Privacy Policy

1. What this policy covers

This policy explains how FoodPostStudio collects, uses, stores, and shares information when you visit the website, create an account, upload content, generate social posts, or purchase a plan.

2. Information we collect

We collect account information such as your email address, display name, authentication identifiers, and session records. We also process the photos, brand details, campaign instructions, generated images, captions, and other content you choose to provide.

When you make a purchase, our payment provider processes payment details. We receive transaction, subscription, product, and status information, but we do not store complete card numbers. We may also collect limited technical and usage data needed for security, fraud prevention, reliability, and support.

3. How we use information

• Provide authentication, workspaces, image generation, storage, downloads, billing, and support.
• Protect accounts, prevent abuse, troubleshoot failures, and maintain an auditable credit ledger.
• Communicate service messages such as login codes and respond to support requests.
• Comply with legal obligations and enforce our Terms.

4. AI processing, safety, and service providers

Before generation, project names, business names, and campaign instructions are sent to Waffo Pancake for a content-safety check. FoodPostStudio stores the resulting decision, policy categories, provider request identifier, and a one-way content hash for security and audit purposes, but does not copy the scanned prompt into the safety audit record. Your original project details remain part of your saved project.

After approval, FoodPostStudio uses OpenRouter to access Qwen Image 3 for image generation and Qwen 3.8 Flash for captions, hashtags, and accessibility descriptions. Source photos, approved project instructions, and the context needed to provide those features are transmitted to these AI services. The model names and providers may change as the service evolves; material changes will be reflected in this policy and our public product disclosures.

We also rely on Railway for application hosting, Cloudflare R2 for object storage, Google for authentication, Waffo Pancake for payment services, and other database, email, analytics, and support providers configured for the service. These providers process data only to perform services for us and under their own applicable terms and privacy commitments.

5. Analytics and Google Tag Manager

We use Google Tag Manager to load and manage website measurement tags. Depending on the tags enabled in our container, these tools may process information such as the page visited, referring page, approximate location derived from an IP address, browser and device information, and interactions with the website. Analytics tags may use cookies or similar technologies, and Google may receive data when those tags load.

Google Tag Manager manages tags but does not determine which measurements we configure. We use analytics information to understand site performance, improve navigation and content, and identify product issues. You can limit or delete analytics cookies through your browser settings.

6. Retention and deletion

Deleted projects remain recoverable for 30 days and are then permanently removed, including generated images and source images that are not used by another project. Inactive free or expired workspaces are scheduled for deletion after 90 days; workspaces with payment history are scheduled after 180 days. We send a notice 30 days before workspace deletion, active paid subscriptions are excluded, and using the workspace during the notice period cancels the scheduled deletion.

Billing, credit, fraud-prevention, analytics, and retention audit records may be kept longer where needed for accounting, security, service improvement, disputes, or legal obligations. You may request account or content deletion through the in-product feedback channel or by emailing [email protected].

7. Security

We use private object storage, server-side authorization checks, hashed session tokens, origin validation, signed payment webhooks, and access controls designed to protect your data. No online service can guarantee absolute security, so you should use an email account you control and avoid uploading sensitive personal information that is not needed for your project.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or export personal information, or object to certain processing. We may need to verify your identity before completing a request.

9. Children

FoodPostStudio is intended for businesses and adults. It is not directed to children under 13, and we do not knowingly collect their personal information.

10. Changes and contact

We may update this policy when the product, AI providers, or legal requirements change. Material updates will be posted here with a revised date. Questions may be sent to [email protected]. Reports of unsafe or infringing AI content can be submitted through the process in our AI Content & Acceptable Use Policy.