Privacy Policy

This policy explains what Spica Post, a service of ML Apps LLC, a Florida limited liability company, collects, why, and what you can do about it. Spica Post is a publishing tool: you connect your social accounts and your own AI assistant asks Spica Post to publish or schedule posts you approve.

The short version

• We store what is needed to publish your posts: your account details, your connected accounts' access tokens (encrypted), your drafts, media and delivery history.
• We never receive your social media passwords. You sign in on each platform's own page.
• We do not run AI on your content. Your own assistant, under your own account with its provider, does the writing.
• We do not sell your data or use it for advertising.
• You can disconnect an account or ask for everything to be deleted. See Data Deletion.

What we collect

Account information

Your email address, and a record of your plan and payments. Card details are handled by our payment processor and never reach our servers.

When you start a free week, our payment processor gives us a code that stands for your card without revealing its number. We keep a scrambled form of that code, which cannot be turned back into the card, so that one card is not used for more than one free week.

Connected social accounts

When you click Connect, the platform asks you to approve access and then gives us an access token, and for some platforms a refresh token. We store these encrypted. We also store the account's identifier and display name so you can tell your accounts apart. We do not receive or store your password for any platform.

Content you publish

Drafts, the text of each version, images and video you upload, schedule times, and a delivery record for each post: its status, the platform's post identifier and the link to the live post.

Statistics (Studio and Pro)

If you use a plan with statistics, we read figures about your own posts and accounts from the platforms you connect, such as reach, likes, comments and follower counts, and from Google Business Profile and Search Console if you connect them. We ask for these permissions when you connect, and use them only to show you your own results.

Brand profile and files

Brand details you confirm, such as colours, logo, fonts and voice notes. The logo and the photos you or your assistant add to your brand are stored with it. The folder you keep your files in stays yours: we do not connect to it.

Enquiries

If you email us: your email address and what you tell us.

Technical data

Basic request logs such as IP address, time and the page or tool requested, kept for security and troubleshooting, for up to 30 days.

How you use Spica Post

For each part of Spica Post your plan includes, such as scheduling, results, templates or your link page, we keep a count of how often you have opened or used it, with the first and the most recent time. We also count the tool requests your assistant sends. These are counts and dates only: they do not include what a post, a draft or a request said.

What we do not collect

• Your conversations with your AI assistant. We only see the tool requests the assistant sends to Spica Post, such as "create this draft" or "schedule this post".
• Private messages, comments or inboxes on your social accounts.
• Your social media passwords.

How we use it

• To publish and schedule the posts you approve, on the accounts you choose.
• To show you the status and history of your posts and, on plans that include them, your statistics.
• To enforce plan limits, prevent abuse of the platform connections all customers share, and keep the service secure.
• To bill you and to send service emails such as login links and connection-expired notices.
• To see which parts of Spica Post are being used, so we can help when something is not working for you and decide what to improve.

We do not use your content to train AI models, and we do not sell or rent personal data.

AI processing

Spica Post does not run AI models on your content. Drafting is done by the assistant you choose (for example Claude, ChatGPT or Meta Muse) under your own agreement with that provider, and what you share with it is covered by that provider's privacy policy.

Who we share it with

• The social platforms you connect. We send a post's content to a platform only when you publish or schedule it there.
• Service providers that process data for us: Cloudflare (hosting, database and media storage), Stripe (payments), and Resend (email).
• A keyword data provider (DataForSEO), for SEO research on Studio and Pro. Lookups send search terms such as a business type and location, not your account details.
• Authorities, where the law requires it.

Platform data and API terms

Data we receive from Meta (Instagram, Facebook, Threads), Google, TikTok, X, LinkedIn and Bluesky is used only to provide the features you asked for, in line with each platform's developer terms.

Spica Post's use and transfer of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

Spica Post uses YouTube API Services to upload the videos you ask it to post to your channel. When you connect YouTube we receive your channel's identifier and name, and afterwards the status of each video we uploaded for you; we do not read your other videos, comments or viewing history. Google's handling of your data is described in theGoogle Privacy Policy. You can remove Spica Post's access to your YouTube channel at any time from yourGoogle security settings page.

How long we keep it

• Uploaded media: deleted 7 days after the post is published.
• Your logo and brand photos: while they are in your brand. One you remove is deleted within about a day, unless a draft or a post still uses it. They are deleted with your account.
• Access tokens: until you disconnect the account, the platform revokes them, or you delete your Spica Post account.
• Drafts and delivery history: while your account is open.
• Counts of how you use Spica Post: while your account is open. They are deleted with your account.
• The scrambled card code from a free week: two years.
• Billing records: as long as tax and accounting law requires.

Security

Access tokens are encrypted before they are stored, and each customer's data is kept separate from every other customer's. Connections use HTTPS. No system is perfectly secure; if a breach affects your data we will tell you.

Your choices and rights

• Disconnect any social account, or revoke Spica Post's access in that platform's own settings.
• Ask for a copy of your data, a correction, or deletion. See Data Deletion.
• Depending on where you live, you may have further rights under laws such as the GDPR or CCPA. Email us and we will respond within 30 days.

Children

Spica Post is for businesses and is not directed at anyone under 18.

Changes

We will post changes here and update the date at the top. For significant changes we will email account holders.

Contact

ML Apps LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702. Email info@spicapost.com.