Privacy policy

Bold Beluga writes, designs and publishes social media posts for businesses. This policy explains what information we handle, why, and the choices you have. Bold Beluga is run by Helstad Digital (org. no. 838 699 472), Alexander Helstad's sole proprietorship in Norway, which is responsible for your information. Questions: alexander@boldbeluga.com.

What we collect

• Your account: name, email address and a securely hashed password. If you invite teammates, we keep their email address and the role you give them.
• Your business: the website address you give us and public content we read from it (text, images, colors, products), plus anything you add yourself, such as notes about your business, photos and your logo.
• Content we make for you: posts, captions, images, schedules and your approvals and edits.
• Early access list: if you ask us to tell you when Bold Beluga opens, your email address. We use it only for a confirmation and one email the day we open, and then delete it. The link in the confirmation takes you off the list anytime.
• Signing in with Google: if you choose “Continue with Google”, Google tells us your name, email address and profile picture. We don't get your Google password or access to anything else in your Google account.
• Connected accounts: when you connect Facebook or Instagram, we receive the name, ID and picture of the Pages and Instagram professional accounts you choose, and an access token that lets us publish posts you approve. If you also connect a Meta ad account for ads, we receive its name, ID and currency, and the results of the ads we run in it (spend, views and clicks). We also read how your posts did (reach, views, likes, comments, shares, saves and clicks) and the comments people leave on your posts, including the commenter's name, so you can see results and reply from your inbox. Comments are read when you open the inbox and aren't stored. We don't receive your Facebook password or your payment details.
• Your earlier posts: once, shortly after you connect Facebook and Instagram, we read the captions and a few photos of your latest posts so new posts match how you already write and the kind of photos you use.
• LinkedIn: when you connect your LinkedIn profile, LinkedIn tells us your name, profile picture and member ID, and gives us an access token that lets us publish posts to your profile. When you connect a LinkedIn company page, we receive the names and logos of the pages you manage, a token to publish to the page you choose, and how its posts did (views, clicks, likes, comments and shares). We don't receive your LinkedIn password.
• Google Drive: when you add photos from Google Drive, Google's own file picker opens and we get only the photos you pick there, nothing else in your Drive. The short-lived access Google gives us stays in your browser and is never stored. The photos you pick are kept like any photo you upload. Bold Beluga's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we use it only to make your posts, never for advertising, never to train AI models, and never share it except with the providers below as needed to make your posts.
• Canva: when you connect Canva, Canva gives us your Canva user ID and an access token that lets us list your designs, export the ones you pick as images, and copy a post's picture into a new design when you choose “Edit in Canva”. We don't receive your Canva password.
• Your online store: if you connect your store, we read its products: names, descriptions, prices, links and photos (for Shopify, the product list your store already shows publicly). A WooCommerce store gives us a read-only key that you approve in your store, and we also read its paid orders, keeping only each order's number, date, total, currency and the tags of the link the buyer arrived by (for example, which of your posts), so we can show the sales your social media brings in. We don't ask for or keep your customers' names, emails, addresses or what they bought, and we never change anything in your store.
• Research about your business: to plan posts that stand apart, we search the public web for businesses your customers may compare you with, using your business name, website, industry and area.
• Screenshots of other businesses' ads: if you use “Learn from ads that work” on the Ads page, the screenshots you add are sent once to Anthropic to find what those ads have in common, and are then dropped. We don't store them. We keep only the new ads written and drawn for you, with a few words on the idea each one follows, and never the other business's pictures, words or name.
• How you use Bold Beluga: which posts you approve, skip or ask to change (and why, if you tell us), and how your published posts do. We call this usage data. It also includes which steps of trying, signing up and setting up you reach (for example opening the Plan page or tapping Connect), and which version of a page or of the quick questions you were shown when we compare two or three versions to see which works better. That stays in our own database; no other company sees it.
• Payments: when you choose a plan, Stripe collects your card and billing details on its own page; we never see your card number. We keep your plan, when it renews, your Stripe customer number and when you paid or were refunded.
• AI assistants: if you connect an assistant such as Claude or ChatGPT, we store which assistant you approved and the access it was given. It can then read and change your brands and posts on your behalf, as you ask it to. What you write to your assistant is handled by its provider under their privacy policy; we only receive the requests it sends us. Remove the connector in your assistant to end its access.
• Technical data: a login cookie, a short-lived cookie (ten minutes) while you connect Facebook, Instagram or LinkedIn, your light or dark choice and a link to your last free preview (for 14 days) kept in your own browser, basic server logs, and a one-way hash of your IP address that we use to limit abuse of free previews, and anonymous page-view statistics (Vercel Web Analytics, and a count of front page views in our own database; neither sets cookies or stores anything in your browser), and a weekly count of which parts of the app each brand uses, kept in our own database without names, so we know what to improve. We don't use advertising or tracking cookies.

How we use it

• To create your brand profile and write and design your posts.
• To publish the posts you approve, at the times you choose, to the accounts you connect.
• If you turn on ads: to create, start, adjust and pause ads in your own ad account within the budget you set, and to show you how they perform.
• To run your account, keep the service secure and fix problems.
• To learn from your approvals, skips, change requests and results, so your next posts fit your taste and do more of what your audience responds to.
• To see, counted together, where trying and setting up Bold Beluga gets stuck, and to make it easier.
• To contact you about your account. We don't sell your information or use it for advertising.

Your content and AI

Your content is everything that belongs to your business: your website text, photos, logo, notes, products, your store's products and sales, and the posts, captions and images we make for you. We use it only to provide Bold Beluga to you. We never use it to train AI models, and we never show it to other customers.

Usage data is the record of your decisions and results described above. Today we use it only for your own brand. We may also use it to improve Bold Beluga for everyone, but only combined with other customers' data and anonymized into statistics (for example, “bakery posts that show the owner get more saves”), never in a way that identifies you, your business or the people who comment on your posts, and never including your content.

To write posts and make images, we send the content each request needs to the AI providers listed below. We use their business services, and Anthropic's and OpenAI's business terms say they don't train their models on what we send them.

We process this information to provide the service you signed up for (performance of a contract) and, for security and abuse prevention, on the basis of our legitimate interests.

Facebook and Instagram data

We use the access you grant only to list the Pages, Instagram accounts and ad accounts you manage, to publish the posts you approve, to show you how your posts did and the comments on them so you can reply, to learn your style from your latest posts once when you connect, and, if you turn on ads, to manage the ads in the ad account you choose and read their results. We don't read your private messages, sell or share this data, use it to train AI models, or use it for any other purpose. Access tokens are stored encrypted. You can disconnect at any time on the Channels and Ads pages in Bold Beluga, or remove Bold Beluga in your Facebook settings under Business integrations. Our use of information received from Meta follows the Meta Platform Terms.

Who helps us run the service

We share information only with providers that run parts of the service for us, under their own data protection terms:

• Vercel (hosting, file storage and anonymous visitor statistics) and Neon (database), in the United States.
• Anthropic (writing posts and ads, reading the ad screenshots you add, and searching the web about your business) and OpenAI (creating images), which process the content needed for each request.
• fal.ai (turning a post's image into a short video clip), which receives the image and a short description when you make a clip.
• Resend (sending email), which receives your email address and the email: confirming your address, password resets, the early access emails, and two emails you can turn off on your account page (when something needs you, and a weekly summary).
• Stripe (payments), which receives your email address, your name, billing address and tax ID if you give them, and your payment details.
• Meta (Facebook and Instagram), when you publish to your connected accounts or run ads in your ad account.
• LinkedIn, when you publish to your connected profile or company page.
• Google, which shows you its file picker when you add photos from Google Drive.
• Canva, when you bring in a design or edit a post's picture in Canva.
• Your own store (Shopify or WooCommerce), which we only read from, when you connect it.

Some providers are in the United States. Where the law requires it, transfers rely on safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Security

We protect your information with encrypted connections, encrypted platform access tokens and store keys, and hashed passwords. Read more on our Security page.

How long we keep it

We keep your information while you have an account. Free previews made without an account are deleted after 30 days. Store orders are kept for about 13 months, and deleted at once when you disconnect the store. When you delete your account, we delete your information within 30 days, except where the law requires us to keep it longer (for example, payment records). Posts already published stay on your social accounts until you remove them there.

Your rights

You can ask to see, correct, download or delete your information, or object to how we use it. Email alexander@boldbeluga.com. If you are in the EU/EEA, you can also complain to your data protection authority (in Norway, Datatilsynet). If you are in California, you have similar rights under the CCPA. We don't sell or share personal information as defined there.

Children

Bold Beluga is for businesses and isn't meant for anyone under 18.

Changes

If we change this policy in an important way, we'll tell you by email or in the app before the change takes effect.