Privacy policy

Effective March 19, 2026

In plain language:

We collect the minimum data needed to run the service: your account info, the content you create, and your connected social media tokens.
We use third-party AI services to generate drafts and suggestions, but we never sell your data or show you ads.
You can request deletion of all your data at any time by emailing us.
We use essential cookies (authentication and language preference) and may use analytics cookies to improve the service. No advertising cookies.
If you are in the EU or California, you have specific rights described below.

1. Information we collect

1.1 Account information

When you create an account, we collect:

Full name
Email address
Password (stored as a bcrypt hash; we never store your password in plain text)

1.2 Company and writer profile information

You may optionally provide:

Company name, description, industry, target audience, and related business information
Writer profile details including name, writing style preferences, tone, and content guidelines

1.3 Content you create

We store the content you create and manage through the Service, including:

Content ideas, drafts, and published posts
Hook variations and text edits
Illustrations and images (generated or uploaded)
Comments, replies, and AI-generated reply suggestions
Scheduling preferences and publication history

1.4 Social media account data

When you connect a social media account (LinkedIn or Facebook), we collect and store:

LinkedIn: OAuth access token, token expiration date, LinkedIn person ID, and profile headline
Facebook: OAuth user access token (exchanged for a long-lived token), Facebook user ID, and information about Facebook Pages you manage (page name, page ID, page access token)
Engagement data: Likes, comments, and other engagement metrics on your published posts, retrieved via the respective platform APIs

We do not store your LinkedIn or Facebook passwords. Authentication is handled entirely through OAuth, and tokens can be revoked at any time by disconnecting your account.

1.5 Usage and analytics data

We automatically collect:

Pages visited within the application
Feature usage patterns (e.g., draft generation, publishing, comment monitoring)
NPS survey responses and feedback you voluntarily provide
Email delivery and engagement events (sent, delivered, opened, clicked) for transactional and lifecycle emails we send you

1.6 Technical data

When you access the Service, our hosting providers may automatically log:

IP address
Browser type and version
Operating system
Referring URL
Date and time of access

We do not use this data for tracking or profiling. It is collected by our infrastructure providers as part of standard web hosting.

2. How we use your information

Purpose	Data used
Provide and operate the Service	Account info, content, social media tokens
Generate AI-powered content drafts and suggestions	Content, company/writer profiles
Generate AI-powered comment reply suggestions and sentiment analysis	Comments, company/writer profiles
Generate illustrations using AI image services	Content, image prompts
Publish and schedule posts to connected social media accounts	Content, social media tokens
Retrieve and display engagement metrics	Social media tokens, post identifiers
Send transactional emails	Email address, name
Send lifecycle emails (onboarding, milestones)	Email address, name, usage milestones
Improve the Service	Usage data, NPS feedback
Ensure security and prevent abuse	Technical data, account info

We do not use your data to:

Display advertisements
Sell or rent your personal information to third parties
Build profiles for ad targeting
Train AI models (your content is processed, not used for training; see Section 3)

3. Third-party services

We rely on the following third-party services to operate Suzy. Each service receives only the data necessary to perform its function.

3.1 Infrastructure and hosting

We use third-party cloud providers for application hosting and data storage. All application data is encrypted at rest and in transit. Technical access logs (IP address, browser type, timestamps) are collected by our infrastructure providers as part of standard web hosting.

3.2 Social media platforms

Service	Purpose	Data shared
LinkedIn API	Publishing, metrics, comment sync	Post content, images, OAuth tokens
Facebook/Meta Graph API	Publishing to Facebook Pages	Post content, images, OAuth tokens

Your use of LinkedIn and Facebook through Suzy is also governed by their respective privacy policies. We encourage you to review them.

3.3 AI processing services

We use third-party AI services for draft generation, reply suggestions, sentiment analysis, and illustration generation. These services receive only the content text, company/writer profiles, and image prompts necessary to perform their function.

Important notes about AI processing:

Your content is sent to these APIs for processing and is returned to Suzy. We do not control how these providers handle data in transit. Please review their respective privacy policies.
As of the effective date of this policy, the AI providers we use state that API inputs are not used to train their models.
Image generation prompts are text-only; your personal information is not included in image prompts.

3.4 Email services

We use third-party email services to send transactional emails (password resets, notifications) and lifecycle email sequences (onboarding, milestones). These services receive your email address, name, and relevant usage milestones.

3.5 Data processing agreements

Where required, we maintain data processing agreements with our sub-processors. A current list of sub-processors is available upon request by emailing hello@solutiontech-consulting.com.

4. Data sharing and disclosure

We do not sell, rent, or trade your personal information.

We may disclose your information only in these circumstances:

Service providers: To the third-party services listed in Section 3, solely to operate the Service.
Legal obligation: If required by law, regulation, legal process, or governmental request.
Protection of rights: To enforce our Terms of Service, protect our rights, privacy, safety, or property, or that of our users or the public.
With your consent: When you explicitly authorize us to share specific data.

5. Cookies and similar technologies

Suzy uses cookies for essential functionality and analytics. We do not use advertising cookies or cookies for ad targeting.

Cookie	Purpose	Duration	Type
`authjs.session-token`	Authenticates your session after login	Up to 30 days	Essential
`authjs.csrf-token`	Prevents cross-site request forgery attacks	Session	Essential
`authjs.callback-url`	Manages OAuth redirect flow	Session	Essential
`NEXT_LOCALE`	Stores your language preference	1 year	Functional
`locale-suggestion`	Suggests a language based on your browser	Session	Functional

We may also use third-party analytics cookies (such as Google Analytics or similar services) to understand how users interact with the Service and to improve the user experience. These cookies collect anonymized usage data such as pages visited, time on site, and interaction patterns. You can opt out of analytics cookies through your browser settings.

6. Data retention

Account data: Retained for as long as your account is active.
Content (ideas, drafts, posts, illustrations): Retained for as long as your account is active, unless you delete specific items.
Social media tokens: Retained until you disconnect the account or tokens expire/are revoked.
Email delivery logs: Retained for up to 12 months for troubleshooting and deliverability monitoring.
NPS responses: Retained indefinitely in anonymized/aggregated form for product improvement.
Technical/access logs: Retained by our hosting providers per their standard retention policies (typically 30 days).

After account deletion, we will remove your personal data within 30 days, except where retention is required by law.

7. Data deletion

You may request deletion of your data at any time.

How to request deletion

Email us at: hello@solutiontech-consulting.com

Include "Data Deletion Request" in the subject line, along with the email address associated with your Suzy account.

What happens when you request deletion

We will acknowledge your request within 5 business days.
We will complete the deletion within 30 calendar days of receiving your request.
We will delete or anonymize: your account and login credentials, your content (ideas, drafts, posts, illustrations, comments), your company and writer profiles, your social media connection tokens, your email preferences and NPS responses, and your data from our email service providers.
We will confirm deletion by email once complete.

What we cannot delete

Data already published to LinkedIn or Facebook through your connected accounts (you must delete this directly on those platforms)
Data we are legally required to retain (e.g., for tax, legal, or compliance purposes)
Anonymized, aggregated data that cannot be linked back to you

Disconnecting social media accounts

You can disconnect your LinkedIn or Facebook accounts at any time from your account settings. Disconnecting revokes Suzy's access tokens. To also revoke the application permission on the platform side, visit your LinkedIn or Facebook app settings directly.

8. Your rights

Regardless of where you are located, you have the right to:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate or incomplete personal data.
Deletion: Request deletion of your personal data (see Section 7).
Data portability: Request an export of your data in a commonly used, machine-readable format.
Withdraw consent: Where processing is based on consent, withdraw that consent at any time.
Opt-out of emails: Unsubscribe from lifecycle emails at any time via the unsubscribe link in any email, or by updating your email preferences in the app.

To exercise any of these rights, email us at hello@solutiontech-consulting.com. We will respond within 30 days.

9. GDPR (European Economic Area)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional provisions apply.

9.1 Legal bases for processing

Processing activity	Legal basis
Operating the Service, processing content	Performance of contract (Art. 6(1)(b))
Sending transactional emails	Performance of contract (Art. 6(1)(b))
Sending lifecycle emails	Legitimate interest (Art. 6(1)(f)); you can opt out
Security and fraud prevention	Legitimate interest (Art. 6(1)(f))
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))

9.2 Your additional rights under GDPR

In addition to the rights in Section 8, you have the right to:

Restrict processing: Request that we limit how we use your data.
Object to processing: Object to processing based on legitimate interests.
Lodge a complaint: File a complaint with your local data protection authority.

9.3 Data protection officer

We are a small business and have not appointed a formal Data Protection Officer. For all privacy inquiries, contact us at hello@solutiontech-consulting.com.

10. CCPA (California)

If you are a California resident, the following additional provisions apply under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

10.1 Categories of personal information collected

Category	Examples
Identifiers	Name, email address, IP address
Commercial information	Subscription status, usage history
Internet activity	Pages visited, feature usage
Professional information	Company name, industry, job-related content

10.2 Your CCPA rights

Right to know: You may request the categories and specific pieces of personal information we have collected.
Right to delete: You may request deletion of your personal information (see Section 7).
Right to opt-out of sale: We do not sell your personal information. There is nothing to opt out of.
Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

10.3 Do not sell or share

We do not sell or share (as defined by the CCPA/CPRA) your personal information for cross-context behavioral advertising. We have not done so in the preceding 12 months.

11. Children's privacy

Suzy is a business-to-business (B2B) service designed for professionals and businesses. It is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children.

If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at hello@solutiontech-consulting.com.

12. Security

We implement reasonable technical and organizational measures to protect your personal data, including:

Passwords stored using bcrypt hashing (never in plain text)
HTTPS encryption for all data in transit
OAuth tokens stored server-side in an encrypted database
CSRF protection on all state-changing operations
Input validation and output encoding to prevent injection attacks
Role-based access controls within the application
Database hosted with encryption at rest
Regular security reviews of application code

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Effective" date at the top of this page
Notify you by email or through an in-app notification

Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

14. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

Solution Tech Consulting
Email: hello@solutiontech-consulting.com