Privacy Policy

Zylopost (“Zylopost”, “we”, “us”, or “our”) provides an AI-powered social media scheduling service that lets you write, schedule, and automatically publish content to your connected social media accounts (this “Service”). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the choices and rights you have.

This policy applies to our website and the Zylopost application. It does not apply to the third-party social networks you connect (LinkedIn, Facebook, and Instagram), which are governed by their own privacy policies.

Information you provide

• Account information. When you create an account, we collect your name, email address, and password. Passwords are stored in hashed form by our authentication provider — we never see or store them in plain text.
• Content you create. The posts you write or generate, including caption text, hashtags, uploaded or AI-generated images and media, target platforms, and scheduled publish times.
• AI prompts. The prompts, tone selections, and instructions you give the AI composer, together with the captions and images it returns.
• Feedback & support. Messages you send us through the in-app feedback form or by email, including the category and content of your message.
• Marketing contact. If you submit your email on our landing page, we use it to follow up about the Service.

Information from connected social accounts

When you connect a social account via OAuth, the platform sends us limited information so we can publish on your behalf. We store:

• Your profile display name, handle/username or email, and the platform's account identifier.
• Access and refresh tokens and the permission scopes you granted. These tokens let us publish the posts you schedule. We do not receive your social account password.

You can disconnect any account at any time, which revokes our access for new publishing actions and removes the stored tokens.

Information collected automatically

• Usage and activity data, such as records of posts published, scheduled, or failed, shown in your activity feed.
• Cookies. We use strictly necessary cookies to keep you signed in and maintain your session. We do not use them to track you across other websites.
• Standard technical data (such as IP address and browser/device information) that our hosting and infrastructure providers process to deliver and secure the Service.

• To create and manage your account and authenticate you.
• To provide the core Service — generating AI content, scheduling posts, and publishing them to your connected accounts at the times you choose.
• To display your dashboard, calendar, and activity history.
• To respond to your feedback, questions, and support requests.
• To maintain the security, integrity, and reliability of the Service.
• To comply with legal obligations and enforce our terms.

We do not sell your personal data, and we do not use the content of your posts or AI prompts to train our own advertising profiles.

Our AI composer is powered by OpenAI. When you generate a caption or image, the prompt and tone you provide are sent to OpenAI's API to produce the result, which is then returned to you and saved to your account. OpenAI processes this data as our service provider to fulfill your request. We rely on OpenAI's API terms, under which API inputs and outputs are not used to train their models by default.

We share personal data only as described below. We do not sell it or share it for cross-context behavioral advertising.

• Connected social platforms. When you publish or schedule a post, we send the relevant content and media to the platforms you selected (LinkedIn, Facebook, Instagram) using the access you granted.
• Service providers (subprocessors). We use trusted vendors to run the Service, including Supabase (authentication, database, and storage), OpenAI (AI text and image generation), and our hosting and infrastructure providers. They may process your data only on our instructions and to provide their services to us.
• Legal and safety. We may disclose information if required by law, or to protect the rights, property, or safety of Zylopost, our users, or others.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We keep your personal data for as long as your account is active and as needed to provide the Service. When you delete your account, the associated data — including your profile, connected accounts and tokens, posts, AI generations, activity, and feedback — is deleted, except where we must retain certain records to comply with legal obligations or resolve disputes. Published posts that already live on a social platform remain there unless you remove them from that platform.

We use technical and organizational measures to protect your data, including encryption in transit, access controls, and row-level security that isolates each user's data in our database. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to notify you of significant incidents as required by law.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can:

• Update your profile details from within the app.
• Disconnect any social account at any time.
• Delete your account, which removes your associated data as described above.
• Contact us at support@zylopost.com to exercise any of these rights.

We will respond to verifiable requests within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data protection authority.

We and our service providers may process and store your data in countries other than your own. Where required, we put in place appropriate safeguards (such as standard contractual clauses) to protect personal data transferred across borders.

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, notify you. Your continued use of the Service after an update means you accept the revised policy.

If you have questions about this Privacy Policy or how we handle your data, contact us at support@zylopost.com.