Privacy Policy

We collect the following categories of information:

1.1 Account Information

• Name, email address, and profile image (from Google Sign-In or email registration)
• Account preferences and settings
• Subscription plan and billing information

1.2 Brand & Content Data

• Brand names, descriptions, and industry categories
• Content drafts, posts, hashtags, and publishing schedules
• Voice & tone preferences, topics, and competitor lists

1.3 Usage Data

• Features accessed, pages visited, and actions taken within the platform
• Device type, browser, operating system, and IP address
• Referral sources and session duration

When you connect your social media accounts, we access limited data from each platform solely to enable publishing and analytics features. We follow the principle of minimal data collection — we only request the permissions necessary for the service to function.

2.1 LinkedIn

• Data collected: Name, profile URL, member identifier, and organization/page memberships
• Permissions requested: openid, profile, w_member_social, w_organization_social
• Purpose: Publishing posts on your behalf to your personal profile or company pages
• We do NOT: Read your private messages, connections list, or any data beyond what is listed above

2.2 Instagram (Meta)

• Data collected: Professional account name, profile picture, and media permissions
• Permissions requested: instagram_basic, instagram_content_publish, pages_read_engagement
• Purpose: Publishing posts, carousels, and reels to your professional Instagram account
• Requirements: Instagram Business or Creator account required; linked Facebook Page may be necessary
• We do NOT: Access your direct messages, follower lists, or personal Instagram account data

2.3 X (Twitter)

• Data collected: Username, display name, and profile identifier
• Permissions requested: tweet.read, tweet.write, users.read, offline.access
• Purpose: Publishing tweets and threads on your behalf
• We do NOT: Read your direct messages, access your followers/following list, or use your data for any purpose unrelated to publishing

We use your information exclusively for the following purposes:

• Publishing content — Creating, scheduling, and publishing social media posts on your connected accounts
• AI content generation — Using your brand preferences, topics, and voice settings to generate relevant draft content
• Analytics & insights — Providing performance metrics for your published content
• Account management — Authenticating your identity, managing subscriptions, and providing customer support
• Platform improvement — Understanding usage patterns to improve features and user experience

We employ industry-leading security measures to protect your data:

• Encryption at rest: All social media access tokens and refresh tokens are encrypted using AES-256-GCM before storage
• Encryption in transit: All communications are secured via TLS 1.3
• Cloud infrastructure: Data is stored on Google Cloud Platform (Firebase/Firestore) with SOC 2 Type II and ISO 27001 certifications
• Access controls: Strict role-based access; only you can access your own data
• OAuth 2.0: We use industry-standard OAuth 2.0 for all social platform connections — we never see or store your social media passwords
• Regular audits: Security practices are reviewed and updated regularly

We share your data only in the following limited circumstances:

• Social media platforms: Your content is sent to the platforms you've connected (LinkedIn, Instagram, X) for the sole purpose of publishing posts
• AI providers: Your brand preferences and content drafts may be processed by AI language models (Google Gemini, OpenAI, Anthropic) for content generation. No personal identifiers are sent
• Infrastructure providers: Google Cloud Platform (hosting, database), Stripe (payment processing)
• Legal requirements: If required by law, court order, or governmental request

We do not sell, rent, or trade your personal information or social media data to any third party for their own purposes.

• Active accounts: Your data is retained as long as your account is active
• Disconnecting platforms: When you disconnect a social media account, the associated access tokens and connection data are immediately deleted from our systems
• Account deletion: You may request complete account deletion at any time by contacting us at privacy@marketingmogul.app. All your data, including brands, drafts, connections, and personal information, will be permanently deleted within 30 days
• Token expiration: Social media access tokens are automatically refreshed or expired according to each platform's policies. Expired tokens are deleted

Regardless of where you are located, you have the following rights:

For All Users

• Access: Request a copy of all personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request permanent deletion of your account and all associated data
• Portability: Request an export of your data in a machine-readable format
• Disconnect: Revoke platform access at any time from Settings

GDPR Rights (EU/EEA/UK Residents)

• Right to object to processing of your personal data
• Right to restrict processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

CCPA Rights (California Residents)

• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to opt out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your CCPA rights

To exercise any of these rights, contact us at privacy@marketingmogul.app. We will respond within 30 days.

LinkedIn

Our use of LinkedIn APIs complies with the LinkedIn API Terms of Use. We access your LinkedIn data solely to publish content you have created or approved. We do not store LinkedIn data beyond what is necessary for this purpose.

Meta (Instagram)

Our use of Meta's Instagram API complies with Meta Platform Terms and Meta Developer Policy. We do not use Instagram data for advertising, profiling, or any prohibited purpose under Meta's policies.

X (Twitter)

Our use of the X API complies with the X Developer Agreement and Policy. We do not store, aggregate, or cache location data from X beyond what is associated with a specific tweet.

We use the following cookies and similar technologies:

• Essential cookies: Required for authentication and session management (Firebase Auth)
• Preference cookies: Store your theme preference (dark/light mode)
• Analytics cookies: Help us understand usage patterns to improve the product (Google Analytics, if enabled)

We do not use cookies for tracking you across third-party sites or for advertising purposes.