Privacy Policy

• Account identity — name, email, and authentication data, handled by our identity provider, Clerk.
• Organization, brand, and workspace data you or your team enter into the product.
• Connected social account credentials — OAuth access and refresh tokens for each platform you connect, stored encrypted at rest using AES-256-GCM application-layer encryption, plus encrypted account metadata (handle, platform account id, permission scopes granted).
• Content — drafts, scheduled posts, uploaded media, and AI-generated media, stored in Cloudflare R2 object storage.
• AI generation data — prompts, reference media, and the resulting outputs. These are sent to AI model providers (including fal.ai and large-language-model providers such as Anthropic and OpenRouter-routed models) solely to fulfill the generation request you make.
• Cost ledger — a per-request record of which model was used, token or unit counts, and the resulting USD cost, powering the product's cost-transparency features.
• Diagnostics and analytics — error and performance data via Sentry, and product usage analytics via PostHog.

The web application runs on Vercel. Background job processing (scheduling, publishing, AI generation orchestration) runs on a VPS we operate, backed by a Redis job queue. The primary database is Supabase Postgres, hosted in the EU (eu-central-1). Media and generated assets are stored in Cloudflare R2.

• Operating the service you sign up for.
• Publishing content you schedule to the platform accounts you connected.
• Showing analytics for the content you've published.
• Showing cost estimates and actuals for AI generation (cost transparency).
• Security, fraud prevention, and customer support.

We do not sell personal data.

When you connect a social or publishing account, we only request the permissions needed to provide the features you use, and only act on your explicit instruction (e.g. publishing a post you composed and scheduled).

• Meta (Facebook, Instagram, Threads) — page and account identity, permission to publish content you compose, post and account insights, and comments for the unified inbox feature. Tokens are stored encrypted; disconnecting an account deletes the stored tokens immediately. Data obtained via Meta's APIs is used only to provide the features you requested and is not used for any other purpose.
• TikTok — when you connect a TikTok account, we access your TikTok profile identity (display name, avatar, open id), publish videos or photos you schedule through LoubSMP, and read your own video performance metrics. TikTok data is stored and handled under the same encryption and deletion posture as every other connected platform: tokens encrypted at rest, deleted on disconnect.
• LinkedIn — member or page identity, publishing on your behalf (as a member or on an organization page you manage), post and page analytics, and comments on the posts we manage for you.
• Google / YouTube — LoubSMP's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and our use of YouTube API Services is subject to the YouTube Terms of Service. You can review the Google Privacy Policy at http://www.google.com/policies/privacy and can revoke LoubSMP's access at any time via Google security settings at https://security.google.com/settings/security/permissions.
• Bluesky, Mastodon, WordPress — credentials or API tokens for these connections are likewise stored encrypted and used only to publish or read the content you request.

• Machine-generated media (AI generations and renders) is automatically deleted from object storage after approximately 90 days unless you mark it as kept or favorited.
• Audit records and cost-ledger entries are retained for accounting and support purposes.
• OAuth tokens are deleted immediately when you disconnect an account.
• Organization-level deletion is handled as described in our Data Deletion Instructions.

AI-generated media carries embedded C2PA Content Credentials and platform AI-disclosure labels where the destination platform supports them. Synthetic media requires human approval before it can be published, consistent with our posture under EU AI Act Article 50(4).

Subject to applicable law (including GDPR for users in the EU/EEA), you have the right to access, correct, delete, and port your personal data, and to object to certain processing. To exercise any of these rights, email privacy@loublab.com. You also have the right to lodge a complaint with your local data protection supervisory authority.

The processors and service providers listed above may process data outside your country of residence. Where that happens, we rely on appropriate safeguards (such as standard contractual clauses or an equivalent legal mechanism) to protect your data.

We may update this policy as the product evolves. Material changes will be reflected by updating the "Last updated" date above.