Privacy Policy

We collect the following categories of information:

• Account information such as your name, email, role, headline, brand goals, audience, tone, and topics you set during onboarding.
• Content you share including voice recordings, text, transcripts, images, and the drafts and posts generated from them.
• Connected account data from platforms you link, such as the social channels you use, limited to the permissions you grant and used to publish or schedule on your behalf.
• Usage and device data such as actions in the app, voice minutes used, log data, approximate location from IP, and basic device and browser details.
• Payment data processed by our payment provider. We do not store full card numbers.

We use your information to:

• transcribe your voice and generate drafts that sound like you;
• schedule and, where authorized, publish posts to your connected accounts;
• remember your preferences and improve Sally's suggestions for you over time;
• provide support, secure the Service, and prevent fraud or abuse;
• process payments and manage subscriptions and usage limits; and
• comply with legal obligations.

I do not sell your personal information. Advertising sharing is described below. I do not use your private content to train third-party foundation models, and we direct our AI providers not to use it for their own model training where their terms allow.

To create drafts, Sally sends your voice or text to AI service providers for transcription and content generation. These providers process the data only to return results to us and operate under contracts that restrict further use. AI output may be imperfect, so you review drafts before they are published. You can delete recordings, transcripts, and drafts at any time.

Where the GDPR or similar laws apply, we process your data based on: your consent (for example, when you record a voice note or connect an account); performance of our contract with you (to deliver the Service); our legitimate interests (to secure and improve the Service); and compliance with legal obligations. You may withdraw consent at any time.

We share information only as needed:

• Service providers who host our infrastructure, provide AI processing, send email, and process payments, under confidentiality and data-protection terms.
• Connected platforms such as the social channels you use, when you choose to publish or schedule content.
• Merchant of Record Paddle.com, which acts as our reseller to handle the sale of the product, subscription management, payments, tax compliance, and invoicing.
• Legal and safety when required by law or to protect rights, safety, and the integrity of the Service.
• Business transfers if the Service is involved in a merger or acquisition, subject to this Policy.

We keep your information for as long as your account is active or as needed to provide the Service. You can delete individual recordings, drafts, and posts at any time. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain limited records for legal, tax, or security reasons.

We use technical and organizational measures to protect your data, including encryption in transit, access controls, and row-level security on stored data. No system is perfectly secure, but we work to safeguard your information and will notify you and regulators of significant breaches as required by law.

Depending on where you live, you may have the right to access, correct, delete, or export your data, to object to or restrict certain processing, and to withdraw consent. You can manage much of this in the app, including disconnecting accounts and deleting content. To exercise other rights, contact us through the in-app support options. You also have the right to complain to your local data protection authority.

If you are in California, you have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of personal information. Advertising disclosures may constitute sharing for cross-context behavioral advertising. I honor Global Privacy Control and your advertising refusal.

Your information may be processed in countries other than your own. Where we transfer data internationally, we use appropriate safeguards such as standard contractual clauses to protect it.

The Service is not intended for anyone under 16, or the minimum age of digital consent in your country. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this Policy from time to time. If we make material changes, we will notify you through the Service or by email before they take effect. The Last updated date above shows the latest revision.

I use Meta (Facebook and Instagram) and TikTok advertising tools to measure visits, confirmed new-account registrations, checkout actions and purchases, and improve ad delivery. These tools may receive page addresses without query details, event and purchase details, browser/device information, IP addresses and advertising cookie identifiers. Your stories, drafts, email address and account identifier are not included in this advertising setup. Meta registration measurement uses a browser Pixel; checkout measurement uses browser and server reporting. Meta and TikTok purchase reporting uses only Paddle-confirmed payments with the actual amount and currency, not clicks or return-page visits. Test payments are kept separate from real advertising results.

In consent-required regions, advertising is off until you accept. If location cannot be resolved, advertising stays off. Elsewhere ordinary advertising measurement may be enabled, unless you refuse or send an applicable opt-out such as Global Privacy Control. Essential sign-in functionality remains available regardless of your choice.

Open Cookie settings below to accept or withdraw advertising permission. I retain a visitor reference, time, notice version and text, region and choice as consent evidence; a later withdrawal does not erase earlier acceptance evidence. Withdrawal stops future advertising reporting, including across open tabs, and blocked events are not replayed. This does not delete information already received by the platforms. Server purchase reports without event-time consent evidence are not sent.

Meta and TikTok may process permitted information outside your country under their own privacy terms. You can also manage advertising choices with those platforms. Contact hello@heysally.app with questions about these records or your rights.

If you have questions about your privacy or this Policy, email us at hello@heysally.app or reach out through the support options inside the app and I will help personally.