Privacy Policy

Appial ("we", "us") is run by [Operator legal name], [Registered address]. This policy covers the marketing site and the product you sign in to. For anything about your personal data, write to [Privacy contact email] or use the contact form.

• Your account. Name, email, password (stored as a hash) or the Google or Apple account you sign in with, and the organizations you belong to.
• What you tell us about your business. Links to your website, store listings and social profiles, descriptions, answers to our questions, and the photos and videos you upload.
• What we read about your business. The public pages of the website you give us, and the public social profiles you point us to or that your website links.
• What we make for you. Business profiles, strategies, ideas, captions, images, slideshows, videos and voice-overs, and your edits to them.
• Connected accounts. When direct publishing is on and you connect a social account, we keep its access token, encrypted, and use it only to publish posts you approve.
• Billing. Your plan, credit use and subscription status. Card details go straight to Stripe. We never see or store full card numbers.
• Usage and security. Product events (for example "business created" or "post published"), server logs, your IP address for rate limits and bot checks, and cookieless traffic analytics on the marketing site.

We use your data to run Appial: read your business, make content, publish what you approve, count credits, bill subscriptions, send email (verification, password resets, invitations, receipts and service notices) and stop abuse. We do not sell your personal data, and we do not train AI models of our own on your content.

To make content, we send each AI provider only what that step needs: your business profile, the idea, your instructions, and any photos, videos or reference posts you attach. They process it under their API terms, which in the setup we use do not let them train their models on it.

Some videos use a presenter. If you upload a photo of a person for that, we send it to OpenAI (or Google, if OpenAI is unavailable) to place the person in a scene, and to fal.ai to animate the video. Upload only photos of yourself, or of someone who has agreed to appear in AI-generated marketing for your business. We use these photos only to make your content, never to identify anyone. Voices are synthetic stock voices, not copies of a real person's voice. The photo is deleted when you delete it, the business or your account.

These companies process data for us, each only for its part of the Service:

• Cloudflare: hosting, file storage, bot checks (Turnstile), rendering websites built with JavaScript, and cookieless traffic analytics
• Neon: the database
• Google (Gemini): reading your business, writing profiles, ideas and captions, analyzing your photos and videos, and making images
• OpenAI: turning your own photos into post images, voice-overs and transcription
• fal.ai: video generation and voice-overs
• Shotstack: assembling and rendering videos
• ScrapeCreators: reading the public social profiles and posts you point us to
• Resend: sending email
• Stripe: payments and subscriptions
• Post for Me: publishing to your social accounts, only when direct publishing is on and you connect an account
• Google and Apple: signing you in, when you choose to sign in with them

Most of them are based in the United States, so your data is processed there as well as where you live.

We use only the cookies that keep you signed in. Traffic analytics on the marketing site are cookieless, and we run no advertising trackers.

We keep your data while your account exists. Deleting a business deletes its content and files. Deleting your account deletes it at once, together with every organization where you are the last member and all of that organization's businesses, content and files. Copies in our database provider's backups expire on that provider's schedule.

When you disconnect a social account, we delete the connection and its token from our database at once and ask Post for Me to revoke its access. If that request fails, we retry every day and follow up by hand if it keeps failing. We keep billing records for as long as tax and accounting law requires.

Depending on where you live (for example under the GDPR or the CCPA), you can ask to access, correct, export or delete your personal data, and object to some processing. Write to [Privacy contact email] and we answer within 30 days. You can also delete businesses, content and your whole account in the product at any time, and you can complain to your local data protection authority.

Data is encrypted in transit, social account tokens are encrypted at rest, and only the people who run the Service can reach production systems. No system is perfectly secure. If a breach affects your personal data, we will tell you as the law requires.

Appial is not for anyone under 16.

We post updates to this policy here. For material changes we email you or show a notice in the product before they take effect.