Privacy Policy

Account & billing information: name, email address, and account credentials. Payments are processed by Stripe; we do not store full payment-card numbers — Stripe handles card data directly.

User Inputs (business information you provide): your website URL and content we retrieve from it, uploaded documents, pasted text, business descriptions, persona and competitor information, and similar materials you submit to build your profile and generate content.

Usage & device information: if you click 'OK, use analytics', how you use the Service, collected with PostHog (see the Cookie Policy). This may include IP address, browser type, pages viewed, and actions taken. Until you click OK, PostHog loads nothing and sends nothing. Separately, and whatever you choose: (a) our error monitoring (Sentry) records technical details of errors, without IP addresses or cookies; and (b) when you are signed in, our servers record a few operational events about your account in PostHog, such as an AI generation finishing or reaching a usage limit, without cookies. We use these to run and secure the Service, not for analytics.

The Service uses third-party AI models (currently Anthropic's Claude models) to analyze your User Inputs and generate marketing content, recommendations, brand-voice analysis, personas, and related outputs. To do this, relevant portions of your User Inputs are transmitted to our AI provider for processing.

What we store from your sources. When we read your website or a document you upload, we keep the text we extracted from it, alongside the conclusions we draw (for example, brand-voice descriptors, capability summaries and persona definitions). We keep the text so we can check generated content against what your sources actually say, show where a fact came from, and compare a page when we re-read it. We also keep the text of industry articles from the news sources your workspace follows. This text belongs to your workspace and is deleted with it, as described under Data Retention & Deletion.

We do not sell your information. The only AI provider that receives your User Inputs is Anthropic, through its commercial API, whose terms do not allow it to train models on that content, and we do not train any AI models on it ourselves.

• To provide, operate, and improve the Service;
• To generate the content, analyses, and recommendations you request;
• To process payments and manage your subscription;
• To communicate with you about your account and the Service;
• To monitor, secure, and troubleshoot the Service;
• To comply with legal obligations.

We share information only with service providers who help us operate the Service, under contracts that limit their use of it. Our key service providers ("subprocessors") include:

• Supabase — database and authentication (data storage).
• Vercel — application hosting.
• Stripe — payment processing.
• Anthropic — AI model processing of User Inputs.
• PostHog — product analytics (only after you consent) and operational account events.
• Resend — email delivery, including team invitations and account notices.
• Firecrawl — fetching the contents of web pages you direct us to.
• Pexels — stock image search, using terms derived from your content.
• Inngest — background job processing.
• Google — sign-in, when you choose to sign in with a Google account.
• HubSpot, Inc. — customer support tickets and CRM contact records (email address, name, company name).
• Sentry (Functional Software, Inc.) — error monitoring: stack traces, browser and device metadata, and an anonymised user id, without IP addresses or cookies. Operational, not analytics.

LinkedIn and Meta receive authorization tokens only if you elect to connect those accounts, and only for the connection you authorize. If you never connect a channel, no data reaches them.

We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (consistent with this Policy).

We retain your account and profile information for as long as your account is active. When we verify your deletion request, we switch off access to your workspace straight away. Your data is then held securely for 90 days in case the request was a mistake — tell us within that window and we can restore it. After 90 days, account information, the text we extracted from your sources, profile conclusions, and uploaded materials are permanently deleted, except where we must retain certain records to comply with legal, tax, or accounting obligations, or to resolve disputes. For step-by-step instructions on disconnecting channels and requesting deletion, see our Data Deletion page.

We use reasonable administrative, technical, and organizational measures to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

All users. You may access, update, or delete your account information through your account or by contacting us. We honor verified deletion and access requests regardless of where you live.

California (CCPA/CPRA). California residents have the right to know what personal information we collect and how we use it, to request deletion, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising.

Canada (PIPEDA). Canadian users may access their personal information and request corrections, and may withdraw consent subject to legal or contractual restrictions.

EU/EEA (GDPR). If you are in the EU/EEA, you have rights to access, rectification, erasure, restriction, portability, and objection. Our legal bases for processing are performance of our contract with you, your consent (where applicable, such as analytics cookies), and our legitimate interests in operating and securing the Service. Note that the Service is intended for U.S. users and we do not actively target the EU/EEA; if you use it from the EU/EEA, your data may be processed in the United States.

To exercise any right, contact privacy@smarkly.com.

We use cookies and similar technologies as described in our Cookie Policy. For every visitor, wherever they are, analytics loads only after you click 'OK, use analytics'. Before that, nothing is sent to our analytics provider.

You can change your analytics choice at any time using the Cookie preferences link in the site footer, or in Settings when you are signed in.

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

We may update this Policy and will post the new effective date. Material changes will be communicated as required. Contact: privacy@smarkly.com, 1120 Sycamore Ave., STE 2G, Vista, CA 92081.