Note: This is a first-draft privacy policy for early access. It should be reviewed by a qualified lawyer before Suggesto opens to real users.
Legal

Privacy Policy

Last updated: July 2026

1. Who we are

Suggestoai.in ("Suggesto", "we", "us") is operated from India. We are the data fiduciary responsible for the personal data you provide. Contact: privacy@suggestoai.in.

2. What data we collect

Account data: Email address and name (provided at signup or waitlist registration).
Social platform tokens: OAuth access tokens from Instagram, YouTube, TikTok, or X — obtained when you connect an account. These are encrypted at rest using AES-256 (Fernet). We use them only to read your account metrics; we cannot post, edit, or delete content on your behalf.
Account metrics: Follower counts, post engagement rates, view counts, average watch times — publicly available metrics from your connected accounts. We do not collect your followers' personal data.
Generated content: Video ideas, analyses, and scripts Suggesto creates for you, associated with your account.
Usage data: Log data (timestamps, feature usage, error events) collected automatically for service reliability. No keystroke logging or session recording.
Waitlist data: Email, name (optional), and platform preference — collected when you join the early access list.

3. How we use your data

We use your data to: provide and improve the Suggesto service; generate AI-scored video ideas, video analyses, and scripts; send transactional emails (account confirmation, early access notification); and maintain service security and reliability. We do not sell your data.

4. Third-party processors

Anthropic (Claude API) (USA): AI generation — we send anonymized content context (your niche, metrics, idea text). No personally identifying information is sent to Anthropic.
Resend (USA): Transactional email delivery.
Vercel (Global CDN): Website hosting and edge functions.
Supabase / Neon (PostgreSQL) (Singapore / EU (depending on region selected)): Encrypted data storage.

5. Data retention

Account data and generated content are retained until you delete your account. OAuth tokens are deleted immediately when you disconnect a platform. Waitlist data is retained until early access opens or you request removal.

6. Your rights

Under the Digital Personal Data Protection (DPDP) Act 2023 (India) and GDPR (for EEA/UK users), you have the right to:

  • → Access the personal data we hold about you
  • → Correct inaccurate data
  • → Request deletion of your data
  • → Withdraw consent for optional processing
  • → Lodge a complaint with the relevant data protection authority

To exercise any right, email privacy@suggestoai.in. We respond within 30 days.

7. Cookies

See our Cookie Policy for details on what cookies we use and how to control them.

8. Changes to this policy

We will notify registered users by email before making material changes to this policy. The "Last updated" date at the top reflects the most recent revision.

9. Contact

Privacy inquiries: privacy@suggestoai.in. General contact: /contact.