Your data, handled with care.

We collect information in a few ways. Some you give us directly. Some we gather when you use the Service.

Information you provide

When you create an account, set up a brand, or contact us, you may share your name, email address, business name, phone number, billing details, and brand preferences (colors, logos, voice settings). If you connect social media accounts, we receive the access tokens and profile information needed to publish on your behalf.

Content you capture

Photos, videos, text, and other media you upload or capture through the Service. This is your content. We process it to generate posts, but we don't claim ownership of it.

Google Drive (photo import)

If you connect Google Drive, we get read-only access so we can read the folder you choose and import new photos from it.

Information collected automatically

When you use the Service, we automatically collect device information (browser type, operating system, device identifiers), usage data (features used, pages visited, timestamps), IP address and approximate location, and cookies and similar tracking technologies.

Information collected by analytics, advertising, and session recording tools

On our website, we use tools from Meta, Google, and Microsoft. In our app (app.wallflower.social), only the Meta Pixel runs in your browser, and only on some pages (sign-up, checkout, sign-in, onboarding, workspace setup, app download, and your dashboard). Google Analytics gets app events, such as sign-ups and purchases, only from our servers. Microsoft Clarity runs only on our website. These tools collect things like the pages you visit, actions you take (such as signing up or making a purchase), how you click and scroll, cookie IDs, your IP address, and your browser type. Section 4 explains each tool, what it collects, and how to opt out.

We use the information we collect to operate and improve the Service, including:

• Generating, scheduling, and publishing content on your behalf
• Personalizing your brand experience and content suggestions
• Processing payments and managing your account
• Sending service-related communications (not marketing spam)
• Analyzing usage patterns to make the product better
• Measuring visits to our website and understanding how our pages are used
• Measuring how well our ads work and improving them
• Complying with legal obligations

We don't sell your information for money. Some of the advertising tools in Section 4 can count as "sharing" for cross-context behavioral advertising under California law (and as "sale" or "targeted advertising" under some other state laws). You can opt out at any time. See Section 12.

We share your information only when necessary and only with parties who need it.

Service providers

We work with trusted third parties for hosting, payment processing, analytics, and email delivery. These include:

• AI model providers, to create content drafts from the photos and info you provide
• A payment processor, to process payments
• An email delivery provider, to send email, including the emails you send to your subscribers
• Hosting providers, to run the Service
• A cloud storage provider, to store your photos and media
• An error-monitoring provider, to help us find and fix errors
• A push notification provider, to send notifications in the Companion app

They access your data only to perform services on our behalf and are bound by confidentiality obligations.

Analytics and advertising partners

We share information with Meta (Meta Pixel and Conversions API), Google (Google Analytics 4), and Microsoft (Clarity) to measure visits, understand how our pages are used, and measure and improve our advertising. Meta may use what we send to match visits and sign-ups to ads it showed you. In our app, only the Meta Pixel runs in your browser. Google Analytics gets app events only from our servers, and Clarity runs only on our website. Section 4 has the details.

Social media platforms

When you connect accounts and publish content, we share your content with the platforms you've chosen. Each platform's own privacy policy governs their use of that data.

Legal requirements

We may disclose information if required by law, legal process, or government request, or to protect the rights, safety, or property of Wallflower Social HQ, our users, or the public.

Business transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We'll notify you before your data becomes subject to a different privacy policy.

Here's every analytics, advertising, and session recording tool we use, where it runs, what it collects, and why.

Where each tool runs

No Meta Pixel events are sent from the pages your email subscribers see. The Pixel script file may still load on those pages, but no events are sent. We don't send the photos, posts, or emails you create in the app, or any information about your email subscribers or followers, to Meta, Google, or Microsoft for analytics or advertising. When you choose to publish to Facebook or Instagram, that content goes to Meta so it can be published, as described in Section 3.

Meta Pixel and Meta Conversions API

What it collects. We share these events with Meta: page views, views of our pricing and landing pages, checkout starts, completed sign-ups, free trial starts, the start of a subscription, and purchases. These events are sent two ways:

• From your browser, through the Meta Pixel. The Pixel does not receive your contact details.
• From our servers, through the Meta Conversions API.

With server events, we send:

• Hashed contact details from the billing details you enter at checkout: email, phone, name, city, state, zip code, and country. Hashing (SHA-256) turns these details into a scrambled code before they leave our servers.
• A hashed account ID (our internal ID for your workspace).
• Your IP address and browser user agent (the browser and device type your browser reports).
• Meta cookie IDs (_fbp and _fbc).

Why. So Meta can match the event to an ad it showed you. That tells us which ads bring people to Wallflower Social HQ, and helps us improve our ads.

Meta's use. Meta's use of this information is governed by its own policy.

• Meta Privacy Policy: https://www.facebook.com/privacy/policy/
• Your Meta ad preferences: https://www.facebook.com/adpreferences
• Your activity off Meta technologies (see and disconnect activity that businesses share with Meta): https://www.facebook.com/off_facebook_activity

California note. Under California law, sending this information to Meta for advertising can be "sharing" for cross-context behavioral advertising. You have the right to opt out. To opt out, email hello@wallflowersocialhq.com with the subject "Do Not Sell or Share" or turn on Global Privacy Control. See Section 12.

Google Analytics 4

What it collects. Information about how you use our site, such as pages viewed and actions taken, plus conversions such as checkout starts and purchases. This is linked to a Google Analytics client ID, a random ID stored in a cookie on your browser. Some events (sign-ups and purchases) are also sent from our servers straight to Google (server-to-server events) and tied to that same client ID. Those server events include the plan, the price, and an order number, but not your name, email, or other contact details.

Why. To measure site usage and conversions, so we know what's working and what isn't.

Global Privacy Control. When your browser sends a Global Privacy Control signal, Google signals and ad personalization are turned off for your visit. Google Analytics still measures the visit. If GPC is on when you check out, our servers also don't send your sign-up or purchase events to Google.

Your choices.

• How Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites
• Google Privacy Policy: https://policies.google.com/privacy
• Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
• Google ad settings (My Ad Center): https://myadcenter.google.com/

Microsoft Clarity

What it collects. On our website only, Clarity records how visitors use our pages. That includes session replays (a recording of how you move through a page, such as clicks, scrolls, and mouse movement) and heatmaps (a combined view of where visitors click and scroll). Form inputs and drop-down choices are always masked, so what you type into forms is hidden in recordings. Clarity also masks content it treats as sensitive, such as email addresses and numbers.

Why. To see where pages are confusing or broken, so we can fix them.

Your choices.

• Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement
• How Clarity masks content: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-masking
• You can block Clarity by blocking cookies or scripts from clarity.ms in your browser. Global Privacy Control and Do Not Sell or Share requests don't turn off Clarity. Form inputs stay masked either way.

Cookies are small files a website stores in your browser. "Similar technologies" means things like pixels and scripts that do the same job. We use them on our website, and on the sign-up, checkout, sign-in, onboarding, workspace setup, app download, and dashboard pages of our app (where only the Meta Pixel runs), to measure visits, understand how pages are used, and measure and improve our advertising.

Cookies we use for analytics and advertising

Lifetimes are each vendor's default and may be reset when you visit again. We don't change these defaults.

Essential cookies and browser storage on our app

These keep the app working and aren't used for advertising:

When the Meta Pixel is on, the app also keeps two small items in your browser's local storage: a short list of sign-up events waiting to be sent to Meta (cleared after 7 days at most) and a short note about your checkout so the right sign-up event is sent. A Google Analytics client ID from your website visit is kept in session storage until you close the tab.

How to control cookies

• Global Privacy Control (GPC). Turn on GPC in a browser or extension that supports it. We treat it as a request to opt out of sale and sharing. Learn more at https://globalprivacycontrol.org/.
• Email us. Send a "Do Not Sell or Share" request to hello@wallflowersocialhq.com. See Section 12 for what it covers.
• Browser settings. Most browsers let you block or delete cookies. Blocking all cookies may stop some parts of the Service from working.
• Meta and Google ad settings. Use the Meta and Google links in Section 4.
• Google Analytics opt-out add-on. https://tools.google.com/dlpage/gaoptout

Wallflower uses third-party AI model providers to create drafts from your photos, media, and the info you provide. They process the content needed to do that, and under their business terms they don't use it to train their models. We don't use your individual content to train models shared with other customers. You can always review and edit drafts before anything goes out.

• We keep your account information for as long as your account is active.
• Content you upload is retained until you delete it or close your account.
• Aggregated product usage statistics may be kept in anonymized form for product improvement. This doesn't cover the checkout IDs described below.
• Google Analytics keeps user-level data for 14 months. Microsoft Clarity keeps recordings and heatmap data for Microsoft's standard retention period (see Microsoft's Clarity privacy information). Meta keeps the data it receives under its own retention rules.
• Our server logs for these events record technical details about each send, such as the event name, an event ID, and whether the send worked. They don't include your contact details.
• The browser and ad-click IDs we capture at checkout (cookie IDs, IP address, and browser type) are kept with your sign-up record. You can ask us to delete them by emailing hello@wallflowersocialhq.com.
• Cookies last for the lifetimes listed in Section 5, unless you delete them sooner.
• When you delete your workspace, there's a 30-day grace period. After that, we delete or de-identify your account data. Some records, and files you uploaded, may be kept for billing, legal, security, or operational reasons. You can ask us to delete them by emailing hello@wallflowersocialhq.com.
• Copies of your data may remain in backups for a while after deletion.

Depending on where you live, you may have the right to:

• Access, correct, or delete your personal data
• Export your data in a portable format
• Opt out of certain data processing, including the sale or sharing of your personal information for advertising
• Withdraw consent where processing is consent-based
• Lodge a complaint with a supervisory authority

To exercise any of these rights, reach out to us at hello@wallflowersocialhq.com. We'll respond within 30 days. To delete data from connected social accounts, see our Data Deletion Instructions.

To opt out of sale or sharing, email hello@wallflowersocialhq.com with the subject "Do Not Sell or Share" or turn on Global Privacy Control.

You can also manage cookies through your browser settings (see Section 5) and unsubscribe from non-essential emails using the link in any message we send.

We use reasonable technical and organizational safeguards to protect your information, including:

• Encryption in transit (TLS)
• Access controls and authentication requirements
• Incident response procedures

No system is perfectly secure, but we take this seriously and keep working to improve our protections.

The Service is not directed to anyone under 16. We don't knowingly collect personal information from children, and we don't knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us with personal data, please contact us and we'll remove it promptly.

If you're using the Service from outside the United States, your information may be transferred to and processed in the United States or other countries where our service providers operate. We take reasonable steps to protect your data during these transfers.

If you're a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you specific rights over your personal information. Residents of some other US states (such as Colorado, Connecticut, Virginia, and others with similar laws) have similar rights, including the right to opt out of targeted advertising. We offer the rights below to all US users, wherever you live.

What we collect and why

In the preceding 12 months, we may have collected these categories of personal information:

• Identifiers: name, email, phone number, IP address, account ID, cookie IDs, and hashed contact details
• Commercial information: billing details, purchase history, and purchase and checkout events
• Internet or other electronic network activity: usage data, browser type, pages visited, actions taken on our site, and session replays and heatmaps of how you use our website
• Geolocation data: approximate location from your IP address, and city, state, zip code, and country
• Professional information: business name and role

We collect this information for the purposes described in Section 2.

Sharing for cross-context behavioral advertising

We don't sell your personal information for money. We do share some personal information with Meta, through the Meta Pixel and Conversions API, so Meta can match visits and sign-ups to ads it showed you. Under California law, this can be "sharing" for cross-context behavioral advertising. The categories we share this way are identifiers (including hashed contact details, hashed account ID, IP address, and cookie IDs), commercial information (sign-up, checkout, and purchase events), and internet activity (page views and browser user agent).

Your rights

• Right to know what personal information we collect, use, and disclose, and who we disclose it to
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of your personal information, including for cross-context behavioral advertising (targeted advertising)
• Right to non-discrimination. We won't treat you differently, or offer you a different level of service, for exercising any of these rights

Do Not Sell or Share My Personal Information

You can opt out of the sale or sharing of your personal information for advertising in two ways:

1. Email us. Send a message to hello@wallflowersocialhq.com with the subject "Do Not Sell or Share." Include the email address on your Wallflower account, if you have one. From then on, our servers stop sending your details to Meta and Google. We can't use an emailed request to turn off tracking in browsers or devices we can't connect to you, so for that, use option 2 or the Meta and Google ad settings and browser controls in Sections 4 and 5.
2. Turn on Global Privacy Control. We honor it automatically in any browser that sends it. See below for what it turns off.

We don't need to verify your identity for an opt-out request.

Global Privacy Control

We honor Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a valid request to opt out of the sale or sharing of your personal information for that browser. With GPC on, the Meta Pixel doesn't run, and Google signals and ad personalization in Google Analytics are turned off. If GPC is on when you check out, our servers don't send your sign-up, subscription, or purchase events to Meta or Google, including later ones tied to that checkout. GPC applies to the browser that sends it; it isn't saved to your account. GPC doesn't turn off Microsoft Clarity, which still records site visits with form inputs masked (see Section 4).

How to make a request

Email hello@wallflowersocialhq.com with the subject line "Privacy Request" and tell us which right you want to use. For requests to know, delete, or correct, we'll verify your identity before processing the request (usually by confirming you control the email address on your account). We'll respond within 45 days. You may also designate an authorized agent to make a request on your behalf.

If we decline your request, we'll tell you why. If you live in a state that gives you the right to appeal, you can reply to our response to ask us to reconsider.

If you're located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and related laws provide you with additional protections.

Wallflower is offered to businesses in the United States. Our website uses the analytics, advertising, and session recording tools described in Section 4 for all visitors, and we don't show a separate consent step. If you visit from outside the US and want to opt out, email hello@wallflowersocialhq.com. An emailed opt-out stops our servers from sending events tied to your Wallflower sign-up or account to Meta and Google. It can't turn off browser tracking if you never signed up, or on devices we can't connect to you. For that, use Global Privacy Control or the browser, Meta, and Google settings in Sections 4 and 5.

Legal bases for processing

We process your personal data under the following legal bases:

• Contract performance: to provide the Service you've signed up for, including content generation, scheduling, and publishing
• Legitimate interests: to improve the Service, prevent fraud, and ensure security, where these interests don't override your rights
• Consent: where you've opted in to marketing emails (you can unsubscribe at any time)
• Legal obligation: where we're required to process data by applicable law

Your rights under the GDPR

In addition to the rights listed in Section 8, you have:

• The right to data portability (receiving your data in a structured, machine-readable format)
• The right to restrict processing in certain circumstances
• The right to object to processing based on legitimate interests
• The right to lodge a complaint with your local data protection authority

Email hello@wallflowersocialhq.com and we'll respond within 30 days.

Data protection officer

For GDPR-related inquiries, you can reach our data protection contact at hello@wallflowersocialhq.com. If you're not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.

Data transfers outside the EEA

When your data is transferred outside the EEA, we take reasonable steps to protect it.

We may update this policy from time to time. When we make meaningful changes, we'll let you know through the Service or by email. The "Last updated" date at the top tells you when this version took effect.

Questions, concerns, or just want to say hello?