Privacy Policy
1. Personal information we collect
- Account information: email address, password (stored only as a non-reversible hash), and name (optional)
- Connected social account information: within the scope you explicitly authorize on Instagram, Facebook, Threads, YouTube, TikTok and similar platforms — account ID, username, profile image, and access tokens (stored encrypted)
- Information created while using the Service: posts and media you write or schedule, auto-reply rules, the content of comments and DMs received on connected accounts along with the sender's username, and post performance metrics
- Automatically collected information: login session information, IP address, and browser information (for security and abuse prevention)
2. How we use it
- Sign-up, login, identity verification (email verification), and password reset
- Providing the Service you request, such as creating and scheduling posts and auto-replying to comments and DMs
- Sending emails essential to operating the Service, such as security notices (we do not send marketing email)
- Preventing abuse, responding to incidents, and improving the Service
3. Retention
When you delete your account or request deletion, we destroy your information without delay (within 30 days at the latest). When you disconnect a social account, that account's tokens and related data are deleted immediately. Information we are required to keep by law is retained for the period the law requires.
4. Sharing with third parties and processors
Madola does not sell your personal information. We engage processors only for the following purposes:
- Amazon Web Services: running servers and databases, and sending email (Amazon SES)
- The AI model provider you choose (Anthropic, OpenAI, Google): the content of your request is sent to them to generate the posts and replies you ask for
- The social platforms you connect (Meta, Google, TikTok, etc.): the posts and replies you request are sent through that platform's API
5. YouTube API Services and Google user data
Madola uses YouTube API Services to connect your YouTube channel. By connecting a channel you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.
- What we access: your channel ID, title and profile image; the videos you choose to upload through Madola (title, description, tags, visibility, made-for-kids setting); and the list of your uploads with their view, like and comment counts and your channel's subscriber and video counts for your analytics dashboard.
- How we use it: only to upload and schedule the videos you create and to show you performance reports. We do not use YouTube or Google user data for advertising, and we do not sell it or use it to train AI models.
- Sharing: we do not share Google user data with third parties except the processors listed above that are needed to run the Service, or when required by law.
- Storage and deletion: access and refresh tokens are encrypted with AES-256-GCM. Disconnecting the channel in Madola deletes its tokens immediately; other stored YouTube data is deleted within 30 days of disconnection or account deletion, or on request to support@madola.app.
- Revoking access: you can revoke Madola's access at any time from your Google account security settings.
Madola's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Email
Madola sends only transactional emails triggered by your actions (sign-up verification, password reset, security notices). We stop sending to addresses that bounce, unsubscribe, or report our email as spam.
7. Your rights
You may request access to, correction of, deletion of, or suspension of processing of your personal information at any time. You can disconnect social accounts yourself within the Service; see the Data Deletion page for how to delete your account.
8. Security measures
- One-way password hashing (scrypt), and social access tokens stored encrypted with AES-256-GCM
- HTTPS for all traffic, databases on a private network, and encryption of data at rest
- Login attempt limits and least-privilege access
9. Contact
Privacy inquiries: support@madola.app