Privacy Policy

Plain-English summary

We collect the minimum we need to run Svmmon. We never sell your data. You can export everything or delete your account from Settings at any time. EU and California residents get the same rights everyone else does. They're built into the product, not bolted on.

What we collect

• Email address. Used to sign you in.
• Display name. If you set one.
• Content you create. Profiles, hook prompts, slideshows, images, automations, saved research.
• Support correspondence. If you email us or open a ticket, we keep the message so we can reply.
• Post performance. View counts, likes, platform handles. Pulled from your connected accounts via each platform's API. Powers the marketing intelligence loop.
• Linked social usernames. Your TikTok / Instagram / YouTube handle if you connect them. We do not pull anything you didn't explicitly authorize.
• Billing info. Our payment processor holds card numbers, billing addresses, and invoice history. We never see card numbers. We store only the customer + subscription IDs.
• IP addresses and user-agent strings. Written to security logs for fraud and abuse prevention. Retained up to 180 days, then purged.
• Consent records. When you agreed to which version of this policy. Required by GDPR / CCPA.
• Encrypted AI provider API key. Only if you opt into BYOK on the Unlimited tier. Stored encrypted at rest; we never log the plaintext.

What we do NOT collect

• No third-party advertising trackers, marketing pixels, or session-replay tools.
• No keystroke logging.
• No card numbers. Our payment processor handles all payment data.
• No phone numbers (we don't do SMS).
• No biometric data.

How we use your data

• Run your account. Sign you in, generate and store your content, charge you, and send service notifications.
• Enforce quotas and prevent abuse. Usage metering, rate limiting, and fraud detection.
• Improve the product. Aggregate, anonymized usage patterns may inform product decisions. We do not use your individual content for AI training without your explicit opt-in.
• Community intelligence. Anonymized post-performance patterns, stripped of account identities, are pooled across creators to power the community-level insights shown to members.
• Comply with law. When required by valid legal process.

Who we share data with

We share the minimum needed to run the service:

• Payment processor. Billing and subscription management.
• AI provider. Slideshow and hook generation. Per its API terms, your inputs are not used to train models.
• Cloud hosting. Database, file storage, and authentication.
• Messaging provider. Only if you opt in for export delivery or admin alerts.
• Research providers. When you use research features. Only public content and your search queries go through these services.
• Product analytics & error monitoring. We use PostHog (privacy-respecting product analytics) and Sentry (error monitoring) to operate and improve the product. They receive product-event and error data only. Never your generated content, never for advertising, and not used to train models.
• Social platforms you connect. Only when you explicitly authorize OAuth, and only the data their APIs require to post on your behalf.

We do not sell your data. We never share data for advertising.

The full, versioned sub-processor list lives at /subprocessors with each provider's purpose, location, and policy link. EU and UK customers, see also our Data Processing Addendum.

YouTube API Services. When you connect a YouTube account, Svmmon uses YouTube API Services to publish content to your channel and to read performance metrics on your own videos. By using Svmmon's YouTube integration, you agree to be bound by the YouTube Terms of Service. Google's handling of any data accessed through YouTube API Services is governed by the Google Privacy Policy. You can revoke Svmmon's access to your YouTube account at any time via your Google Account permissions page at myaccount.google.com/permissions.

Where data lives

We do not transfer your data outside the United States unless required by law or to deliver functionality (our AI provider's API may process inference requests in different regions per its terms).

Your rights

• Export your data. Settings → Privacy & data → Download my data. Produces a JSON file with every row we hold about your account. Link is valid 24h.
• Delete your account. Settings → Privacy & data → Delete my account. Your data is soft-deleted for 7 days (sign in to undo) then permanently purged.
• Correct your data. Edit your profile, settings, and connected accounts anytime.
• Withdraw consent. Some functionality requires consent (e.g. you can't use the product without agreeing to the Terms). Reach out at support@svmmonapp.com for anything beyond that.
• Lodge a complaint with your local data protection authority (UK ICO, your EU country's DPA, etc.).

Retention

• Account data. Kept while your account is active. Deleted within 7 days of you requesting deletion (sign in during that window to keep your account). Residual copies in encrypted backups are purged within 90 days.
• Security logs (IP / user-agent). Up to 180 days.
• Data-export downloads. The signed download link expires 24 hours after generation, after which the export can no longer be downloaded. The underlying file is removed when you delete your account.
• Billing records. Our payment processor's retention applies. Typically 7 years for tax and audit purposes.
• Consent records. Kept indefinitely while you have an account. Hard-deleted with your account.

Cookies

We use a strictly-necessary authentication session cookie. We do not use marketing, advertising, or analytics cookies. The one exception is affiliate attribution, described next, which loads only after consent in the EU, EEA, and UK.

Affiliate attribution

Our marketing site (svmmonapp.com) uses a third-party affiliate attribution provider to credit the affiliate who referred you. Once it loads, it stores persistent identifiers in your browser's localStorage and sends your IP address, browser user agent, and approximate geolocation to that provider to track clicks and conversions. The provider acts as a data processor for this. In the EU, EEA, and UK, this tracker loads only after you accept the cookie banner. If you decline, it never loads and none of these identifiers or data are sent. In other regions, where prior consent is not legally required, it loads automatically. You can contact us to have it disabled.

International transfers

Our processors operate from the United States and other regions. When EU personal data is transferred, transfers rely on the Standard Contractual Clauses (SCCs) where applicable.

Security

We implement industry-standard practices:

• HTTPS on all network traffic.
• Encrypted at rest for sensitive data (OAuth tokens, etc.).
• Database-level Row-Level Security ensures users can only access their own data.
• Our payment processor handles all payment card data. We never see card numbers.
• Strong session security with industry-standard rotation.

No system is perfectly secure. If you suspect a breach, contact us at security@svmmonapp.com.

Children's privacy

Svmmon is not directed at children under 13 (or 16 in the EU). We don't knowingly collect data from children. If you believe a child has provided us data, contact us at support@svmmonapp.com and we'll delete it.

Data breach notification

In the event of a data breach affecting your personal information, we will notify you without undue delay and, where feasible, within 72 hours of becoming aware of the breach, via the email associated with your account, in compliance with GDPR and applicable U.S. state laws. If you suspect a breach, contact us at security@svmmonapp.com.

Contact

For any privacy question, data request, or complaint: support@svmmonapp.com. We aim to acknowledge requests within 7 days and to resolve them within the statutory period (up to 30 days under GDPR, extendable for complex requests as the law permits).

For security-specific inquiries: security@svmmonapp.com.