Privacy Policy

Who we are

AlphaNovix operates this service and is the data controller for the information described below. You can reach us at support@alphanovix.com, or by post at:

What we collect

Account information. Your email address, name and profile picture. These come from our authentication provider when you sign up; we do not store your password, and we never see it.

Workspace information. The name, URL and timezone of each workspace you create, and who belongs to it.

Connected social accounts. When you connect a social network we store the access tokens that network issues, along with your account id, handle, display name and profile picture on that network.

Content you create. Post text, images and video you upload, scheduling times, and the outcome of each publish attempt.

Performance data. Metrics the social networks report about your published posts — impressions, likes, comments and similar — and follower counts for your connected accounts.

AI usage. When you use the AI writing features, the text you submit is sent to a third-party model provider. We record which feature was used and how much of your monthly allowance it consumed.

Activity records. A log of significant actions in your workspace — who published what, who invited whom, who changed a role — including the IP address and browser the action came from. This exists so that a workspace owner can see who did what.

Payment information. If you subscribe, our payment processor handles your card. We store only a customer reference, your plan, and its status. We never receive or store card numbers.

How we protect your social account tokens

The tokens that let us publish on your behalf are the most sensitive thing we hold, and they are treated differently from everything else. Each one is encrypted with AES-256-GCM before it is written to the database, using a key that is not stored alongside the data. They are decrypted only at the moment a publish or analytics request is made, and they are never written to logs or error reports.

We ask each network for the narrowest permissions the feature needs. We do not read your private messages, and we do not post anything you have not asked us to post.

Why we collect it

• To operate the service you signed up for — publishing your posts is the product.
• To show you how those posts performed.
• To enforce the limits of your plan and to bill you if you are on a paid one.
• To keep an audit trail so a workspace owner can see who did what.
• To detect and prevent abuse.

We do not sell your data. We do not use your content to train AI models, and we do not share it for advertising.

Who else processes it

Running this service means other companies process some of your data on our behalf. Each is bound by contract to use it only for that purpose:

• Clerk — authentication and account management.
• Neon — database hosting (United States).
• Vercel — application hosting.
• Inngest — the queue that delivers scheduled posts.
• Stripe — payments, if you subscribe.
• OpenRouter — routing requests to AI models, if you use the AI features.
• Cloudflare or Amazon Web Services — storage for the images and video you upload.
• Resend — sending transactional email such as team invitations.

Separately, when you connect a social network and publish through it, that network receives the content you asked us to publish. Their handling of it is governed by their own policies, not this one.

Our infrastructure is located in the United States. If you are outside the United States, using the service means your data is transferred there.

How long we keep it

• Performance metrics are kept for as long as your plan allows — 7 days on Free, 90 days on Starter, 365 on Pro and 730 on Agency — and are then deleted automatically.
• Posts, media and workspace data are kept while your account is open, and removed when you delete them or delete your account.
• Social account tokens are deleted as soon as you disconnect the account.
• Activity records and billing records are kept longer, because we need them to answer questions about past charges and to meet tax obligations.

Your rights

You can ask us to show you the data we hold about you, correct it, delete it, or give you a copy in a portable form. You can also object to a particular use or ask us to restrict it. Email support@alphanovix.com and we will respond within 30 days.

Most of this you can do yourself and immediately: see the deletion page for the steps.

If you are in the UK or the European Economic Area and believe we have handled your data improperly, you have the right to complain to your local data protection authority.

Children

This service is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us information, email us and we will remove it.

Cookies

We use cookies that are necessary for the service to work — keeping you signed in, protecting forms against cross-site request forgery, and remembering whether you chose the light or dark theme. We do not use advertising or cross-site tracking cookies.

Changes to this policy

If we change this policy in a way that materially affects you, we will email you before the change takes effect. The date at the top always reflects the current version.

Contact

Privacy questions: support@alphanovix.com
Everything else: support@alphanovix.com