Privacy Policy

1. Who we are

K2026679039 (SOUTH AFRICA) (Pty) Ltd, trading as Social Post Generator ("we", "our" or "us"), is a South African company that develops and operates Social Post Generator on the web and in our iPhone, iPad and Android apps (the "Service"). We serve customers worldwide.

We are the responsible party under South Africa's Protection of Personal Information Act (POPIA) and the controller under the EU and UK General Data Protection Regulation (GDPR) for the personal information described here.

• Address: 31 Buitenzorg Road, Somerset West, South Africa
• Information Officer: Pierre Blom
• Privacy contact: info@socialpostgenerator.app

2. Information we collect

2.1 Information you provide

• Account Information: Verified email and, when supplied by Apple or Google, name and profile image, plus your business name. Email sign-in stores a keyed code hash and bounded attempt/expiry metadata, not the code.
• Business Profile: Industry, target audience, brand voice, business description, offers, website address and similar business facts
• Product Photos: Images you choose to upload for your brand. The apps only access the photos you select.
• Content Inputs and Edits: Information you provide to generate content, and your edits to drafts
• AI Permission Records: When you give or withdraw permission for AI processing in the apps, and which version of the notice you saw
• Reports and Communications: Draft reports, support requests and messages sent through our contact form or support channels
• Launch Waitlist: The email address and signup source you submit, and the signup date. We use these to record your request and send confirmation and launch updates. Joining does not create an account or start a subscription. Contact us to request removal from the waitlist.
• Public Share Links: A caption, visual and business details copied from a post you choose to share publicly
• Historical Programme Records: Deployments predating the removal of the referral programme may retain payout and commission records while their financial and legal retention requirements are reviewed. The current application does not create new records or attribution cookies.

2.2 Payment information

Website subscriptions are paid through Stripe, which handles your card details; we receive your subscription status, plan and payment identifiers. In-app subscriptions are paid through Apple or Google; we receive the purchase and subscription records we need to confirm and maintain your access, not your card details.

2.3 Automatically collected information

• Usage Data: Features used and content generated; optional analytics is collected only after consent
• Consent-Gated Analytics: On the website, browser/device, page-view and traffic-source information collected by Google Analytics only after you accept analytics
• Consent-Gated Advertising Measurement: If you accept analytics cookies on the website, the Meta pixel records page views, waitlist sign-ups, account registration and the value of a confirmed subscription so we can measure our Facebook and Instagram adverts. It is not loaded if you reject or withdraw consent. The apps contain no advertising or tracking SDKs.
• Security and Operational Data: IP address, timestamps, rate-limit/security events and the action or route involved
• Error Data: In production, Sentry receives a scrubbed error class, application source and stack location. Request/user payloads, dynamic messages and local variables are removed; Session Replay and performance tracing are disabled. App crash reports are scrubbed the same way and do not include your email or sign-in tokens.
• Cookies: Session and preference cookies on the website (see our Cookie Policy)

3. How we use information and our legal bases

We process personal information only for these purposes. Where the GDPR or POPIA applies, the legal basis is shown for each.

• Provide the Service, including generating drafts, storing your profile and photos, and syncing across devices: performance of our contract with you.
• Send your information to AI providers to generate content: performance of our contract and, in the apps, your explicit permission, which you can withdraw at any time.
• Billing and subscriptions: performance of our contract and our legal obligations (tax and accounting).
• Support, service and launch messages: performance of our contract or our legitimate interest in keeping you informed; waitlist emails are based on your request.
• Security, fraud prevention and abuse reports: our legitimate interest in protecting customers and the Service, and legal obligations.
• Optional website analytics and advert measurement: your consent, which you can withdraw in Cookie Settings.
• Improving the Service using aggregated usage and error information: our legitimate interest.
• Legal compliance and responding to lawful requests: legal obligation.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI is used only to draft content for you to review.

4. AI processing of your data

• External AI Processing: Business information, website extracts, product photos, prompts and generated content may be sent to the AI providers needed to produce the requested output: Anthropic (text, and web searches about your business topic and market for platform and seasonal research), Google (Gemini and search services) and Runware (images).
• Permission in the apps: The apps ask for your permission before sharing information with AI providers, and you can withdraw it in Settings.
• Prompt Boundaries and Review: Website and visitor-supplied material is marked as untrusted before model submission, and generated output remains a draft that you must review before publishing.
• Do not submit secrets or sensitive personal information, such as health or financial details about individuals.

5. Who we share information with

We do not sell your personal information. We share it only with:

• Service Providers acting for us: Stripe (payments), Apple and Google (sign-in and in-app billing), Google Cloud (storage and AI/search services), Anthropic (text AI and web search), Runware (image generation), Resend (email), Inngest (background jobs), Sentry (scrubbed error monitoring), our hosting provider, and Google Analytics and Meta (advertising measurement) only when you consent to optional analytics
• People you choose to share with, such as viewers of a public share link you create
• Legal Requirements: When required by law or to protect rights, safety and the Service
• Business Transfers: In connection with a merger, acquisition, or sale of assets, subject to this policy

Payment providers and app stores may keep their own financial records independently of your account with us, under their own privacy policies.

6. International transfers

We are based in South Africa, and our providers process data in other countries, including the United States and the European Union. When we transfer personal information across borders, we rely on the safeguards that the applicable law recognises, such as the providers' data processing agreements and standard contractual clauses, or the transfer being necessary to provide the Service you asked for. Contact us for more information about the safeguards that apply.

7. Your rights

Wherever you live, you can ask us to access, correct, export or delete your personal information, and you can withdraw consent you have given. Depending on your location, you may also have:

South Africa (POPIA)

• Access to and correction of your personal information
• Deletion of information we no longer need
• Objection to processing, including direct marketing
• A complaint to the Information Regulator

European Union, EEA and United Kingdom (GDPR)

• Access, rectification, erasure, restriction and portability
• Objection to processing based on our legitimate interests
• Withdrawal of consent at any time
• A complaint to your local data protection authority, or in the UK to the Information Commissioner's Office

United States

Residents of California and other states with privacy laws may request access to, correction of and deletion of their personal information, and may opt out of sale or sharing. We do not sell personal information. The Meta pixel on our website may count as "sharing" for advertising under some state laws; it runs only if you opt in, and you can withdraw at any time in Cookie Settings. We will not discriminate against you for using these rights.

To exercise a right, email info@socialpostgenerator.app. You can also export your data and delete your account in the apps or your account settings. We will verify your identity before acting and respond within the time the applicable law requires, usually within 30 days.

8. Deleting your account

Delete your account in the app (Settings), in your website account settings, or without the app on our account deletion page, which verifies ownership with an email code and, if enabled, your second factor. Deletion immediately ends access, revokes public share links and cancels website and Google Play renewals where we can. Apple subscriptions must be cancelled in your Apple subscription settings. Files you exported to other apps cannot be recalled.

9. Data retention

• Active Accounts: Data is kept while your account is open, including after a subscription is cancelled.
• Deleted Accounts: Account data, uploaded photos and generated content are permanently erased by our daily purge within 90 days of an accepted deletion request. Export data before deleting if you need a copy.
• Public Share Links: A draft you choose to share remains public while your account stays open and is removed when you request account deletion. Legacy anonymous demo results enter the daily cleanup after 30 days. A short-lived share handoff cookie lasts 30 minutes.
• Contact Messages: The application does not store message content in its database; Resend and the support mailbox receive the message and confirmation copy. Their retention is governed separately.
• Audit, Billing and Provider Records: Some audit records are kept for security and legal evidence with email, IP and details scrubbed during account purge. Billing records needed for tax and accounting are kept for the period the law requires. Providers may keep independent records under their own obligations.
• Backups: Residual copies may remain in backups until those backups expire on their regular schedule.
• Historical Programme Records: Any records left by the retired referral programme are not used for new attribution. Their retention, export, anonymisation or deletion requires an operator-approved financial and legal decision.

10. Data security

Current safeguards include:

• HTTPS/TLS for data in transit
• Authenticated access controls for account data
• Encrypted storage of two-factor secrets and sign-in tokens on your device
• Security headers and rate limits on sensitive endpoints

No online service can guarantee absolute security. If we become aware of a breach that affects your personal information, we will notify you and the relevant regulators as the law requires.

11. Children

Social Post Generator is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children, and we will delete it if we learn that we have.

12. Third-party links

The Service may link to third-party websites and platforms. Their own privacy policies apply to them.

13. Changes to this policy

We may update this Privacy Policy. We will tell you about material changes by email or a prominent notice in the Service. The "Last updated" date shows when it last changed.

14. Contact us