Privacy notice
Last updated: [DATE]
1. Who we are
The controller of your personal data is [LEGAL NAME OF WHITECLOAK LABS] (WhiteCloak Labs), a [LEGAL FORM, e.g. registered association / foundation / non-profit company], [STREET, POSTAL CODE, CITY, COUNTRY]. Contact for privacy questions: privacy@whitecloaklabs.com.
This notice covers the website https://whitecloaklabs.com, the STRATA product line and its products (currently Genie, and Erudite once it launches).
2. What data we process
- Account data: your email address, your password (stored only in protected form by our authentication provider), your plan and trial status.
- Content you give us: photos and videos you upload, your instructions for how a post should look, and the results Genie creates from them (edited files, captions and tags).
- Connected social accounts: the username and ID of an account you connect (for example Instagram) and an access token, stored encrypted, so that we can publish what you approve or schedule.
- Posting records: what was scheduled or published, when, and whether it succeeded.
- Technical data: IP address, browser and device information and timestamps in server logs, used to run and protect the service.
- Messages: feedback or support requests you send us.
- Payment data (once payments are enabled): handled by our payment provider. We do not store card numbers. [DESCRIBE WHEN PAYMENTS ARE ADDED]
3. Why we process it, and on what legal basis
- To provide the service you asked for, including your account (performance of a contract).
- To keep the service secure, prevent abuse and improve it (our legitimate interests).
- To meet legal obligations, such as tax or accounting rules where they apply.
- Where we ask for it, and only then, on the basis of your consent, which you can withdraw at any time.
[A LAWYER SHOULD CONFIRM THE LEGAL BASIS FOR EACH PURPOSE]
4. Artificial intelligence
To create edits, captions and tags, Genie sends small preview images taken from your uploads, together with your instructions, to AI service providers. The suggestions can be wrong, so please review everything before it is published. We do not use your content to train our own models. [CONFIRM EACH AI PROVIDER'S DATA-USE TERMS, INCLUDING FREE TIERS, BEFORE LAUNCH, AND LIST THEM]
5. Who receives your data
We use service providers who process data on our behalf:
- Hosting, file storage and AI processing: Cloudflare.
- Database and sign-in: Supabase.
- AI text and image analysis: Cloudflare Workers AI and Google (Gemini). [CONFIRM]
- Social networks you connect, such as Meta (Instagram), which receive what you choose to publish.
- Payments, once enabled: Stripe. [CONFIRM]
We do not sell your personal data.
6. Transfers outside the EU/EEA
Some providers may process data outside the EU/EEA. In that case we rely on appropriate safeguards such as standard contractual clauses. [DESCRIBE REGIONS AND SAFEGUARDS]
7. How long we keep data
- Account data: while your account exists, then [PERIOD].
- Campaigns, uploaded files and results: until you delete the campaign or your account. Deleting a campaign removes its files from our storage.
- Server logs: [PERIOD].
- Backups: [PERIOD].
8. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent. You can also complain to your data protection supervisory authority. To use these rights, write to privacy@whitecloaklabs.com. See also our data deletion instructions.
9. Security
We protect data with encryption in transit, encrypted storage of social account tokens, access controls and separation between customers' data. No system is perfectly secure. [LAWYER AND SECURITY REVIEW]
10. Age
Our services are not intended for people under [MINIMUM AGE, e.g. 18]. [ADD HOW YOUTH PROGRAMMES OF WHITECLOAK LABS ARE HANDLED, IF RELEVANT]
11. Cookies
See our cookie notice.
12. Changes and contact
We may update this notice and will publish the new version here. Questions: privacy@whitecloaklabs.com.