Privacy Policy

What Infludio is

Infludio is a social media management platform: you connect your own social accounts (Instagram, Facebook, TikTok, YouTube, X, LinkedIn), and Infludio schedules posts, reads back real engagement data from each platform's own API, and offers optional AI-assisted features you control with your own API key.

Data we collect

• Account data — your name, email, and password (hashed, never stored in plain text).
• Workspace & team data — workspace name, team member roles, invitations.
• Connected social account data — when you connect a platform via OAuth, we store the access/refresh token it issues (encrypted at rest), your handle, avatar, and follower count as reported by that platform.
• Content you create — captions, media, schedules, and drafts you write or upload in Infludio.
• Engagement analytics — likes, comments, shares, views, and (where the platform grants it) impressions/reach, pulled directly from each connected platform's own API. We never estimate or fabricate a number that isn't real — see our public no-mock-data commitment.
• AI features (optional, BYOK) — if you add your own Google Gemini/Veo API key, we store that key (encrypted) and use it only to fulfill requests you make. Content you submit for AI generation is sent to Google under your own key and Google's own terms, not ours.
• Brand voice examples (optional) — text you explicitly save as a "voice example" is embedded and stored to ground future AI caption suggestions in your own style. You can delete any example at any time.

What we don't do

• We don't sell your data, or your connected accounts' data, to anyone.
• We don't use your content to train any model beyond what you explicitly request via your own BYOK key.
• We don't fabricate analytics — every number shown is either pulled live from a platform's API or explicitly labeled as an estimate/guideline.

Who we share data with

Only the parties necessary to provide the service:

• The social platforms you connect (Meta, TikTok, Google/YouTube, X, LinkedIn) — to publish content and read back analytics, under the OAuth scopes you approve.
• Google's Gemini/Veo API — only if you add your own key, and only for requests you make.
• Formspree — processes the early-access and contact forms on this site.
• Google Analytics — aggregate, anonymized traffic analytics on this marketing site.

Security

Social account access/refresh tokens and BYOK API keys are encrypted at rest. Sessions are authenticated with signed JWTs, and two-factor authentication is available on every account.

Data retention & deletion

We keep your data for as long as your workspace is active. See our Data Deletion page for how to request deletion of your account and all associated data.

Changes to this policy

We'll update the "last updated" date above whenever this policy changes materially, and post the change here before it takes effect.