LegalLast updated

Privacy Policy

We collect the minimum personal data needed to run a creator page and content workspace, and we tell you what each piece is used for. This policy explains the details — including the account data available for export and how to request deletion.

Plain-English summary

Repping Labs LLC operates Repping.AI and is the controller of the personal data described in this policy, except where a creator independently controls data it collects or processes as a seller through its storefront.

  • We process your account data, content, and basic device telemetry to run the service.
  • Payments are handled by Stripe; we never see full card numbers.
  • You can request an account-data copy through our contact form or delete your account from Settings → Profile. See the scope and limits below.
  • We don’t sell personal data and we don’t display third-party ads. Optional Meta advertising measurement requires marketing consent.

1. Data we collect

We collect data in three ways:

  • You give it to us. Email, sign-in details managed by Clerk, display name, chosen username, profile bio and avatar, the content you upload, and your social-channel OAuth grants.
  • It is generated as you use the service. Posts you schedule, scheduled times, publish results, billing events, credit ledger entries, and audit logs.
  • Automatic. IP address (truncated for analytics), user agent, coarse device type, PostHog page-view events (only with analytics consent — see Cookies), cookieless visit measurement by Vercel Web Analytics, and error stack traces sampled by Sentry.

2. How we use it

  • To operate the service: authentication, scheduling, publishing, payments, support.
  • To improve the product: aggregate analytics, debugging, A/B experiments.
  • To keep the service safe: rate limiting, fraud prevention, abuse moderation.
  • To comply with the law: tax records, DMCA, and lawful requests.

Where data-protection law applies to you, we rely on the following bases to process your data:

  • Contract — to deliver the service you signed up for.
  • Legitimate interest — fraud prevention, debugging, product analytics in aggregate.
  • Consent — non-essential cookies, marketing emails (you can withdraw any time).
  • Legal obligation — tax, accounting, lawful requests.

4. Who we share with

We share data with sub-processors that perform a specific function under contract. Current sub-processors:

  • MongoDB Atlas (US) — primary application database.
  • Cloudflare R2 (global) — object storage for uploaded media.
  • Stripe — payment processing, Checkout, subscriptions, invoices, and refunds.
  • Clerk — authentication, sign-in credentials, account verification, and session management.
  • Composio — connected-platform authorization and actions for integrations that use this delivery service.
  • OpenRouter and the selected AI model providers — prompts and content submitted to AI features when that model route is used.
  • Meta — optional advertising measurement on public acquisition pages, only with marketing consent.
  • Resend — transactional email (signup, billing receipts, security alerts, account-deletion confirmation, contact form).
  • PostHog — product analytics; only loaded after you accept analytics cookies.
  • Sentry — error monitoring; we strip request bodies and known PII fields before send.
  • Trigger.dev — background job execution (scheduled publishing, webhook fan-out).
  • Vercel — application hosting, edge network, and cookieless Web Analytics.
  • Social platforms you connect (Meta, TikTok, YouTube, X, LinkedIn, Pinterest) — we only send what you explicitly asked us to publish.

We do not sell personal data. With marketing consent, Meta receives advertising-measurement events from public acquisition pages. We do not use automatic advanced matching or send email addresses to Meta. See the Cookie Policy for controls.

When you connect a social platform or a storefront payment processor, that third party processes your data under its own privacy policy, which we do not control. Once content or data reaches a platform you connected, that platform’s handling of it is governed by that platform’s terms and privacy policy — see Meta / Instagram, TikTok, YouTube / Google, X, LinkedIn, Pinterest, and Stripe, or PayPal. Disconnecting a platform from Settings revokes the access we hold; you control that platform’s own data handling through the platform directly.

5. Google user data (YouTube API)

When you connect a YouTube channel, Repping.AI uses YouTube API Services under the OAuth scopes you grant on Google’s consent screen. Specifically:

  • Upload & publish (youtube.upload) — to upload videos you choose to publish.
  • Read channel & video data (youtube.readonly) — to show your channels, list videos, and confirm publish results.
  • Advanced permissions — optional youtube.force-ssl and yt-analytics.readonly permissions are requested only when the advanced connection is enabled. YouTube analytics is beta and limited to granted permissions and available data. Playlist-management permission is not part of the default connection.

Google user data is used only to provide and improve these user-facing features. We store OAuth tokens encrypted at rest (AES-256-GCM encryption) and we do not transfer Google user data to others except as necessary to provide the features above, to comply with applicable law, or as part of a merger/acquisition with prior notice. We do not use Google user data for advertising, and we do not sell it. No humans read your Google user data except with your explicit consent (e.g. to debug a support request you raise), to comply with law, or for security purposes.

Repping.AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your use of YouTube features through Repping.AI is also subject to the YouTube Terms of Service and the Google Privacy Policy. You can revoke Repping.AI’s access at any time from your Google security settings or by disconnecting the channel in Settings.

6. International transfers

Repping.AI is operated by Repping Labs LLC from the United States. When you use the service from outside the US, your data is transferred to the US under Standard Contractual Clauses (SCCs) or equivalent safeguards, depending on your jurisdiction. We undertake supplementary measures (encryption in transit, AES-256-GCM encryption of OAuth tokens at rest) to maintain a level of protection essentially equivalent to that of your home jurisdiction.

7. Retention

  • Account record: while your account is active, plus 30 days after closure (for fraud and chargeback windows).
  • Posts and ledger entries: retained for audit even after account closure, with the user reference redacted to a tombstone identifier.
  • Billing records: 7 years (tax law).
  • Webhook events and security logs: 90 days.
  • Sentry error events: 90 days.
  • Backups: rolling 30-day window, then purged.

8. Security

We use TLS 1.2+ for transport, Clerk for authentication and sessions, AES-256-GCM encryption for OAuth tokens at rest, scoped storage access, and Stripe signature verification for inbound payment events. We run least-privilege access controls and rotate secrets on a regular cadence. No system is unbreakable; we will notify you and competent authorities of breaches affecting your data within statutory windows.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You can exercise the most common rights yourself:

  • Access / portability: Request a copy of your personal data through our contact form. We will review the request and explain its scope before we provide the data.
  • Erasure: Use Delete my account to permanently disable the account, redact your email and personal fields, revoke connected OAuth tokens, and clear billing identifiers. Posts and financial records may be retained under the retention policy with identifying references redacted. Account owners must transfer ownership of organizations with other members before deletion; a confirmation phrase is required. Contact us about data outside this self-service process.
  • All other requests: email us via the contact form. We will respond within 30 days.

Depending on your jurisdiction, you may also have the right to lodge a complaint with your local data-protection authority. We do not sell personal data. The cookie banner lets you disable optional analytics cookies and Meta advertising measurement; browser privacy signals are respected as described in the Cookie Policy.

10. Children

The service is not directed to children under 16 and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.

11. Changes

We will post any material change here with a refreshed “last updated” date, and notify active users by email or in-app banner.

12. Contact

Data protection inquiries for Repping.AI, operated by Repping Labs LLC: use the contact form or email support@repping.ai with “Privacy” in the subject line.