Privacy Policy

This policy applies to the Amplinet website, the waitlist, and the Service. It covers both (a) data about you as an Amplinet user and (b) data we process on your behalf from the social media accounts you connect (“Connected Platforms”). At launch, Connected Platforms are X, Instagram, Facebook, LinkedIn, TikTok, and Threads. Additional platforms on our roadmap (such as YouTube and Pinterest) will be governed by this policy, and any platform-specific disclosures those services require will be added when the integration launches.

The data controller responsible for your personal data is [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. For any privacy matter you can reach us at privacy@amplinet.com. Where you connect a social account, Amplinet acts as a processor of that platform data on your behalf and as a controller for your Amplinet account data.

We collect the following categories of data:

• Waitlist & account data: your email address, and — if you create an account — your name, password credentials, and profile settings.
• Connection credentials: OAuth access and refresh tokens issued by Connected Platforms when you authorize Amplinet. These are stored in encrypted form and used only to act on your behalf.
• Connected-account information: the account identifiers, usernames, and profile details a Connected Platform returns for the accounts you link.
• Content you create: drafts, scheduled posts, captions, and media (images and video) you upload or schedule.
• Platform data we access on your behalf: your existing posts, comments and mentions we read and reply to at your direction, and analytics/metrics for your accounts.
• Billing data (once paid plans launch): processed by our payment provider; we do not store full card numbers.
• Usage & device data: log data, IP address, browser/device type, and interactions with the Service, collected to operate and secure it.

We use data only for these purposes:

• to provide the Service — scheduling, publishing, reading and replying to engagement, and reporting analytics for the accounts you connect;
• to authenticate you and maintain the security and integrity of the Service;
• to send you service-related communications, including your waitlist confirmation and, when we launch, your early-access invitation;
• to provide support and respond to your requests;
• to improve the Service in aggregate and comply with our legal obligations.

We do not sell your data, use platform data for advertising or to build profiles for surveillance, use it to train unrelated machine-learning models, or use it to build an independent database of platform users.

Where the GDPR applies, we rely on: performance of a contract (to provide the Service you sign up for); consent (for the waitlist, for connecting each platform, and for optional analytics cookies — which you may withdraw at any time); legitimate interests (to secure and improve the Service, balanced against your rights); and legal obligation (to comply with applicable law).

When you connect an account, you grant Amplinet permission to access that platform’s API on your behalf, limited to the scopes you approve. We handle that data under each platform’s developer requirements:

• we use platform data only to provide the features you authorized;
• we keep cached platform content reasonably current and remove or update content that is deleted or changed on the source platform;
• we do not sell, rent, or transfer platform data to data brokers, and we do not use it to build competing datasets;
• we delete platform data when you disconnect the account, revoke access, delete your Amplinet account, or request deletion (see How to delete your data).

Your use of each Connected Platform is also governed by that platform’s own terms and privacy policy. We recommend reviewing them: X, Instagram, Facebook, LinkedIn, TikTok, and Threads.

We share data only with service providers (“sub-processors”) who help us run the Service, under contracts that require them to protect it and use it only on our instructions:

• Supabase — database, authentication, and file storage;
• Inngest — background job scheduling (to publish your posts at the scheduled time);
• [HOSTING PROVIDER, e.g. Vercel] — application hosting and delivery;
• [EMAIL PROVIDER] — sending transactional and waitlist emails;
• the Connected Platforms you direct us to publish to.

We may also disclose data if required by law, to enforce our terms, or in connection with a merger or acquisition (with notice where required). We do not sell your data.

We keep personal data only as long as necessary for the purposes described here. Waitlist emails are kept until you unsubscribe or ask us to delete them. Account and platform data are kept while your account is active and deleted (or anonymized) after account closure, subject to a limited backup window and any legal retention requirement. Cached platform content is refreshed or deleted to stay consistent with the source platform, and where a platform imposes a stricter maximum (for example, a fixed refresh-or-delete window), we apply that limit.

You can request deletion of your data at any time. This section also serves as our data deletion instructions for platform review purposes.

• In the app: disconnect an account, or delete your Amplinet account, from your account settings. Disconnecting removes the stored tokens and platform data for that account.
• By email: write to privacy@amplinet.com from the address associated with your account and ask us to delete your data. We will verify your request and complete deletion within [30] days, except where we must retain limited data to meet a legal obligation.

On deletion we remove your stored OAuth tokens, connected-account data, drafts, scheduled posts, uploaded media, and cached analytics. Content already published to a Connected Platform is not affected and must be removed on that platform directly.

You can revoke Amplinet’s access to any connected account at any time — either by disconnecting it inside Amplinet, or from the platform’s own settings:

• X: Settings → Security and account access → Connected apps.
• Facebook:Settings & privacy → Settings → Business Integrations.
• Instagram / Threads: Settings → Website permissions / Apps and websites.
• LinkedIn:Settings & Privacy → Data privacy → Permitted services (linkedin.com/psettings/permitted-services).
• TikTok:Settings and privacy → Security & permissions → Manage app permissions.

Revoking access at the platform stops further access immediately; we then delete the associated stored data as described above.

We protect your data with industry-standard measures: encryption of data in transit (TLS) and of stored OAuth tokens at rest, access controls and least-privilege permissions, and the security features provided by our infrastructure sub-processors. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a data breach where required by law.

We and our sub-processors may process data in countries other than yours. Where we transfer personal data across borders, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism recognized under applicable law.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any right, contact privacy@amplinet.com.

• EEA/UK (GDPR): you have the rights above and may lodge a complaint with your local supervisory authority.
• California (CCPA/CPRA):you may request to know, delete, and correct your personal information, and to opt out of its “sale” or “sharing.” We do not sell or share personal information as those terms are defined, and we do not discriminate against you for exercising your rights.
• India (DPDP Act, 2023): you may access, correct, and erase your data and nominate another person to exercise your rights; contact our Grievance Officer below.

We use strictly necessary cookies to run the Service (for example, to keep you signed in). We may use privacy-respecting analytics to understand aggregate usage; where required, we ask for your consent before setting non-essential cookies, and you can withdraw it at any time through your browser or our cookie controls.

The Service is not directed to children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. If we make material changes, we will update the “Last updated” date and, where appropriate, notify you. Please review it periodically.

For any privacy question or to exercise your rights, contact us at privacy@amplinet.com.

Grievance Officer (India DPDP Act): [NAME], privacy@amplinet.com, [REGISTERED ADDRESS]. We will acknowledge and address grievances within the timeframe required by applicable law.