Privacy Policy

We collect and process the following categories of information:

• Account details: email address, name, and profile photo where provided via Google sign-in.
• Business profile details: business name, category/vertical, target audience, business goals, social media links (Instagram/Facebook), and preferred tone of voice.
• Uploaded media: photos and video you upload for your business, including photos used to generate content and including photos and video in which people appear (see Section 4A). From a photo file we read only the date it was taken (from its EXIF data), to suggest grouping photos from the same occasion into collections; we do not read or keep location data from photos.
• Staff (Character Profile, optional): photos of a person you add so that they appear in content, their name or label, and records of the consents you gave — consent to appear in content and, separately, consent to talking-avatar content — including when each consent was given (see Section 4 below).
• Voice recordings: recordings of your voice when you choose to narrate a video yourself, record a line for a video presenter, or report a word mispronounced in a narration — and the transcription of those recordings by an AI model for that purpose.
• Public information about the business: when you provide a website address or a link to a social profile, we read the public homepage and profile pages and the logo, to learn the business's brand identity.
• Support and feedback: questions and searches in the help center (including questions to the smart assistant, whose answers are written by AI), ratings and feedback you give on content and on the Service, and messages you send us.
• Generated content and approval records: content drafts produced by the AI engine, and the approval, edit, or rejection history for each item.
• Subscription and billing details: your chosen subscription tier, payment status, and billing and invoice records. Payment processing is performed by the payment provider Cardcom on a secure payment page — full card details are provided directly to it and are never stored by us. For monthly recurring charges, and with your consent shown at the time of payment, we store a secure charge token issued by the payment provider, together with the card's last 4 digits, brand, and expiry — used solely to perform the monthly charge and display your payment method in your account. When you make a purchase we also ask for the payer's full name and Israeli mobile phone number — details required to process the transaction with the payment provider and issue a receipt, used solely for payment-related communication — unless you separately give explicit consent to marketing messages, as described in Section 11 below. You can update them in your account settings.
• Basic technical usage data: essential cookies used to manage your login session, standard system logs used to operate and secure the Service, and rate-limiting records that include an IP address — used to prevent abuse of the Service and routinely deleted after a short period.
• Site visit measurement: when you arrive at the public site we record the page, the link or site that referred you (for example Instagram or a Google search), the device type and the country — without an IP address and without a persistent identifier. To count repeat loads of the same visit once, we keep a hashed code that changes every day and cannot identify you or link visits on different days. If you sign up, your account records which of our links or channels brought you — so we know which channels bring us customers.

Providing your information is not a legal obligation, but is required for us to provide you the Service. Withholding certain information (e.g., business details or media) may prevent us from providing the Service or parts of it.

We use collected information solely for the following purposes: creating and authenticating your account; generating marketing content (captions, images, video) tailored to your business using AI models; managing the approval, editing, and rejection workflow for content; managing your subscription and billing; customer support; securing the Service and preventing fraud and abuse (including request rate limiting); improving the Service and aggregate usage analysis; and complying with legal requirements.

Information may be shared with the sub-processors listed in Section 5 below solely to provide the Service — it is never sold or shared with third parties for their own marketing purposes.

Processing is based on your consent to our Terms of Use and this Policy when you register for the Service, on the performance of our contract with you (providing the Service you requested), and on our legitimate interest in operating, securing, and improving the Service.

The staff feature ("Character Profile") allows, only with your explicit, documented consent, adding photos of a person so that they appear consistently in content generated for the business. The photos are used as reference images: with each generation they are sent to the AI model producing the image or video (see Section 5), and they are automatically checked for photo quality. We do not train a personalized AI model on the photos, and we do not create or keep such a model. Consent is captured and recorded in the Service interface, including the date it was given; talking-avatar content (video in which the person appears to speak, with a synthesized voice or your own recording) requires an additional, separate consent.

At any time, on the staff page in your account, you can pause a person's appearance in content, withdraw talking-avatar consent, remove one of their photos, or delete them entirely — deletion removes their details and photos from the Service. You may also ask us to do this via our contact page.

This data is treated as especially sensitive due to its use of a person's likeness, and is stored and processed with heightened care and is never used for any purpose beyond generating content for the business that uploaded it.

Media you upload may include photos or video of people (for example you, your staff, or your customers). To produce content we process this media — including the likeness of the people in it — with AI models (see Section 5), and may create edited, restyled, re-staged, or animated versions of it. Image analysis serves content understanding and quality control only: we do not identify people by their faces and do not create biometric templates from your media. As the business owner you are responsible for holding the consent of the people who appear (or a parent's or guardian's consent for a minor) and for informing them of this use; we process this information on your behalf and for you only. A person who appears in your media may contact us to request its removal, and we will handle the request in coordination with you and in accordance with the law.

To provide the Service, we rely on external providers who process data on our behalf, under contractual obligations to us to maintain confidentiality and data security:

• Vercel — hosting and running the website and servers.
• Neon — the database storing account and content information.
• Cloudflare R2 — storage of uploaded media files (photos and video).
• Resend — sending operational email, including one-time sign-in codes.
• Google — sign-in via your Google account, at your choice.
• Anthropic — AI models for writing and analysis: writing captions, texts and scripts; analyzing the photos and videos you upload (including staff photos) to check quality, choose material and plan content; analyzing the public information about the business; and answering questions in the help center's smart assistant.
• fal.ai — a platform running AI models that generate images and video, narration and voice, music, separate a photo's subject from its background, and transcribe voice recordings — including editing, restyling, and animating the photos and videos you upload, including the people appearing in them, using staff photos as reference images, and (only with your separate, explicit consent as described in the Terms of Use) generating talking-avatar content based on a real photo of a person and synchronized speech.
• Cardcom — secure payment processing, storage of payment methods for recurring charges (tokenization), and issuing accounting documents (receipts).
• Meta Platforms — connecting your Facebook Page and Instagram business account for publishing content you approved, if you chose to connect them (see Section 15).

We do not use your content or personal data to train AI models.

Some of the providers listed above operate infrastructure outside Israel, meaning some processing of your personal data occurs outside the country. These transfers are made in accordance with the Privacy Protection (Transfer of Data Abroad) Regulations, 5761-2001, including giving weight to the fact that data is transferred to providers bound by data protection and security commitments comparable in level to Israeli law.

We retain personal data for as long as your account is active, and for a reasonable additional period thereafter where required for operational, accounting, or legal purposes (for example, to handle a dispute or a request relating to the account).

You can delete files from your media library, staff members and their photos, and your entire account yourself (from your account settings; with an active paid subscription — after cancelling it). Deleting the account removes from our systems the account, the business, its content, its media (including staff photos and voice recordings), the approval history, and the billing records in the account. The accounting documents (receipts) for payments made are issued and kept by the payment provider Cardcom, as required by law. Operational database backups are kept for a limited period for disaster recovery and are deleted in the normal backup rotation cycle.

We employ reasonable and customary security measures in accordance with the Data Security Regulations, including: encrypted transport (HTTPS/TLS), permission-based access control for accounts and customer data, passwordless sign-in (one-time code / Google OAuth) that reduces password-leak risk, separation between the admin environment and the client environment, and cloud media storage with time-limited signed links.

Access to your account data is limited to you and our small service team. The team accesses a client account only when needed for support, to fix a problem, for quality control of content, or to provide a service you asked for, and every team sign-in to a client account is logged.

That said, no system is 100% secure, and we cannot guarantee the total absence of security incidents. In the event of a material security incident involving personal data, we will act in accordance with applicable law, including, where relevant, reporting obligations to the Privacy Protection Authority.

Under Sections 13–14 of the Privacy Protection Law, anyone whose information is held in a database has the right to review the information held about them, and where they find it to be incorrect, incomplete, unclear, or outdated, the right to demand its correction or deletion.

You can view, correct and delete most information yourself inside the Service (business details, media, staff, and the entire account — see Sections 4 and 7). For any other access, correction or deletion request, contact us via the Service's contact page or by email, and we will respond within the period required by law.

The Service uses first-party cookies only — no advertising, analytics or tracking cookies from third parties, and no information about your browsing is passed to anyone. These are the cookies and browser local-storage items the Service sets:

• Login and security (session) cookies: identify your signed-in account and protect against request forgery (CSRF). Signing in is impossible without them. They are deleted or expire with your login session.
• Language-preference cookie: stored only after you actively switch the interface language, to remember your choice on future visits.
• Temporary security cookies when connecting Facebook/Instagram: they verify that the return from Meta's login screen belongs to your connection request, and are deleted when the connection completes (and after 10 minutes at the latest).
• Arrival-source cookie: when you arrive through one of our links (for example a link in a story) or from another site, it remembers for 30 days which channel brought you — for example "Instagram / story". It contains no personal identifier, is not accessible to any third party, and is used only so that, if you sign up, we know which channel brought you.
• A separate staff login cookie: used exclusively by our internal admin interface and not relevant to customers.
• Browser local storage: your chosen accessibility adjustments from the accessibility widget; a record that the cookie notice was shown to you and acknowledged — so it is not shown again; the publishing destinations you last chose (Facebook/Instagram); notices you closed, so they are not shown again; and when the in-app feedback request was last shown, so it does not appear too often. This information stays in your browser only and is never sent to us.

On your first visit, a transparent notice about our use of cookies is displayed, with a link to this Policy. Because every cookie the Service uses is our own — essential, functional, or the arrival-source cookie that holds no personal identifier — the notice is informational.

You can delete or block cookies at any time through your browser settings. Note: blocking essential cookies will prevent signing in and using your account. If we ever add analytics, advertising or tracking cookies from third parties, we will update this Policy and request your prior consent as required by law.

We send operational emails (such as sign-in codes, account updates, and content awaiting approval) necessary to provide the Service; these do not require separate consent.

Marketing email or marketing messages by SMS or WhatsApp (direct mail as defined in Section 17C of the Privacy Protection Law) are sent only with your explicit, documented prior consent, in accordance with Section 30A of the Israeli Communications Law (Telecommunications and Broadcasting), 5742-1982 (the "Anti-Spam Law"). Consent to marketing messages to your mobile number is given by ticking a dedicated consent checkbox — never pre-ticked — when providing payment details or in account settings; consent to offers by email is given by a dedicated checkbox on the registration form, never pre-ticked and never a condition of registering. We record when each consent was given.

Every marketing message is labeled as an advertisement, identifies us with a way to contact us, and offers a convenient unsubscribe option. You may withdraw consent at any time — in account settings or via the unsubscribe option in any message — and withdrawal requests are honored immediately. Declining or withdrawing consent does not affect your use of the Service, and operational messages related to your account or payments are sent as usual.

The Service is intended for business use only by individuals aged 18 or older, and is not intended for use by minors. If we become aware that we have collected information about a minor without lawful authorization, we will act to delete it.

Media you upload may include minors only with their parent's or guardian's consent, which you are responsible for obtaining.

The data controller is the operator of the Service, operating under the Socialist brand. For any question, request, or complaint regarding your privacy and the processing of your data, please contact us via the Service's contact page or by email at socialistil2026@gmail.com.

In addition to contacting us, you have the right to file a complaint with the Privacy Protection Authority (הרשות להגנת הפרטיות), the authority responsible for enforcing the Privacy Protection Law in Israel.

We may update this Policy from time to time to reflect changes to the Service or the law. A material change will be published on the Service with the date at the top of this document updated accordingly. Continued use of the Service after a change is published constitutes acceptance of the updated Policy.

If you choose to connect your Facebook Page and/or Instagram business account to the Service, the connection is made on Meta's own official login screen (OAuth) — via Facebook, or directly via Instagram if you chose the Instagram-only connection (no Facebook Page). We never ask for, see, or store your password at any stage.

As part of the connection we store: access tokens issued by Meta — encrypted with AES-256 at rest; the user ID, Page ID, and Instagram account ID you connected; the Page name and username; and the IDs of posts published through the Service, in order to display publish status and performance data.

This data is used solely to publish content you explicitly approved inside the Service, and to read performance data for that content. Nothing is ever published without your explicit approval.

You can disconnect at any time from the Service's settings page — disconnecting permanently deletes the access tokens we hold — or directly from your Meta account settings (Settings → Apps and Websites). A Data Deletion Request submitted through Meta will likewise automatically delete the connection data we hold.