LEGAL

Privacy Policy

Last updated: September 2026

1. What we collect

When you create an account: your email address, name, role, company name, company email, phone number, and any brand/market details you add to boards.

When you use the platform: board inputs (brand name, industry, market, competitors), campaign data generated for your boards, plan and billing status, and standard usage logs (pages visited, API calls made).

When you pay: Stripe handles payment. We receive a customer ID, plan name, and billing status. We never see or store your card number.

2. How we use your data

To provide the service: generate demand reports and campaigns for your boards, persist your boards and saved briefs, and sync your subscription status.

To contact you: account and billing communications, and (with your consent) product updates. You can opt out of marketing emails at any time.

To improve the service: aggregate, anonymised usage metrics. We never sell individual-level data.

3. Data processors

We use the following third-party processors. Each handles your data under their own privacy programme:

  • Supabase - user authentication and PostgreSQL database hosting (EU or US, depending on project region).
  • Stripe - payment processing. PCI DSS Level 1 certified.
  • Vercel - hosting and edge delivery for both the marketing site and the backend API.
  • Anthropic - AI-generated campaign programs (Command tier only). Your board data is passed as context; Anthropic's API terms govern retention.
  • DataForSEO - search volume, SERP, and Google Trends data. Your queries are sent to their API; no personal data is shared.
  • Google (YouTube Data API) - video and comment data for demand evidence. No personal data is shared.
  • Upstash - rate-limit counters (IP addresses only; not linked to accounts).

4. Data retention

Account data is retained for as long as your account is active. You may request deletion at any time (see section 5). Board and campaign data in demand_runs is retained for 24 months, after which it is automatically purged.

5. Your rights (GDPR and CCPA)

Under GDPR (EU/UK) and CCPA (California), you have the right to access, correct, or delete your personal data; object to or restrict processing; and port your data. To exercise these rights, email privacy@userintly.com. We will respond within 30 days.

6. Cookies

We use only functional cookies: one session cookie set by Supabase Auth. No advertising or tracking cookies are set. No third-party analytics scripts are loaded on the marketing site unless you have consented.

7. Contact

Data protection enquiries: privacy@userintly.com