Privacy Policy

Data we collect

• Account data: your name, email address and profile picture when you sign in with Google.
• Project data: your store links, website address, screenshots you upload and the descriptions you write.
• Country when you create a project: the country your connection comes from at that moment is used to pre-select the project's target market, and you can change it. The IP address itself is not stored.
• AI Coach conversations: the messages you exchange with the AI Coach in the dashboard, and the lasting notes derived from them (your preferences, facts about your product and things to avoid). You can see and remove these notes on the AI Coach page.
• Reviewers you invite: when you ask a client or teammate to review content, the name and email address you enter for them. We use these only to send the review link and to record their comments and decision; they are deleted together with the project. The same holds for a teammate you give a seat to: we keep the address you invited and, once the invitation is accepted, the account behind it, so that person can open the panel.
• Repository content: if you connect a GitHub repository, the code is processed only during analysis and deleted immediately afterwards. We keep only the derived product brief, your colour palette and the brand images in the repository (logo, app icon, mascot, screenshots).
• App screens: to make marketing videos, your app is built and explored in every language inside a single-use, isolated container on a GitHub-hosted machine, with no access to any keys or passwords. The app is opened in a browser there, and the requests it sends from that browser to your API or other back-end servers are blocked; only static files such as images, fonts and style sheets are loaded. If your project has no code we can build, or the build fails, we open your public website instead and only read its pages, as a visitor would. No sign-in, purchase or delete actions are performed. Your code stays there for at most 24 hours and is deleted when the job ends; only the screenshots and short screen descriptions are kept.
• People photos: images that look like a real person are never used in videos until you confirm you hold the rights.
• Connected account credentials: we connect to social and store accounts only through official OAuth or API keys, stored encrypted. We never ask for or see your passwords.
• Publishing and metrics data: content published on your behalf, its performance metrics and incoming comments.
• Store reports: if you connect your App Store Connect or Google Play Console account, the daily download figures of your app and, for the App Store, its net revenue, read from the stores' own reports.
• Short link clicks: for people who click the short links in posts and profiles, their country, device type (iPhone, Android, other) and the domain of the site they came from. IP addresses are not stored; a repeat click by the same person is recognised for 30 minutes only, through a one-way digest.
• Website visit counter: if you add our visit counter to your own website, it counts the visits to that site for you, without cookies. We keep only daily totals by traffic source (for example Instagram, a search engine or the tags in a link), country and device type (iPhone, Android, other). IP addresses and browser details are not stored; to count the same visitor only once a day we use a one-way digest that changes every day and is deleted within 24 hours. Adding the counter is your choice; mention it in your own website's privacy notice.
• Public data: your competitors' store pages, public social content, public discussions on forums such as Reddit and Hacker News, and ad library records. We keep the excerpt taken from a public discussion only for 30 days, as long as it can still be used; after that the copy of the text is deleted and only the link, the title and our own summary remain.
• Technical records: error logs, usage logs and AI call traces. Secrets are never written to these logs.
• Payments: card details never reach us; they are processed by our payment provider, Stripe.

Why we process data

• Performance of our contract: running the service, producing content, publishing and reporting.
• Legitimate interests: security, abuse prevention, debugging and product improvement.
• Legal obligations: invoicing and accounting records.
• Consent: optional notifications and marketing emails, which you can withdraw at any time.

AI and your data

We use AI providers to generate content. Your data is not used to train models; we work with providers under business terms that exclude training. Every video, image and post we publish for you carries an AI content label that cannot be switched off: a C2PA content credential embedded in media files, together with the platform's own AI label or, where the platform has none, a note in the post text. Comment replies and store listing texts are also written with AI but carry no separate label.

Who we share data with

Service providers we rely on: Vercel, GitHub (Microsoft), Inngest, bundle.social, Supabase, Cloudflare R2, Upstash, OpenRouter, Anthropic, OpenAI, Google (Vertex AI, Gemini API), xAI, Amazon Web Services (Amazon Bedrock), Microsoft Azure, Langfuse, Sentry, Resend, Apify, Firecrawl, Pexels, ElevenLabs, Stripe, Meta, Google, TikTok, X, LinkedIn, Apple (App Store Connect). Each receives only the data needed for its function. We do not sell your data and do not share it for third-party advertising.

YouTube API Services

Some features use YouTube API Services: finding public videos where your product's topic is discussed, reading public comments and, only if you give a channel the YouTube comment permission, posting the comments and replies you approved or allowed through your permission mode. By using these features you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's Privacy Policy (https://policies.google.com/privacy) describes how Google handles data.

With the comment permission we keep an encrypted access token for that channel and use it only to post those comments and replies. We never upload, delete or edit your videos, ratings or captions with it. You can revoke the permission at any time in your Google Account (https://myaccount.google.com/permissions) or by removing the channel on the Channels page. The token is deleted when you remove the channel, and within 30 days if you delete your account.

Retention

• Repository content: deleted as soon as analysis completes; the temporary copy used for screen capture is deleted within 24 hours.
• App screenshots and brand images: kept while your account is active and deleted together with your project.
• Product brief, generated content and metrics: kept while your account is active.
• If you delete your account: all project data is deleted within 30 days; removal from backups can take a few more weeks.
• Invoice records: kept for the statutory retention period.

Your rights

You can access, correct, delete, restrict, port and object to the processing of your data. Write to privacy@tirelessmarketer.com and we will respond within 30 days. You may also complain to your local data protection authority.

Cookies

We use only functional cookies: the ones that keep you signed in, one that remembers your language (kept for one year) and one that remembers the project you last opened (one year). No advertising cookies, no tracking pixels.

A few preferences are kept in your browser's local storage instead of cookies: the dashboard's light or dark theme, whether the side menu is open, a language suggestion you closed and an unsaved draft in the creative editor. They stay in your browser and are not sent to us.

On the public website we count page views with Vercel Web Analytics: it sets no cookies, stores no IP addresses and cannot recognise you across sites; we see totals, not people. The dashboard is not measured this way.

The public website also runs our own visit counter, the same one customers can add to their own sites. It sets no cookies and stores no IP addresses or browser details; we keep only daily totals by traffic source, country and device type, and the one-way digest used to count the same visitor only once a day is deleted within 24 hours. The dashboard is not measured by it.

Security

Access tokens are encrypted with AES-256-GCM, data in transit is protected with TLS, and authorisation is enforced at the database level. No system is perfectly secure; if a breach occurs we will notify you and the authorities within the legal deadlines.

Age limit and international transfers

The service is not intended for anyone under 18. Some providers are based in the United States; transfers rely on standard contractual clauses.

Changes

If we update this policy we will change the effective date and notify you by email about material changes.