Privacy policy

1. Who operates Publisher

Publisher is operated by Build a Micro SaaS Academy (“we,” “us,” or “our”). This policy applies to Publisher's website, application, public API, MCP tools and related support services. Questions and privacy requests can be sent to support@buildamicrosaas.com.

When you use Publisher for an organization, its workspace administrators control membership, connected accounts and publishing permissions. They can access the content and activity within that workspace. Brand folders organize content; they do not create private areas between workspace members.

2. Information we handle

• Account and workspace information: your email address, account identifier, workspace name, timezone, membership, role, invitations and notification preferences.
• Connected account information: the social networks, profiles, Pages and channels you authorize; their identifiers, display names, connection status, permissions and provider mappings. Authorization credentials are handled through our authentication and connection providers; do not send us your social-network passwords.
• Publishing content and activity: drafts, captions, destination variants, media files and file metadata, schedules, selected destinations, delivery receipts, native post links, errors and audit records.
• Developer resources: API-key names, prefixes, scopes, allowed accounts, verification hashes and usage timestamps; webhook URLs, event filters, signing secrets stored in encrypted form and delivery results. Full API keys and webhook secrets are revealed when created, so keep your copy private.
• Billing and support information: selected plans, subscription and payment status, billing identifiers, invoices or payment references, and information you include in support requests. Stripe handles payment-card details; Publisher does not store full card numbers or card security codes.
• Operational information: IP addresses, request timestamps, browser or device information, security events and diagnostic records needed to operate the service, prevent abuse and investigate failures.

Include only content and personal information you have permission to use. Public preview workspaces contain shared sample data; their visible preview notice warns you not to enter private information.

3. Why we use information

We use this information to authenticate users, enforce workspace permissions, connect authorized destinations, store and validate drafts, transfer media, schedule and publish posts, reconcile delivery outcomes, provide API and webhook access, process subscriptions, deliver service messages, answer support requests and protect the service from fraud, spam and misuse.

We also use necessary operational records to diagnose reliability issues, resolve disputes and meet legal obligations. We do not sell personal information or use your drafts or uploaded media for advertising. Publisher does not use your content to train AI models. If you connect an AI assistant or another external tool, information you choose to send to it is also subject to that tool's terms and privacy practices.

4. Service providers and sharing

We disclose information needed to deliver the features you use to providers that support Publisher:

• Supabase: account authentication, workspace database records and background application services.
• Cloudflare R2: private temporary storage and transfer of uploaded source media.
• Upload-Post: hosted social-account authorization, connected-account information, publishing payloads, media transfer and delivery status.
• Stripe: payment collection, subscription management, billing records and the customer billing portal.
• Resend: transactional email delivery, including recipient addresses and the service-message content we send.

Our hosting and infrastructure providers also process requests and operational data to serve the application. Providers receive information relevant to their function. Authorizing a social destination instructs us to send the selected content and necessary account identifiers to that network, including through Upload-Post. Published content may become public according to the visibility you choose and the network's rules.

Workspace members and tools using an authorized API key can access information allowed by their current permissions. Customer webhooks send event information to the URLs a workspace administrator configures. Those external destinations are controlled by the workspace, so configure them carefully.

We may disclose information where required by applicable law, to address fraud or security threats, to establish or defend legal claims, or in a merger, acquisition or transfer of the business, with appropriate protections and notice where required. Social networks and other services you connect apply their own privacy policies to information they receive.

5. Cookies and device storage

Publisher uses necessary cookies and browser storage for sign-in sessions, security, workspace selection and connection flows. Disabling these may prevent authentication or other essential features from working. Optional tracking is disabled until you choose it in Cookie settings. Analytics consent enables Google Analytics to measure page visits and verified signup and purchase events using browser and session identifiers. Advertising consent enables Meta Pixel and server conversion reporting using browser and click identifiers, campaign information and conversion details to measure advertising performance. We do not send your email address for advertising matching. Rejecting optional tracking does not prevent you from using Publisher.

Your choices are remembered for six months. Use Cookie settings on any page to change or withdraw consent. Withdrawal stops future optional tracking and removes accessible tracking cookies; it does not erase events already received by providers. Global Privacy Control disables advertising tracking. Attribution identifiers expire after 90 days and delivery payloads after 30 days; minimal deduplication records may remain to prevent duplicate conversions.

Opening a payment portal, social authorization screen or another external service may involve that provider's own cookies and privacy controls.

6. Retention and deletion

Source media is temporary storage, not a permanent backup. Keep your originals. Retention depends on all current uses of a file; the longer applicable recovery window takes precedence:

• Incomplete or abandoned uploads are generally eligible for cleanup after 24 hours.
• Unused draft or unattached source files are generally eligible for deletion after 14 days without a new media use.
• Files needed by future scheduled posts or publishing already in progress remain available while those operations need them.
• Sources for successfully settled or canceled deliveries generally have a 72-hour recovery window after settlement.
• Known failures and unresolved publishing outcomes generally have a 7-day review window after the last actual submission attempt. A delivery check by itself does not restart that window.

Files shared by several drafts or deliveries remain subject to their other applicable references. You can request earlier deletion of eligible files; active references may need to be removed or resolved first. Cleanup runs in the background, and failed deletion attempts are retried. Displayed retention information and deletion status show the current operational state. Expiring a source file does not remove text history, delivery records or a post already published on a social network.

We retain account, workspace, draft and publishing records while needed to provide the service. Canceling a subscription does not by itself delete the workspace. An owner can request workspace deletion in Settings. That stops new publishing and begins removal of the workspace's stored sources, connected-provider profiles and application records. Work already submitted may need to settle before deletion completes; a deletion receipt remains available to the requesting owner.

We may retain limited transaction, security, dispute and deletion records where necessary for legal obligations, fraud prevention or completion of the deletion request. Backup copies may remain until the applicable backup cycle expires and are not used to resume ordinary service. Deleting a workspace does not necessarily delete a login account used in other workspaces. Contact us to request account-level deletion or discuss any remaining records.

7. Security and international processing

We use access controls, workspace authorization, private media storage, limited-duration transfer links and protected credential storage to reduce unauthorized access. You are responsible for protecting your login, API keys and webhook secrets, and for choosing appropriate workspace roles. No internet service or storage system can guarantee absolute security.

Information may be processed in countries other than where you live, including the United States, through our service providers. It may therefore be subject to the laws and lawful access requirements of those countries. We use contractual and technical measures appropriate to the information and applicable requirements.

8. Your choices and requests

You can manage connected accounts, revoke API keys, remove webhook destinations, adjust available notification preferences and delete eligible media in the application. Disconnecting a destination stops future authorized dispatches through that connection; it does not remove native social posts. Essential security, account and billing messages may still be sent when optional emails are disabled.

Depending on applicable law, you may request access, correction, deletion, a copy of your personal information, restrictions on processing, or withdrawal of consent where processing relies on consent. Write to support@buildamicrosaas.com using the email associated with your account. We may verify your identity and authority before acting. Some requests must be handled with your workspace administrator or a connected provider, and legal or security obligations may limit what we can erase.

You may also contact the privacy regulator that applies where you live. Nothing in this policy removes rights available under applicable privacy law.

9. Age requirements

Publisher is for people who are at least 18 and legally able to enter into a contract where they live. It is not directed to children. If you believe a child has provided personal information to Publisher, contact us so we can investigate and take appropriate deletion steps.

10. Changes and contact

We may update this policy as Publisher changes. The effective date appears at the top of this page. We will provide notice of material changes through the application or email where appropriate or legally required, and obtain additional consent when required.

For privacy questions or requests, contact Build a Micro SaaS Academy at support@buildamicrosaas.com. Use of Publisher is also governed by our Terms of Service.