Privacy

• Your email address and password (the password is stored hashed; we can't see it).
• Your brand profile: business name, website, what you do, customers, tone, topics, and words to avoid.
• Photos you upload, and images we make for you.
• The posts we draft, your edits, and when they're scheduled and published.
• Which social accounts you connect, and the reach and interaction numbers for posts we published.
• Billing status from Stripe. We never see or store your card number.

We never ask for your social media passwords. Accounts connect through each platform's own sign-in, and you can disconnect at any time in Waffilo or in the platform's settings.

We don't sell your information. The only advertising use is counting which of our own ads bring people to Waffilo (see below).

When you sign up we record how you found us: campaign tags, the site you came from, whether you clicked an ad, and your answer to our sign-up question. We also record the main steps you take in Waffilo, such as setting up your business, connecting an account and approving posts. We use this to run and improve the service. Only we and the tools we use to run Waffilo can see it. To see it or have it deleted, email duncan@waffilo.com. Deleting your account deletes it too.

These services process data for us, only to provide Waffilo:

• Supabase: database, sign-in and file storage.
• Lovable: website hosting.
• Anthropic (Claude): writing posts, reading your website and describing your photos.
• fal.ai (FLUX) and, when it's unavailable, Google Gemini through Lovable's AI gateway: making images. Your brand profile and photos are sent to them when drafting.
• bundle.social: connecting your social accounts and publishing posts.
• Resend: sending our emails.
• Stripe: payments.
• Meta (Facebook) and Google: our website uses their ad tags to count which ads lead to sign-ups. They see that a browser visited and signed up, not your posts, photos or business details.

Some of these store data outside New Zealand, mainly in the United States. We choose providers with security standards comparable to those the Privacy Act requires.

We keep your data while your account is open. If you ask us to delete your account, we delete your brand, photos, posts and connections within 30 days. Billing records are kept as long as tax law requires.

You can ask to see or correct the information we hold about you, or ask us to delete it. Email duncan@waffilo.com. If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.