Privacy Policy

1. Data We Collect

The data we collect depends on how you interact with the Service. We do not collect shipping addresses, phone numbers, or passwords — authentication is handled via third-party OAuth providers.

2. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

• Performance of a contract — Processing necessary to provide the Service to you, including account management, content generation, post scheduling, and billing.
• Consent — Where you have given specific consent, such as for marketing communications or non-essential cookies. You may withdraw consent at any time.
• Legitimate interests — For purposes such as improving the Service, analytics, fraud prevention, and security monitoring, where our interests do not override your rights and freedoms.
• Legal obligation — Where we are required to retain data for tax, accounting, or regulatory purposes.

3. How We Use Your Data

• Service delivery — Generating AI content, scheduling posts, displaying analytics, managing credits and subscriptions.
• Account management — Authentication, profile management, and customer support.
• Communications — Transactional emails (post approvals, subscription confirmations, cancellation receipts) and, with your consent, marketing communications.
• Analytics and improvement — Understanding how the Service is used, identifying errors, and improving features.
• Security — Rate limiting, fraud prevention, and abuse detection.

4. Third-Party Data Processors

We share your data with the following third-party service providers who process it on our behalf:

5. International Data Transfers

Some of our third-party processors are based outside the United Kingdom, primarily in the United States (including Vercel, Stripe, Sentry, and Resend). Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:

• Transfers to countries with an adequacy decision from the UK Secretary of State.
• Standard Contractual Clauses (SCCs) approved by the Information Commissioner's Office (ICO).
• The processor's binding corporate rules or equivalent safeguards.

6. Data Retention

We retain your personal data as follows:

• Active account — Data is retained for the duration of your account.
• After cancellation — Your Instagram connection is disconnected immediately. Scheduled posts are cancelled and credits are zeroed. Brand settings and content history are retained for 30 days to allow reactivation, then permanently deleted.
• Billing records — Retained for up to 7 years as required by UK tax and accounting law.
• Error and analytics data — Automatically expired according to each processor's retention policy (typically 30–90 days).

You may request deletion of your data at any time by contacting support@fulcrank.com.

7. Automated Decision-Making and AI

Fulcrank uses artificial intelligence to generate content suggestions (captions, images, and videos) based on your brand data and content preferences. This is automated processing, but it does not produce legal or similarly significant effects — by default, generated content is published automatically on your chosen schedule. You may enable an optional approval mode so that each post requires your explicit approval via email before it goes live. You always have full control over your publishing preferences.

8. Cookies

We use cookies and similar technologies for essential functionality (such as authentication sessions) and, with your consent, for analytics and error monitoring. For full details on the cookies we use and how to manage your preferences, see our Cookie Policy.

9. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete personal data.
• Right to erasure — Request deletion of your personal data, subject to legal retention requirements.
• Right to restrict processing — Request that we limit the processing of your personal data in certain circumstances.
• Right to data portability — Receive your personal data in a structured, commonly-used, machine-readable format.
• Right to object — Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@fulcrank.com. We will respond within one month of receiving your request.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay, providing details of the breach and the steps we are taking.

11. Children

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@fulcrank.com and we will delete the data promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. We will post the updated policy on this page and update the “Last updated” date. For material changes, we will notify you by email or through a notice on the Service at least 30 days before the changes take effect.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

Fulcrank
Email: support@fulcrank.com

You also have the right to contact the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection, at ico.org.uk.