Privacy Policy

The Bereel operator identified on this page is responsible for its own account administration, billing, security, and service-management processing. When an organization uses Bereel to process personal data in project content solely on its instructions, that organization may be the controller and Bereel its processor. The relevant data processing agreement must establish the roles and obligations for that use.

This draft requires confirmation of the operator, provider register, processing locations, retention schedule, and lawful bases before publication. It describes the application’s data flows without asserting unverified certifications, hosting regions, model-training exclusions, or deletion deadlines.

The categories depend on the features you use:

• Account and verification information: name, email, mobile number, verification status, authentication/session information, password credentials handled by the authentication service, and account settings.
• Organization information: membership, roles, invitations, project access, brand information, style preferences, products, audience descriptions, and saved creative memory.
• Content and generation information: prompts, uploaded media, source URLs and retrieved context, voice recordings, transcripts, captions, translations, job settings, generated outputs, feedback, and generation status or errors.
• Facebook and other connected-platform information: Meta account identifiers used to maintain or remove a connection, Facebook Page names and identifiers, selected Page destinations, user and Page access tokens, post identifiers and links, scheduling and publication outcomes, and platform performance metrics.
• Billing and referral information: plan, subscription status, processor identifiers, invoices and payment status, credit transactions, referral attribution, and reward history. Payment details entered on a processor’s checkout are also subject to that processor’s notice.
• Operational information: requests, device/browser and network information available to the service, security and error records, support correspondence, cookie choices, optional signed-in presence signals when enabled, and Microsoft Clarity session recordings of product use (pages, clicks, scrolls) labeled with the signed-in email so recordings can be reviewed per account.

Information comes from you, authorized teammates, connected social platforms, payment and verification providers, websites or sources you ask us to process, and your use of the service. An administrator may invite you and assign access before you first sign in. If someone uploads your personal data, contact the organization that controls that project or the privacy contact here so the request can be directed appropriately.

We use account, project, and job information to provide requested features and administer the service. Where applicable, performance of a contract with an individual is the basis for necessary account and service processing. For business representatives and other processing not necessary to a contract with the individual, an appropriate legitimate-interest assessment or another applicable basis is needed.

When you connect Facebook, we use the authorization credentials and Page identifiers to show you Pages you can manage, remember the Pages you select, publish the content and instructions you schedule, and retrieve publication status and available post-performance metrics for display in Bereel analytics. Facebook metrics can include views, reactions, comments, shares, and a link to the published post. We do not use this Facebook connection to publish to personal profiles.

Billing records and legally required disclosures may be processed to meet legal obligations. Security, fraud prevention, troubleshooting, and proportionate service administration may rely on legitimate interests after assessing the impact on individuals. The draft operator must validate these bases against actual backend practices before publication.

Optional referral storage and signed-in activity measurement are controlled by your cookie choices. Consent can be withdrawn as easily as it is given. Essential processing is not switched off by rejecting optional cookies. Marketing email requires its own appropriate legal basis and unsubscribe controls; accepting account terms or cookies does not subscribe you to marketing.

Authorized project users may access shared content and activity according to permissions. Providers that operate hosting, storage, authentication, payment, verification, communication, AI generation, transcription, product-usage analytics, or support may process information needed for their role. Microsoft Clarity (Microsoft) receives session-replay and interaction data from this frontend, including custom tags such as email and page path, under Microsoft’s Clarity terms and privacy notice. AI requests can include selected source media, prompts, brand context, audio, or transcripts. For Facebook publishing and analytics, the service communicates with Meta using the authorization credentials you grant; Meta receives the content and publishing instructions you choose and provides the Page and post information needed for the connected features. Meta may act as an independent controller under its own privacy notices.

This frontend includes Stripe billing integration and references to generation and transcription services, but does not establish a complete list of backend subprocessors or their retention and training policies. A verified provider register and, where required, subprocessor notice must accompany the final policy. Do not assume all providers receive all content.

Information may also be disclosed when legally required, to protect lawful rights and security, or as part of a lawful corporate transaction with appropriate safeguards and required notice. These categories do not authorize unrelated advertising disclosure.

Processing locations depend on the operator and the providers used for a feature. Where personal data is transferred internationally, the applicable legal transfer mechanism and safeguards must be identified, such as an adequacy decision or approved contractual clauses with required supplementary measures. Ask the privacy contact for applicable transfer information and how to obtain a copy of safeguards. This draft does not claim that all data stays in the EU or any other region.

Retention must be limited to the purposes for which information is needed, including providing active projects and jobs, resolving disputes, preventing abuse, and meeting accounting or legal obligations. Different schedules apply to active content, authentication records, logs, invoices, backups, and provider-held copies. The operator must confirm the actual periods and deletion processes before publishing this policy; the frontend alone cannot establish them.

Facebook user and Page access tokens, Page names and identifiers, selected Page identifiers, and the Meta account identifier used for connection management are stored server-side in the service’s Infisical-managed secrets vault, not in browser storage. They are retained while the Facebook connection is active and needed to provide the connected features. The service does not currently apply a fixed time-based expiry to these connection records. Facebook post-performance metrics and publishing records are retained with the related Bereel publishing history while needed to provide the calendar and analytics features.

The preference cookie lasts up to 180 days; the optional referral cookie is described as lasting up to 30 days. Browser local storage persists until cleared by you or the application, while session storage normally lasts for the tab session. More detail appears in the Cookie Policy.

Disconnecting Facebook or completing a valid Meta data-deletion request removes the Facebook connection credentials, Page selections and identity, and stored Facebook publishing/metrics records from the service, and pauses pending Facebook schedules. The authored calendar or library content remains in Bereel, and posts already published remain on Facebook unless you remove them there. Account and project deletion controls initiate the relevant service action but do not guarantee immediate removal from all backups, legally retained records, providers, or social networks. Clearing browser storage does not delete your server-side account.

Depending on applicable law and the processing basis, you may request access, correction, erasure, restriction, portability, or object to processing, and you may withdraw consent prospectively. Contact the privacy email shown in the Operator & contact details at the end of this policy with enough information to identify your account and request. You can disconnect Facebook in Integrations or submit a data-deletion request through Meta; the public Facebook data-deletion instructions explain that process. We may need proportionate identity verification; do not send identity documents unless requested through an appropriate channel.

You may complain to the competent data-protection authority, including in your habitual residence, place of work, or location of an alleged infringement where applicable. If project data is controlled by your employer or client, we may need to refer the request to that controller or assist it under the applicable processing agreement. Required response periods and exceptions are those in applicable law.

Manage optional tracking in Cookie settings, connected accounts in Integrations, brand-memory prompts in Settings, and marketing preferences through the unsubscribe link where provided. If you decline information necessary for registration, verification, payment, or a chosen generation feature, we may be unable to provide that feature.

AI-assisted generation and creative recommendations use your prompts and project context to produce content. This is different from making a legal or similarly significant decision about a person. The backend’s fraud, eligibility, moderation, and referral checks must be assessed separately for any additional automated-decision disclosures or safeguards required by law.

We use safeguards appropriate to the processing, and users should protect credentials and project permissions. No service can promise absolute security. Report suspected unauthorized access through the support contact. This document does not claim a particular certification, encryption regime, or incident-response guarantee that has not been verified.

Bereel is intended for adults, not children. Do not create an account if you are under 18. If you believe a child has supplied personal data improperly, contact the privacy address. Changes to this policy will be identified by version and effective date, with additional notice or consent where required.