Effective date: [TO BE SET]
This Privacy Policy describes how ABMediaX LLC, a Pennsylvania limited liability company ("ABMediaX", "we", "us"), collects, uses, discloses, and protects personal information in connection with the ABMediaX Poster service (the "Service"). It is designed to satisfy the U.S. state privacy laws (including the California Consumer Privacy Act as amended by the CPRA — collectively "CCPA") and the EU/UK General Data Protection Regulation ("GDPR") for users who reach us from those jurisdictions.
1. Information We Collect
- Account information: email address, hashed password (stored by Supabase Auth).
- Technical data: IP address, browser/device metadata, timestamps of requests (retained in Vercel access logs for approximately 30 days).
- User content: videos and images you upload, videos and audio the Service generates for you, captions and hashtags you create, transcripts of your uploads.
- AI prompts and history: the prompts you submit to AI generation features and metadata about each generation.
- OAuth tokens: access and refresh tokens for the social platforms you connect (TikTok, YouTube, Instagram, X), encrypted at rest using AES-256-GCM before being written to the database.
- Billing data: your Stripe customer ID and subscription state. Payment card numbers never touch our servers — they are handled entirely by Stripe.
- Usage analytics: feature-usage counters, aggregated only.
2. How We Use Your Information
- To operate, provide, and maintain the Service (deliver posts to your connected platforms, generate AI content you requested, etc.);
- To bill you and administer subscriptions;
- To secure the Service, prevent abuse, and detect fraud;
- To improve the Service using aggregated, de-identified metrics;
- To comply with legal obligations and enforce our Terms.
We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use your content, prompts, or generated outputs to train AI models.
3. Legal Bases (GDPR)
Where GDPR applies, our legal bases for processing are:
- Performance of a contract — to provide the Service you signed up for.
- Legitimate interests — to secure and improve the Service, in a manner not overridden by your rights.
- Consent — for optional cookies and any analytics beyond what is strictly necessary.
- Legal obligation — to retain records required by tax, accounting, or law-enforcement rules.
4. Subprocessors
We share personal data with the following processors, each subject to a data-processing agreement ("DPA") or equivalent. A full list is also available at /legal/subprocessors.
- Supabase (authentication and database, United States) — Privacy Policy.
- Vercel (application hosting and logs, United States) — Privacy Policy.
- OpenAI (AI generation of text, images, captions, and voice, United States) — Privacy Policy. Per OpenAI's API data-usage policy, data submitted via the API is not used to train OpenAI models.
- Runway (AI video generation, United States) — Privacy Policy.
- ElevenLabs (AI voice generation, optional, United States) — Privacy Policy.
- Stripe (payments, United States) — Privacy Policy.
- Meta (Instagram), TikTok, Google (YouTube), and X — these platforms receive only the specific content and metadata you have chosen to publish to your own connected account via OAuth. They do not receive our internal user database.
5. Data Retention
- Account data: retained for as long as your account is active. Deleted within 30 days of your verified deletion request.
- Uploaded and generated media: automatically deleted 90 days after last use, unless still referenced by an active scheduled or published post.
- Application and access logs: approximately 30 days.
- Billing records: retained for 7 years to comply with U.S. Internal Revenue Service record-keeping rules.
- Real-person consent logs (for AI likeness generation): retained for 5 years after the last related post.
6. Your Rights Under GDPR
If GDPR applies to you, you have the following rights, exercisable free of charge by emailing privacy@abmediax.com or using the in-app data export / delete controls:
- Right of access to your personal data;
- Right of rectification of inaccurate data;
- Right of erasure ("right to be forgotten");
- Right to restrict processing;
- Right to data portability (delivered as a JSON export);
- Right to object to processing based on legitimate interests;
- Right to withdraw consent at any time (does not affect prior processing);
- Right to lodge a complaint with your national supervisory authority.
7. Your Rights Under CCPA
If you are a California resident, you have the following rights:
- Right to know what categories of personal information we collect, sources, purposes, and to whom we disclose it.
- Right to delete personal information we hold about you.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing of personal information. We do not sell or share your personal information, but you may still exercise this right at Do Not Sell or Share My Personal Information.
- Right to opt out of automated decision-making that produces legal or similarly significant effects.
- Right to non-discrimination for exercising any of the above.
8. International Data Transfers
The Service is operated from the United States. If you access the Service from the European Economic Area, the United Kingdom, or Switzerland, your personal data will be transferred to the U.S. We rely on the European Commission's Standard Contractual Clauses (2021/914) with our U.S. subprocessors, supplemented by technical measures (encryption in transit and at rest).
9. Cookies
We use only strictly necessary session and authentication cookies(issued by Supabase). We do not use advertising cookies and we do not load third-party analytics without your consent. See our Cookie Policy.
10. Children
The Service is not intended for or offered to persons under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact privacy@abmediax.com and we will delete it.
11. Security
Our technical safeguards include:
- AES-256-GCM encryption of OAuth access and refresh tokens at rest;
- TLS 1.2 or higher for all data in transit;
- Row-Level Security (RLS) on every multi-tenant table in the database;
- Encrypted database backups managed by Supabase;
- Least-privilege service credentials and rotation on suspected compromise.
No system is perfectly secure. In the event of a personal-data breach we will notify affected users and, where legally required, supervisory authorities within the timelines prescribed by applicable law (see our Acceptable Use Policy and internal incident-response plan).
12. Contact
Privacy inquiries: privacy@abmediax.com.
Data Protection Officer: ABMediaX has not designated a formal DPO because it does not meet the mandatory-designation thresholds under Article 37 of the GDPR. Your inquiries will be handled by the ABMediaX privacy contact.
13. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes we will provide at least 30 days' notice by email and/or by prominent in-product notice before the changes take effect.