. No system can guarantee absolute security. Operational retention and provider settings can vary; contact us for the schedule that applies to your account.

Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict processing, object, receive a copy, or withdraw consent. Requests are handled under applicable law and may require identity verification. You may also contact your local data-protection authority. Marketing opt-outs are effective immediately for future marketing sends; essential service messages remain available. Client organizations may act as controllers for data they place in the service; we may need to coordinate your request with that organization.

Children

This service is not intended for children under 13. Enrollment blocks the under-13 age range before account creation. Children must not submit personal information. A parent or guardian who believes a child has provided data should use the child-data request option below so we can verify, restrict, and remove the relevant information as appropriate.

Changes

We identify changes by an updated effective date. Material changes may require additional notice or acceptance where applicable.

Submit a privacy or legal request

Do not include passwords, API keys, payment-card numbers, or sensitive information that is not needed. Children under 13 must not use this form; a parent or guardian can request help with existing child data.

Submitting a request does not itself delete an account, remove third-party posts, or cancel an external subscription. We may need to verify your identity or authority before acting.