Privacy Policy

Who is responsible for your data

SMM AI Assistant is provided by Dmytro Muzylov, carrying on individual activity registered in the Republic of Lithuania, who is the controller of personal data within the meaning of the General Data Protection Regulation (GDPR).

The details are at the foot of this page. The full registered address is given on request, sent to support@smm-ai-assistant.com.

No Data Protection Officer has been appointed: the scale and nature of the processing are not among the cases where the GDPR requires one.

What we collect

As much as it takes for the service to work, and nothing beyond that.

• Account data: the email address, name and profile picture link Google passes on when you sign in. No password is stored — this service has none.
• Project content: everything you enter about a brand — project names and descriptions, questionnaire answers, settings — and everything the assistant makes in reply: research, strategies, weekly plans, post copy, storyboards and images.
• Subscription data: the plan, its state, the dates of paid periods, the Stripe customer id and records of credits spent. Your card details are neither seen nor stored by us — Stripe handles them.
• Technical data: request logs — IP address, time, browser and errors. They are what makes a fault or an abuse findable.

Why we process it, and on what basis

Every processing has a basis, and none of them is “because it was convenient”.

• To provide the service itself — create the account, keep the projects, generate the content. Basis: performance of a contract, Art. 6(1)(b) GDPR.
• To take payment and keep accounts. Bases: performance of a contract and a legal obligation, Art. 6(1)(b) and 6(1)(c).
• To keep the service running and to stop abuse of it. Basis: legitimate interest, Art. 6(1)(f).
• To send product emails, if you subscribe to them. Basis: consent, Art. 6(1)(a), which you can withdraw at any time.

We do not profile users, and no decision about you is made automatically.

Artificial intelligence: what actually reaches the model

To write a strategy or a post, the service sends OpenAI what that particular generation needs: your questionnaire answers, the brand description, the project settings and the earlier content the new one builds on.

OpenAI processes this as our subprocessor and, under the API terms, does not use it to train its models — unlike consumer ChatGPT, which that rule does not cover.

Requests and replies are held on OpenAI’s side for up to 30 days for abuse monitoring, and deleted after that.

Do not give the assistant anything you would not hand to a third party: passwords, your own clients’ personal data, somebody else’s trade secrets.

Who else receives it

We do not sell data and do not pass it to advertising networks. It reaches only the providers the service cannot run without:

• Supabase — the database and authentication.
• OpenAI — generating text and images.
• Stripe — taking payments and holding payment details.
• Vercel — hosting the application.
• Google — signing in with a Google account.

Your account and your project content are held in a Supabase database in London. The United Kingdom is not part of the European Economic Area, but the European Commission has found its level of data protection adequate — the decision in force runs to 27 December 2031 — so this transfer needs no separate contractual safeguards.

OpenAI, Vercel and Google also process data outside the EEA, the United States included. Those transfers rest on the European Commission’s standard contractual clauses.

How long we keep it

Three different periods, because three different things ask for them: you, the law, and the running of the service.

• Project content and account data — for as long as the account exists. Deleting it removes them at once and for good.
• Invoices and payment records — at least ten years from the end of the financial year, and longer for some kinds of document: Lithuanian bookkeeping and archives law sets the periods. Those records are held by Stripe.
• Requests to OpenAI — up to 30 days on OpenAI’s side, for abuse monitoring.
• Technical logs — up to 30 days.

Your rights

The GDPR gives you the right to a copy of your data, to have it corrected or erased, to restrict or object to its processing, to take it to another service, and to withdraw consent.

• Deleting the account and everything on it is something you do yourself: the Account page, under “Delete your account”. It needs no request to us and happens immediately.
• For anything else, write to support@smm-ai-assistant.com. We answer within one month.
• If our answer does not satisfy you, you may complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt) or to the supervisory authority where you live.

Cookies

The service sets only functional cookies: they hold your session after sign-in and remember the language you chose. The theme you picked is kept by the browser locally, in localStorage, and never reaches us at all.

Neither signing in nor keeping the choices you made is possible without this, so it needs no separate consent.

There is no analytics, no advertising pixel and no third-party tracker on this site. If any appear, a consent banner will be added and this page updated before they start working.

Security

Data travels over encrypted connections only, database access is bounded by row level policies, and payment details never reach our servers at all.

There is no such thing as absolute security. But a breach that puts your rights at risk will be reported to you and to the supervisory authority within 72 hours.

Age

The service is for adults: you may use it from the age of 18. We do not knowingly collect children’s data.

Changes to this policy

If this policy changes, the date at the top of the page changes with it. Material changes — to the scope of processing or to the list of providers — are announced by email at least 30 days in advance.