Privacy Policy

At Opengraphy ("we," "us," "our"), we take your privacy seriously. This Privacy Policy explains in detail how we collect, use, disclose, and safeguard your information when you use our AI-powered marketing platform and services available at app.opengraphy.com (the "Service").

We are committed to complying with the General Data Protection Regulation (GDPR), the ePrivacy Directive, and other applicable privacy laws including but not limited to the California Consumer Privacy Act (CCPA) and applicable Belgian and European data protection regulations.

Data Controller: Opengraphy SPRL, Square Eugène Plasky, 1030 Schaerbeek, Belgium. We act as the data controller for personal data processed through the Service.

🔔 Important Notice: By using Opengraphy, you acknowledge and consent to the processing of your data as described in this policy, including the transfer of data to third-party AI providers and integration partners necessary to deliver our services.

We collect several types of information to provide and improve our Service:

2.1 Personal Data

• Account Information: Name, email address, phone number, company name, job title when you register for an account.
• Billing Information: Payment card details, billing address, VAT number (processed securely through Stripe, our payment processor).
• Profile Data: User preferences, avatar/profile picture, communication preferences.
• Organization Data: Team member information, organization name, industry, website URL.

2.2 Content Data You Submit

• Brand Information: Brand names, descriptions, positioning, target audience, competitors.
• Marketing Content: URLs, marketing briefs, content strategies, keywords, queries.
• Creative Assets: Images, videos, audio files, documents you upload for analysis or generation.
• AI Training Data: Custom instructions, knowledge base documents, brand voice guidelines for AI agents.

2.3 Generated Data

• AI Outputs: Reports, analyses, images, videos, text, audio content, and strategies created by our AI on your behalf.
• Visibility Insights: Brand mentions, competitor analyses, AI citation data from multiple LLM sources.
• Content Library: All generated assets stored in your account.

2.4 Usage & Technical Data

• Log Data: IP address, browser type and version, device information, operating system.
• Usage Analytics: Pages viewed, features used, time spent, interaction patterns.
• Performance Data: API response times, error logs, crash reports.
• Cookies & Tracking: See our Cookie Policy for details.

2.5 Lead Data (If Using Lead Generation Features)

• Visitor Information: Names, email addresses, phone numbers, company information collected through your embedded forms and AI agents.
• Interaction Data: Chat transcripts, voice recordings, form submissions from your website visitors.
• Source Data: Referral URLs, UTM parameters, landing pages.

📝 Note: When you use our lead generation or delegated AI agent features on your website or your clients' websites, you are responsible for informing your visitors that their data will be processed by Opengraphy as a third-party processor in accordance with GDPR Article 28.

To deliver our AI-powered services, we transmit your Content Data to specialized third-party AI providers and service infrastructure. By using Opengraphy, you explicitly consent to this data transfer. We have implemented data processing agreements with these providers where available, and we configure API settings to prevent your data from being used to train their models where such opt-out options exist.

3.1 AI Model Providers

3.2 Infrastructure & Service Providers

🔒 Data Processing Safeguards: We configure API settings to opt-out of training where available, implement encryption in transit (TLS/HTTPS), and only transmit the minimum data necessary for each operation. We do not share your API outputs with third parties beyond what is required to deliver the requested service.

Opengraphy offers integrations with various platforms to publish content, analyze performance, and sync data. When you enable an integration, you authorize us to access and process data from that platform on your behalf. We only access the data necessary for the specific integration features you activate.

4.1 Social Media Integrations

4.2 CMS & E-commerce Integrations

4.3 Analytics & Search Integrations

⚙️ Integration Data Processing: When you enable an integration, we process data from that platform according to the permissions you grant. You can revoke these permissions at any time through Settings → Integrations. Revoking access will stop data syncing but will not delete historical data already imported. We retain integration data as described in Section 9 (Data Retention).

Legal Basis for Processing (GDPR): We process your personal data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b)): To provide our Service, process payments, deliver AI-generated content, and fulfill your subscription.
• Consent (Art. 6(1)(a)): For marketing communications, optional cookies, and third-party AI processing beyond core services.
• Legitimate Interests (Art. 6(1)(f)): To improve our Service, prevent fraud, ensure security, and analyze usage patterns.
• Legal Obligation (Art. 6(1)(c)): To comply with tax laws, accounting requirements, and legal requests.

We Use Your Data To:

• Provide Services: Operate and maintain our platform, generate AI content, analyze brand visibility, manage your account.
• Process Payments: Handle subscriptions, credit purchases, invoicing, and refunds via Stripe.
• Improve & Personalize: Enhance AI models, optimize features, provide recommendations, customize your experience.
• Communicate: Send transactional emails (account, billing, reports), service updates, and marketing (with consent).
• Support: Respond to inquiries, troubleshoot issues, provide technical assistance.
• Security & Fraud Prevention: Detect abuse, prevent unauthorized access, monitor for security threats.
• Analytics: Understand usage patterns, measure feature adoption, improve performance (see Cookie Policy).
• Compliance: Meet legal obligations, respond to legal requests, enforce terms of service.

6.1 Your Responsibilities as Data Controller

When you embed Opengraphy's lead capture or AI agent features on websites, you act as the data controller and Opengraphy acts as the data processor under GDPR Article 28. You must:

• Update Your Privacy Policy: Clearly state that visitor data (names, emails, phone numbers, chat transcripts, voice recordings) will be shared with Opengraphy for lead management and AI processing.
• Obtain Consent: Ensure you have legal grounds (consent, legitimate interest, or contract) to collect and share visitor data with third parties.
• Provide Transparency: Display a clear privacy notice near forms and chat widgets explaining data collection and third-party sharing.
• Honor Data Rights: Facilitate visitor requests to access, rectify, or delete their data (we provide tools in Settings → Leads for this purpose).
• Data Processing Agreement: By using these features, you agree to our Data Processing Addendum (DPA) available at opengraphy.com/dpa.

6.2 How We Process Lead Data

When visitors interact with your Opengraphy-powered forms or AI agents:

• Data Collected: Name, email, phone, company, custom fields, chat transcripts, voice recordings, IP address, referrer URL.
• AI Processing: Lead qualification via Google Gemini, sentiment analysis, intent detection, automatic enrichment.
• Storage: Stored in your Opengraphy organization database (Supabase EU region) accessible via Leads dashboard.
• Retention: Retained until you delete the lead or close your account (see Section 9).
• Third-Party Sharing: Lead data is NOT shared with third parties except as required for AI processing (Gemini, ElevenLabs for voice) and your enabled integrations.

6.3 GDPR Compliance Checklist for Embedded Agents

6.4 Example Privacy Policy Language

We use cookies and similar tracking technologies to enhance your experience, analyze traffic, and ensure security. Full details are available in our Cookie Policy.

Cookie Categories:

• Essential Cookies (Always Active): Authentication, session management, security, CSRF protection. Required for the Service to function.
• Analytics Cookies (Optional): Google Tag Manager (GTM), Google Analytics to understand usage patterns and improve features.
• Marketing Cookies (Optional): Advertising, remarketing, conversion tracking (if you consent).

Manage Your Cookie Preferences:

You can also control cookies through your browser settings. Note that blocking essential cookies may prevent you from accessing certain features of the Service.

If you are a resident of the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following data protection rights under GDPR:

• Right to Access (Art. 15): You can request copies of your personal data. We will provide this within one month.
• Right to Rectification (Art. 16): You can request correction of inaccurate or incomplete personal data.
• Right to Erasure / "Right to be Forgotten" (Art. 17): You can request deletion of your personal data when it is no longer necessary, consent is withdrawn, or you object to processing.
• Right to Restrict Processing (Art. 18): You can request limitation of processing in certain circumstances.
• Right to Data Portability (Art. 20): You can request transfer of your data to another organization or directly to you in a structured, commonly used format.
• Right to Object (Art. 21): You can object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you can withdraw it at any time.
• Right to Lodge a Complaint (Art. 77): You can file a complaint with your local data protection authority (in Belgium: Commission for the Protection of Privacy).

How to Exercise Your Rights:

To exercise any of these rights, contact us at antoine.gounel@opengraphy.com or use Settings → Account → Export Data / Delete Account in the dashboard. We will respond within 30 days.

We retain your data only as long as necessary for the purposes described in this Privacy Policy, or as required by law.

Retention Periods:

• Account Data: Retained while your account is active. Deleted 30 days after account closure (or immediately upon request).
• Generated Content (Library): Retained until you manually delete items or close your account.
• Usage Logs: Retained for 90 days for security and troubleshooting, then aggregated or deleted.
• Billing Records: Retained for 7 years to comply with tax and accounting regulations (Belgium/EU requirements).
• Lead Data: Retained until you delete individual leads or close your account. Anonymized for analytics after 2 years.
• Marketing Consent Records: Retained for 3 years after consent withdrawal to demonstrate compliance.

Note: Some data may be retained in backups for up to 30 days after deletion, but will not be accessible for day-to-day operations.

Opengraphy operates primarily within the European Union (EU). However, some of our third-party AI providers are located outside the EU/EEA, including the United States and other countries. When we transfer data internationally, we ensure adequate safeguards are in place:

• Standard Contractual Clauses (SCCs): We use EU-approved SCCs for transfers to countries without adequacy decisions.
• Data Processing Agreements: All processors handling EU data sign DPAs with appropriate security and privacy commitments.
• Adequacy Decisions: We prioritize providers in countries with EU adequacy decisions (e.g., UK, Switzerland) where available.
• Encrypted Transit: All data transfers use TLS 1.2+ encryption in transit.

Data Locations by Provider:

• Supabase: EU region (Frankfurt, Germany) - GDPR compliant
• Google Gemini: US-based with EU data processing terms
• OpenAI: US-based (California) - Standard Contractual Clauses
• Anthropic Claude: US-based - Standard Contractual Clauses
• RunwayML: US-based (New York) - DPA available
• Kling AI: China-based (Kuaishou) - Limited to video generation only, no sensitive PII transmitted
• ElevenLabs: US-based - Voice data only, short retention
• Stripe: US-based, EU processing available, PCI-DSS Level 1 certified

We implement industry-standard security measures to protect your data:

• Encryption: TLS 1.2+ for data in transit, AES-256 for data at rest (where applicable)
• Authentication: Secure password hashing (bcrypt), multi-factor authentication (MFA) available
• Access Controls: Role-based access (RBAC), least privilege principle, audit logs
• Infrastructure: Supabase Row-Level Security (RLS) policies, regular security audits
• Monitoring: Real-time intrusion detection, automated vulnerability scanning
• Incident Response: We will notify you of any data breach affecting your personal data within 72 hours (GDPR Article 33)

⚠️ Important: While we implement robust security measures, no system is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

Our Service is not intended for children under 16 years of age (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at antoine.gounel@opengraphy.com, and we will delete such information within 30 days.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending email notification to your registered email address
• Displaying an in-app notification banner

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy. If you do not agree with changes, you should discontinue use and close your account.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of personal information collected, used, or sold.
• Right to Delete: Request deletion of personal information (subject to legal exceptions).
• Right to Opt-Out: Opt-out of sale/sharing of personal information (we do not sell your data).
• Right to Correct: Request correction of inaccurate personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights.

To exercise these rights, contact antoine.gounel@opengraphy.com. We will verify your identity and respond within 45 days.