Privacy policy

This policy explains what personal data AEYVLA collects, why, and what you can do about it. We keep it to what the service needs to work.

Who we are

AEYVLA is run by [Company legal name] ([Company registration number]), [Registered address]. We are the controller of your account data. For the content you add to a brand workspace, we process it on behalf of the business that owns the workspace.

What we collect

• Your account: name, email address and password (stored only as a secure hash). If you sign in with Google, Microsoft or Apple, we receive your name, email address and an account identifier from them.
• Your brand workspace: your website address and what we find on it (colours, tone of voice, products, logo), the images, videos and captions you upload or create, and the posts you plan and schedule.
• Connected social accounts: the account or page name and identifier, access tokens (stored encrypted), the posts we publish for you, and the reach and engagement numbers the platform provides.
• Connected ad accounts: the ad account's name and identifier, access tokens (stored encrypted), and each campaign's name and daily spend, impressions, clicks and conversions. We only read them: AEYVLA can't create, change or pay for ads.
• Technical data: IP address, browser and device details, and logs of requests and errors, used to keep the service secure and running.
• Payments: when paid plans are available, payments are handled by our payment provider. We never see or store your full card number.

How we use it

• To provide the service: reading your website, writing and illustrating posts, publishing them when you ask, and showing how they performed.
• To keep your account secure and prevent abuse.
• To contact you about your account, such as sign-in emails and important changes.
• To fix problems and improve the service.
• To meet legal obligations, such as bookkeeping.

Under the GDPR we rely on our contract with you to provide the service, our legitimate interest in keeping it secure and improving it, legal obligations, and your consent where we ask for it.

AI processing

To suggest captions, images and insights, we send the relevant parts of your brief, brand details and website content to our AI providers. They process it only to return a result to us, under terms that do not allow them to use it to train their models.

Who we share it with

We use these service providers, who process data only on our instructions:

• Vercel: hosting of the AEYVLA website and app.
• Supabase: database and file storage, located in the EU.
• Resend: sending email.
• Anthropic (Claude): writing posts and reading your website.
• OpenAI, and Google as a backup: making and editing AI images.

When you connect a social account, we send the posts you publish to that platform and receive account details and statistics from it. The platform's own privacy policy applies to what it does with that data. We do not sell your personal data.

Where your data is stored

Our database and files are stored in the EU. Some providers may process data outside the EU/EEA. When they do, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

We keep your data while your account is open. When you delete your account, we delete your workspace data within [30] days, and it disappears from backups within a further [30] days. Technical logs are kept for up to [90] days. We keep billing records for as long as accounting law requires.

Your rights

You can ask to access, correct, export or delete your personal data, and object to or restrict how we use it. Where we rely on consent, you can withdraw it at any time. Contact us at [privacy@ayvla.com]. You can also complain to your local data protection authority.

Deleting your data

To delete your account and everything in it, go to Settings, then Account, and choose Delete account. Your brand, its posts, products, images and connected channels are deleted straight away. You can also email [privacy@ayvla.com] from the email address on your account; we confirm when it's done, within [30] days.

To stop AEYVLA using a social account, disconnect it in Settings, under Channels. You can also remove AEYVLA's access in the platform itself, for example in Facebook under Settings and privacy, then Business integrations. We then delete the access tokens we stored for that account.

Cookies

We use cookies that are needed to keep you signed in and to keep the service secure. We don't use advertising cookies.

Children

AEYVLA is a tool for businesses and is not meant for anyone under 16.

Changes to this policy

When we change this policy we update the date above. If a change matters to how your data is used, we tell you by email or in the app before it applies.

Contact

Questions about privacy: [privacy@ayvla.com], or by post to [Company legal name], [Registered address].