Privacy Notice

1. Who we are and how to contact us

Publixy ("Publixy", "we", "us", or "our") provides a workspace for planning, scheduling, publishing, and reviewing social-media content. For privacy questions or to exercise a data-protection right, contact us at [email protected].

2. Information we collect

Information you provide

• Account information: your name, email address, hashed password, and profile image URL.
• Workspace details: workspace name, business category, language preference, logo, and description.
• Post content: captions, media files (images and videos), scheduled dates, and publication status.
• AI feature inputs: prompts, reference images, and other materials you submit to our AI-assisted content generation tools.
• Support communications: messages you send us, including any information you voluntarily include.

Information from connected social accounts — Facebook and Instagram

When you connect a Facebook or Instagram account, we request access through the Meta platform using the minimum permissions necessary to provide the features you choose. These permissions may include the ability to read your Page or professional account details, publish content on your behalf, and retrieve post performance insights. We receive and store:

• Your Facebook or Instagram user ID, display name, and profile image.
• Access tokens and, where applicable, refresh tokens required to act on your behalf.
• Facebook Pages or Instagram professional accounts linked to your profile: their IDs, names, category, profile images, and Page-level access tokens.
• Follower counts for connected accounts and Pages.
• Post performance snapshots you request via our analytics features, including: reach, impressions, engagement, comments, shares, clicks, saves, video views, and reaction counts (like, love, wow, haha, sad, angry, care).

We use this data solely to operate Publixy features you have enabled — specifically to publish content, retrieve insights you ask to view, and display account information within the app. We do not sell, license, or otherwise transfer your Facebook or Instagram data to third parties for advertising, analytics outside of Publixy, or any purpose unrelated to providing the service to you.

Information from connected social accounts — LinkedIn

When you connect a LinkedIn account, we receive and store your LinkedIn user ID, display name, profile image, and the access token required to publish content on your behalf. We use this information only to perform publishing actions you initiate within Publixy.

Information generated through use of the service

This includes authentication session information, social-account connection status, publishing outcomes (success or error messages), in-app notification records (e.g., post published, post failed), and AI generation logs (batch status, processing phase, and any error messages).

3. How we use information

• To create and secure your account and authenticate you to the service.
• To store, schedule, and publish content to the social accounts you connect.
• To retrieve and display post and account performance insights you ask to view.
• To generate or refine content suggestions when you use AI-assisted features.
• To send you service, security, and publishing-status notifications.
• To prevent fraud, misuse, and unauthorized access, and to comply with legal obligations.
• To process images you upload through our AI vision pipeline to improve content suggestions within your session.

Where applicable, we process information to perform our contract with you, for our legitimate interests in operating and securing Publixy, with your consent where required, and to meet legal obligations.

4. How we share information

We use carefully selected third-party providers to operate Publixy. Depending on the features you use, these may include:

• Meta Platforms, Inc. — to publish content to and retrieve data from your connected Facebook and Instagram accounts via the Meta Graph API.
• LinkedIn Corporation — to publish content to your connected LinkedIn account via the LinkedIn API.
• Google LLC — for optional sign-in via Google OAuth.
• Amazon Web Services (AWS) — for file storage (images and videos you upload) and application infrastructure.
• Brevo (Sendinblue) — for transactional email delivery (e.g., account verification, publishing notifications).
• Groq, Inc. — for AI-assisted content generation. Inputs you submit to AI features may be processed by Groq's API; we do not submit personally identifying information beyond what is necessary for the feature.

These providers process information only as necessary to provide their services. We do not sell your personal data. We may also disclose information where required by law, to protect the rights and security of Publixy and our users, or as part of a lawful business reorganization.

5. Meta Platform Data — specific commitments

Data obtained through the Meta Platform (Facebook and Instagram APIs) is subject to Meta's Platform Terms and Developer Policies in addition to this notice. Specifically:

• We use Facebook and Instagram data only to provide and improve the features you have authorized within Publixy.
• We do not use Facebook or Instagram data for advertising, data brokerage, or to build profiles for purposes unrelated to Publixy.
• We do not share Facebook or Instagram data with other platforms or third parties except as required to operate Publixy (e.g., storing files on AWS).
• Access tokens are stored securely and used only to make API calls on your behalf.
• You can disconnect your Facebook or Instagram account from within Publixy at any time, which revokes our ability to act on your behalf. You may also revoke access directly from your Facebook or Instagram account settings.
• To request deletion of data obtained from Facebook or Instagram that Publixy has stored, contact us at [email protected] with the subject line "Facebook data deletion request."

6. International transfers

Our providers may process information in countries other than the one where you live, including the United States. When required, we rely on appropriate safeguards such as standard contractual clauses to protect personal data transferred across borders.

7. Retention

We keep personal data for as long as needed to provide Publixy, maintain security, resolve disputes, comply with legal obligations, and enforce our agreements. Retention periods vary by data type:

• Account and workspace data is retained while your account is active.
• Connected social account tokens and identifiers are retained until you disconnect the account or delete your Publixy account.
• Post content and media are retained until you delete them or your account is closed.
• Analytics snapshots are retained to provide historical reporting within the service.
• Support communications are retained as needed to resolve your issue and for a reasonable period thereafter.

8. Security

We use technical and organizational measures designed to protect personal data, including encrypted connections (TLS), access controls, and restricted access to production systems. Access tokens for connected social accounts are stored with application-level security controls. No online service can guarantee absolute security, so please use a strong, unique password and protect your connected social-media accounts.

9. Your choices and rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or portability of your personal data, or to object to certain processing. You may also:

• Disconnect a connected social account at any time from within Publixy settings.
• Delete post content and uploaded media directly from the Publixy dashboard.
• Request deletion of your account and associated data by contacting us.

To make any request, email [email protected]. We may need to verify your identity before acting on a request.

10. Cookies

Publixy uses essential cookies to keep you signed in, protect your session, and operate core service features. We do not use advertising cookies or cross-site tracking. If we introduce non-essential cookies or similar technologies in the future, we will update this notice and provide any consent choices required by applicable law.

11. Children

Publixy is not directed to children under 16 (or under the applicable age of digital consent in your jurisdiction), and you must be old enough to enter into a binding agreement where you live. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us so we can delete it.

12. Changes to this notice

We may update this notice as Publixy evolves or as laws change. We will post the updated version here and revise the "Last updated" date. For material changes, we will provide additional notice where required by law.