Last updated: [DATE]
When you register: business name, your name, email, phone, chosen subdomain, and a password (stored as a one-way hash, never in plain text). Payment details are collected and processed directly by our payment processor (Stripe) — we never see or store your card details.
Once provisioned, your instance is an isolated environment that stores whatever business data you put into it: leads, buyer/vendor records, generated content, and any third-party credentials you choose to connect. This data is not shared with, or accessible from, any other subscriber's instance.
| Data | Where it lives | Who can access it |
|---|---|---|
| Registration details, billing status | Platform database | Platform operator only |
| Your leads, content, business records | Your own isolated instance | You (and the platform operator, only as needed for support/maintenance) |
| Third-party credentials you connect (social, email, etc.) | Your own instance's configuration, not the platform database | Your instance only — used to act on your behalf as you've configured |
Depending on what you connect, your instance may send data to: your chosen AI provider (for content generation), social media platforms you authorize, your email provider, and — if enabled — a video-generation service. Each of those is governed by that provider's own privacy policy; connecting them is optional and entirely your choice.
We use your registration and billing data to operate your subscription (provisioning, billing, support) and to send you service-related email (e.g. your login link, password resets, billing notices). We do not sell your data.
Active subscriptions: for as long as your subscription is active. Cancelled subscriptions: your instance is paused, and data is retained for [RETENTION PERIOD] to allow reactivation or export, after which it's permanently deleted.
You can request a copy of your platform-level registration data, or request account deletion, by contacting [SUPPORT EMAIL]. [Add jurisdiction-specific rights language here — GDPR/CCPA/APP rights differ and should be drafted by a lawyer for the jurisdictions you actually operate in.]
Passwords are stored as salted one-way hashes, never in plain text. Each subscriber's instance runs in its own isolated environment. [Describe your actual infrastructure security practices here once finalized — encryption at rest/in transit, access controls, etc.]
Questions about this policy or your data: [SUPPORT EMAIL].