Privacy Policy

Account information — When you register, we collect your name, email address, and a hashed password. If you sign in via Google, we receive your name and email from Google.

Organisation & workspace data — Organisation name, workspace name, country, time zone, and any content you create (posts, captions, media files, scheduled content).

Social account tokens — When you connect a social network, we store OAuth access and refresh tokens in encrypted form. We never store your social network password.

Billing information — Subscription plan, billing cycle, and payment reference numbers from our payment processors (Paystack, Flutterwave). We do not store full card numbers — payment processors handle that under their own PCI-DSS compliance.

Usage data — Log data including IP address, browser type, pages visited, and timestamps. We use this for security monitoring and product improvement.

Device information — On mobile, we collect device type and OS version for debugging and push notification delivery.

We use your data to:

• Provide, operate, and improve the Service
• Authenticate your identity and manage your session
• Publish posts and schedule content on your behalf to connected social platforms
• Process subscription payments and send billing notifications
• Send transactional emails (verification codes, password resets, subscription notices)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your content to train AI models without explicit opt-in consent.

When you use AI-assisted content features (caption generation, hashtag suggestions, rephrase, translate, AI Studio, AI Autopilot), your content is sent to third-party AI providers (OpenAI, Google Gemini) under data processing agreements. These providers process your input only to generate a response and do not retain it for model training under our agreements.

When you enable AI Agents, messages received in your connected social channels (WhatsApp Business, Instagram DMs, Facebook Messenger, Instagram post comments, Facebook post comments) are processed by our AI to classify the conversation, search your brand knowledge, and generate a reply suggestion or automated reply. This message data is transmitted to our AI providers under the same data processing agreements and is not retained for model training. Conversation transcripts are stored on our servers and visible to authorised team members in the Inbox.

We share personal data only with:

• Social platforms — We publish content, retrieve messages and comments, and interact with your connected Facebook, Instagram, and WhatsApp Business accounts on your behalf using your authorised tokens.
• Payment processors — Paystack and Flutterwave process payments in accordance with their own privacy policies.
• Infrastructure providers — DigitalOcean (hosting), MinIO/object storage for media files, Redis for session caching.
• Email delivery — We use a third-party SMTP provider to deliver transactional email.
• Law enforcement — Where required by applicable law or valid legal process.

Active accounts — We retain your data for as long as your account is active.

Expired subscriptions — If your subscription expires and you do not renew within 7 days, your uploaded media files are deleted. Your account and profile remain active.

Inactive accounts — If your account remains inactive for 30 days after the file deletion date, your account is permanently deleted along with all associated data.

Deletion requests — When you request account deletion, we process it within 30 days. Certain records (e.g., payment history, audit logs) may be retained for up to 7 years as required by applicable law.

Depending on your jurisdiction, you have the right to:

• Access — request a copy of personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your account and personal data
• Portability — receive your data in a machine-readable format
• Objection — object to certain processing activities
• Withdraw consent — disconnect any social network and revoke permissions at any time from Settings → Social Accounts

To exercise any of these rights, email us at support@247brandhq.com. We will respond within 30 days.

We use session cookies to maintain your login state. We do not use advertising or cross-site tracking cookies. We may use anonymous analytics (page views, error rates) via server-side logging only — no third-party analytics SDKs are loaded in your browser.

We encrypt social network tokens at rest using AES-256. All data is transmitted over HTTPS. We apply role-based access controls and maintain audit logs of sensitive operations. In the event of a data breach affecting your personal data, we will notify you within 72 hours as required by applicable law.

247BrandHQ is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it promptly.

247BrandHQ is operated from Nigeria and serves users across Africa and internationally. Your data may be processed in the United States (AI providers) and Europe (infrastructure providers) under appropriate data transfer safeguards including standard contractual clauses where required.

We may update this policy from time to time. We will notify you of material changes by email and by posting the revised policy on this page with an updated effective date. Your continued use of the Service after the effective date constitutes acceptance.

If you have questions about this policy or wish to exercise your data rights:

Email: support@247brandhq.com

Company: 247BrandHQ (Envision Apps)