Privacy Policy

1. Who we are

Pith operates pith.day and the related dashboard from Israel. Contact: privacy@pith.day.

2. What we collect

• Account: email, display name, and the Instagram handle you connect.
• Connected platforms: OAuth access tokens for the platforms you connect (currently including Meta/Instagram and Canva), plus the account IDs they grant access to.
• Content: drafts, generated images, scheduled posts, and metadata about posts we publish on your behalf — including data we read back from the connected platforms (for example, engagement and captions).
• Inbound assets: files and emails you send into the Service for use as content.
• Billing: a customer ID with our payment processor, plan, and renewal status. We do not see or store card numbers.
• Technical: IP address, basic request logs, and error reports.

3. Why we process it

To provide and operate the Service (contract), to bill you (contract), to keep the Service secure and to debug failures (legitimate interest), and to comply with legal obligations.

4. Who we share it with

We use third-party processors that act on our behalf in these categories: hosting and storage, database, transactional email, payment processing, AI model providers, product analytics, and error monitoring. The current named list lives at /privacy/processors. We do not sell personal data and do not allow processors to train models on your content.

5. Retention

• Drafts and content metadata: while your account is active.
• Connected-platform tokens: deleted within 24 hours of disconnect or a deauthorization signal from the platform.
• Logs and error reports: up to 90 days.
• After account deletion: removed within 30 days, except billing records retained as required by tax law.

6. Meta deauthorization & data deletion

Removing Pith from your Instagram or Facebook settings triggers token deletion within 24 hours. To request full data deletion, email privacy@pith.day or use the deletion-request URL listed in your Meta settings.

7. Your rights

You can access, correct, export, delete your data, or object to a specific processing by emailing privacy@pith.day. We respond to verified requests within 30 days. EU/UK users may also lodge a complaint with their supervisory authority. Israeli users have the rights granted by the Privacy Protection Law.

8. Security

TLS in transit, encryption at rest for connected-platform access tokens, and audit logging. To report a vulnerability, email privacy@pith.day.

9. Changes

We will update this page and revise the effective date above. Material changes will be announced by email before they take effect.