1. Scope
This Policy covers information we collect through the Service, including information you provide directly, information generated while Agents work for you, information from Connected Accounts you authorize, and technical information from your use. It does not cover third-party platforms (such as Google, YouTube, TikTok or Stripe), which have their own privacy policies.
2. Information we collect
Depending on how you use the Service, we may collect:
- Account identity: your name, e-mail address, profile information from your sign-in provider (for example Google sign-in), authentication identifiers, and your platform role and access status.
- Organization and business context: the business profile you provide (name, description, industry, website, markets, audiences, positioning, restrictions and approved claims) and the sources you import, including content from your own public website and the verification state you assign to it.
- Products and services context: the products or services you describe, their attributes, and related sources.
- Mission and task data: the goals you submit, derived intents and constraints, plans, tasks, runs, Agent outputs and drafts, publication proposals, and the approvals you grant or reject.
- Connected account metadata: the provider, the account, channel or profile identifier and display name (for example a YouTube channel id or a TikTok open id), the OAuth scopes you granted, connection status and health, timestamps of connection, refresh and health checks.
- OAuth tokens: access and refresh tokens issued by the provider when you authorize a connection. They are stored server-side in encrypted form and are never shown in the app.
- Analytics data you request: read-only channel or profile statistics (for example subscriber, follower, view or like counts) that you ask an Agent to read from a Connected Account.
- Billing and subscription metadata: your plan, subscription status and period, Stripe customer and subscription identifiers, credit balances, manual-payment references and payout information for referrals. Card details are collected and stored by Stripe, not by us.
- Support interactions: messages and requests you send us and our responses.
- Audit and security logs: authority decisions, delegations, Kill Access events, approvals, Action Receipts, connection lifecycle events, provider invocations and related correlation identifiers.
- Device and technical data: IP address, browser and device information, language preference, timestamps, and error diagnostics, collected by our hosting, authentication and error-reporting infrastructure.
3. How we use information
We use information to:
- provide, operate, secure and support the Service and your workspace;
- authenticate you and enforce access, plan entitlements and tenant isolation;
- run Missions: research, analysis, planning and drafting by Agents, grounded in your Business Context;
- enforce human authority through EHIP, record authority decisions, request and record your approvals, and honor Kill Access;
- execute the actions you authorize and approve on Connected Accounts, such as uploading a video you approved to your channel, and read analytics you request;
- issue Action Receipts and maintain the audit trail that proves what happened, under whose authority, and with what result;
- bill subscriptions, meter credits, process referral rewards and prevent fraud;
- communicate with you about the Service, approvals, security and support;
- diagnose errors, monitor performance and improve the Service;
- comply with law, enforce our Terms and protect rights, safety and property.
4. Lawful and business purposes
We process information because it is necessary to perform our contract with you (providing the Service), to comply with legal obligations, for our legitimate interests (securing and improving the Service, preventing abuse, and documenting authority and actions), and, where required, on the basis of your consent — for example when you authorize a Connected Account, which you can withdraw by disconnecting it.
5. AI processing and model providers
To run Missions, the Service sends relevant inputs — such as your goal, the relevant portion of your Business Context with its provenance labels, and prior Agent output — to AI model providers (for example Anthropic, and other providers such as OpenAI or Google when configured for the task). Providers process these inputs to generate output and may retain them according to their own terms; we use business API access designed for service use rather than consumer chat products. We send only what a task needs, never your OAuth tokens or payment details, and provenance labels travel with the data so Agents keep verified facts distinct from external research and their own inference.
Research Agents may perform public web searches through a provider's search tool; retrieved web content is treated as data and is never treated as instructions or authority.
7. Connected accounts and third-party platforms
When you connect a third-party account, the provider asks you to grant specific permissions (scopes). We use the resulting access only for the features you use: identifying the account, verifying the connection's health and capabilities, publishing content you approve, and reading analytics you request. Tokens are encrypted at rest with a server-side key, are never sent to your browser, never logged, never included in receipts or audit metadata, and are deleted when you disconnect the account. We do not sell tokens or connected-account data.
Disconnecting an account in the Service removes our stored tokens; you can also revoke the Service's access in the provider's own settings at any time.
8. Google API Services (Google sign-in, Google account and YouTube)
The Service uses Google APIs only after you authorize them, and only within the scopes you grant. For the YouTube connection these are: youtube.readonly (channel identity and statistics), youtube.upload (uploading videos you approve to your channel) and yt-analytics.readonly (your channel's analytics). Google sign-in uses basic profile and e-mail scopes to authenticate you.
We use Google user data to provide the user-facing features you request: showing which channel is connected, verifying the connection, publishing the exact videos you approve with the visibility you choose, and displaying analytics you ask an Agent to read. We do not use Google user data to serve advertisements, and we do not sell it. Humans at Equilibre do not read your Google user data except with your consent, to resolve a security or support issue you raise, to comply with law, or for internal operations where the data has been aggregated or anonymized.
Equilibre Intelligence's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke the Service's access at any time from your Google Account permissions page (myaccount.google.com/permissions) and you can disconnect YouTube from the Connections page of the Service, which deletes the stored tokens.
9. TikTok API
TikTok access occurs only after you authorize it through TikTok's login flow and only within the scopes you grant (basic account information, read-only account statistics, listing your own videos, and publishing videos you approve). We use TikTok data to identify the connected account, check posting eligibility and allowed visibility, publish the exact posts you approve, confirm their processing status, and display analytics you request. Whether publication is possible depends on the permissions granted, your account's eligibility and TikTok's review of our application; we report these limits rather than pretending a capability exists.
You remain responsible for content you approve and publish. You can disconnect TikTok from the Service at any time (deleting stored tokens) and revoke access from your TikTok settings. We do not guarantee TikTok API availability.
10. Payments (Stripe)
Card payments are processed by Stripe. Stripe collects and stores your payment details under its own privacy policy; we receive customer and subscription identifiers, plan and status information, and webhook events needed to activate and maintain your subscription. For manual payment methods we store the payment reference you submit and the decision made on it.
11. Infrastructure and service providers
We rely on service providers that process information on our behalf, under contracts that restrict their use of it:
- Supabase — database, authentication and storage for the Service, with row-level security enforcing workspace isolation;
- hosting and content-delivery providers that serve the application;
- AI model providers, as described above, when a Mission requires them;
- Stripe for payments;
- an e-mail delivery provider for notifications and account e-mails;
- error-reporting and monitoring tools that receive technical diagnostics.
13. Data retention
We keep account, workspace and Business Context data for as long as your account is active. OAuth tokens are kept only while a Connected Account remains connected and are deleted on disconnect. Authority decisions, delegations, approvals, Kill Access events, Action Receipts and audit events are retained as durable records for as long as needed to document authority and actions, meet legal, accounting and security requirements, and resolve disputes. Billing records are kept as required by tax and accounting law. Technical logs are kept for a limited period for security and diagnostics. When data is no longer needed we delete or de-identify it.
14. Security
We protect information with measures appropriate to its sensitivity: encryption in transit; OAuth tokens encrypted at rest with a server-side key and never exposed to the browser; secrets and provider keys held only in server configuration; server-side derivation of your organization and identity from the authenticated session (never trusted from the browser); workspace isolation enforced in the application and with database row-level security; EHIP gating of every protected action; single-use, signed OAuth state; and an append-only audit trail. No system is perfectly secure; if you believe your account or data has been compromised, contact us immediately at contact@equilibrellc.com.
15. Your rights and choices
Subject to applicable law, you may access, correct, export or delete personal information we hold about you, object to or restrict certain processing, and withdraw consent where processing is based on it. You can edit your Business Context and products in the Service, disconnect Connected Accounts at any time, revoke provider access from the provider's settings, change your language preference, and manage your subscription. To exercise a right, contact contact@equilibrellc.com from the e-mail address associated with your account; we may verify your identity before acting. If you are in a jurisdiction with a supervisory authority, you may also lodge a complaint with it.
16. Account deletion
You may request deletion of your account and workspace data by contacting contact@equilibrellc.com or through any deletion control we provide in the Service. We will delete or de-identify your personal information within a reasonable period, except for records we must retain as described in the retention section (for example audit and authority records, billing records and security logs), which are kept only for those purposes and protected accordingly.
17. International transfers
Equilibre is based in the United States and our providers may process information in the United States and other countries. Where required, we use appropriate safeguards for international transfers, such as contractual protections with our providers.
18. Children
The Service is not directed to children and is intended for users who are at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
19. Changes to this Policy
We may update this Policy from time to time. The effective date at the top of this page shows when the current version took effect. For material changes we will provide reasonable notice, for example in the Service or by e-mail. Your continued use of the Service after a change takes effect means you accept the updated Policy.