Privacy policy
1. What we collect
Account: your email address and a hashed password (or the identity your sign-in provider gives us), and the times you sign in.
Brand and work: everything you enter about a brand, the photos and clips you upload, the research produced for it, plans, drafts, images, approvals and the week-to-week memory.
Public data you ask us to read: posts, profile counts and comments from the public accounts you name or that match your topic, and the accounts on your watchlist.
Photos and videos you add (your materials): files you choose from Google Drive, a Dropbox folder you connect, a link you paste, or your own Instagram posts. We copy only the files you choose (or the files in the one Dropbox folder you chose to keep in sync) into your private storage, and describe each one with AI (what is in it, the place, the light) so the right one can be picked for each post. With Google Drive we only ever see the files you pick in Google's own window; with Dropbox we read the folder you chose and the folders inside it, never the rest of your Dropbox, and we do not write or delete anything there. The Dropbox access is encrypted when stored and is deleted when you disconnect.
Google user data: Tiwizit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Files from Google Drive are used only to make your posts, are never sold, never used for advertising, and never used to train AI models.
Billing: your plan, its status and Stripe's identifiers for your customer and subscription. Your card number is entered on Stripe's pages and never reaches us.
Usage: counts of metered actions (research runs, images, writing calls) and their approximate cost, so limits can be enforced and shown to you.
The website and the app set no advertising or analytics cookies. Signing in stores a session token in your browser.
2. Why we use it
To run the service for you: sign you in, keep your brands and weeks, produce research and drafts, enforce plan limits, bill you, and answer when you write to us. We do not sell personal data and we do not use your content to train models.
3. Who processes it for us
| Provider | Purpose | What it receives |
|---|---|---|
| Vercel | Hosting the app and the site | Requests, including your IP address, as any web host does |
| Supabase | Database and sign-in | Account, brand and work data, stored with row-level access control |
| Stripe | Payments and invoices | Email, plan, card details you enter on Stripe's pages |
| Anthropic | Writing, planning and checks | Your brand record and the research needed for a given draft or check |
| Apify | Reading public posts | The public account names and topics to read |
| Ideogram | Generating images | The visual brief and text of the image |
| GitHub | Scheduled monitor, video rendering and publishing | Watchlists, clips and edit plans while a job runs; the approved post and its encrypted token while it is published |
| Meta (Instagram, Threads) and LinkedIn | Publishing your approved posts and reading their results, only once you connect an account | The approved post's text, image or video, and the time it goes out |
| Google Drive and Dropbox | Bringing in the photos and videos you choose | Requests for the files you picked, or for the folder you chose to keep in sync |
These providers process data on our behalf under their own terms and security practices. Several are in the United States; if you are outside it, your data is transferred there to run the service.
4. How long we keep it
For as long as your account exists. When you delete a brand, its data is deleted. When you ask us to delete your account, we delete it within 30 days, except billing records we must keep for accounting. Read data from public accounts is kept only as long as it is needed for your reports and watchlist. A connected Instagram, Threads, LinkedIn or Dropbox account, with its token, is deleted when you disconnect it, when you delete its brand, or when you delete your account. Photos and videos in your materials are kept until you remove them, delete their brand or delete your account.
Deleting your data
To remove a connected Instagram, Threads or LinkedIn account: in the app, open Settings, then Connected accounts, and choose Disconnect; its token is deleted at once and nothing scheduled on it goes out. You can also remove Tiwizit from Instagram (Settings, then Apps and websites), from Threads (Settings, then Account, then Website permissions), or from LinkedIn (Settings, then Data privacy, then Permitted services); when you do, or when you ask Meta to delete your data, Meta tells us and the account and its token are deleted here too. To delete a brand and everything held for it, use the × on its card in the app. To delete your whole account and all its data, write to mehdibensifi@themirageframework.com from the account's address; it is done within 30 days and we confirm by email.
5. Your rights
You can see and edit your brand data in the app at any time. Write to us to receive a copy of your data, to correct it, or to delete your account. If you are in the EU, UK or California, the rights those laws give you apply; write to the address above to exercise them, and you can complain to your local authority.
6. Security
Data is encrypted in transit. Access to your data in the database is restricted to your own account by row-level rules. Secrets used to reach our providers are kept server-side and never in your browser. No system is perfectly secure; if we learn of a breach affecting you, we tell you.
7. Children
The service is for adults. We do not knowingly collect data from anyone under 18.
8. Changes
If this policy changes in a way that matters to you, we tell you by email or in the app before it applies.