Privacy Policy

WinyMarket AI ("we", "us", or "our") operates the WinyMarket AI Marketing Operating System — an AI-powered platform for content creation, scheduling, and distribution, available at https://winymarket.com. We are the data controller in respect of personal data processed through this platform.

Data Controller: WinyMarket AI, Kenya
Privacy Contact: support@winymarket.com

We aim to respond to all privacy-related enquiries within 30 days of receipt. For urgent data breach concerns, please mark your email subject "URGENT — DATA BREACH".

This Privacy Policy applies to all users of the WinyMarket AI platform and is written to comply with:

• •Kenya Data Protection Act 2019 (DPA 2019) — our primary applicable legislation as a Kenya-based operator
• •EU General Data Protection Regulation (GDPR) — to the extent we process personal data of individuals in the European Economic Area
• •UK GDPR — to the extent we process personal data of individuals in the United Kingdom
• •Children's Online Privacy Protection Act (COPPA) — governing our obligations in respect of children under 13 in the United States

Additionally, our service is designed for business use and requires users to be at least 18 years old to create an account. By registering, you represent and warrant that you are 18 or older.

If you have reason to believe that a child under 13 has provided us with personal data, please contact us immediately at support@winymarket.com. We will delete such data promptly upon verification without requiring a formal written request.

We do not seek parental consent to collect data from children under 13 because our service is not directed at children and we actively prohibit their use of the platform.

4.1 Information You Provide Directly

• •Account information: Name, email address, and hashed password when you register
• •Profile information: Brand voice guidelines, tone preferences, and other customisation settings you configure
• •Content data: URLs, text, uploaded files, images, and other material you add to the Content Brain
• •Support communications: Messages and attachments you send to our support team
• •Payment information: Billing details processed securely by PayPal — we never see or store your full card number or banking credentials

4.2 Information Collected Automatically

• •Usage data: Pages visited, features used, actions taken (e.g., content approval, scheduling), and time spent
• •Device information: Browser type, operating system, screen resolution, and IP address
• •Authentication logs: Login timestamps, session events, 2FA events, and failed login attempts
• •Performance metrics: Post analytics data you manually enter (likes, shares, reach, etc.)
• •Error data: Crash reports and error traces captured by Sentry to help us fix bugs

4.3 Data We Do Not Collect

• •We do not collect government IDs, passport numbers, or national identification numbers
• •We do not collect health or medical data
• •We do not collect biometric data
• •We do not build advertising profiles or sell your data to third parties

Important: Do not upload content containing sensitive personal data (health records, financial account details, government IDs) to the Content Brain. The platform is designed for marketing content only. If such data is inadvertently uploaded, contact us to request deletion.

We process your personal data only where we have a lawful basis to do so. The table below sets out our processing activities and the applicable legal basis:

When you use AI generation features, your source content and preferences are transmitted to Anthropic's Claude API for processing. We recommend reviewing Anthropic's Privacy Policy.

• •Your content is sent to Anthropic solely to generate the requested output — not for general model training
• •Generated outputs and your approval or rejection decisions are stored in your account to improve future content quality for your brand voice specifically
• •We do not use your content to train shared or public AI models
• •You retain ownership of all content you upload and all AI-generated outputs produced from your inputs

We do not sell your personal data. We share your information with the following sub-processors, all of whom are bound by appropriate data processing agreements:

Social media platforms: When you use scheduling and publishing features, approved content is sent to the relevant platform (Facebook, Instagram, Twitter/X, LinkedIn, TikTok, YouTube) via their official APIs. Each platform's own privacy policy governs their processing.

We review our sub-processor list regularly and will update this policy when processors change. We will notify you of significant processor changes by email.

WinyMarket AI is operated from Kenya. Most of our sub-processors are located in the United States. When we transfer personal data internationally, we rely on the following safeguards:

• •Standard Contractual Clauses (SCCs): For transfers from the EEA/UK, we use the European Commission's approved SCCs incorporated into our Data Processing Agreements with each sub-processor
• •Kenya DPA 2019 cross-border compliance: We assess each sub-processor's data protection standards under DPA 2019 Section 48 before transferring data to them, and ensure they provide an adequate level of protection
• •Data minimisation: We transfer only the minimum data necessary for the specific processing purpose

You may request a copy of the relevant transfer safeguards by contacting support@winymarket.com.

We retain your data only as long as necessary for the stated purpose or as required by law:

When your account is deleted, we will permanently delete or irreversibly anonymise all personal data within 30 days, except where retention is required by law. You will receive a deletion confirmation by email.

We implement the following technical and organisational security measures, aligned with SOC 2 Trust Service Criteria:

Confidentiality

• •All data in transit is encrypted using TLS 1.2 or higher (HTTPS enforced via HSTS preload)
• •Passwords are hashed using bcrypt with a minimum of 12 salt rounds — we never store or transmit plain-text passwords
• •Authentication tokens are cryptographically signed JWTs with rolling expiry and token-version invalidation on logout or password change
• •Database access is restricted to authorised systems via network-level access controls
• •API keys and secrets are stored as encrypted environment variables in Vercel — never committed to source code

Availability

• •Platform is hosted on Vercel's global edge network with automatic failover
• •Database is hosted on Railway with automatic daily backups
• •Uptime monitoring is active with immediate alerting on downtime
• •We target 99.5% monthly uptime, excluding planned maintenance windows

Processing Integrity

• •All API routes include input validation and schema enforcement
• •Rate limiting is enforced via Upstash Redis sliding-window algorithm to prevent abuse
• •Role-based access control prevents users from accessing data beyond their permissions
• •A human-in-the-loop content approval workflow runs before any AI-generated content is published

Incident Response and Breach Notification

• •Security incidents are monitored continuously via Sentry error tracking
• •In the event of a personal data breach, we will notify affected individuals and relevant supervisory authorities within 72 hours of becoming aware, as required by GDPR Article 33
• •Breach notifications will include: nature of the breach, categories and approximate number of affected individuals, likely consequences, and remediation measures taken
• •For Kenya DPA 2019 notifications, we will comply with the procedures prescribed by the Office of the Data Protection Commissioner (ODPC)

We use only essential and functional cookies. See our full Cookie Policy for complete details. In summary:

• •Essential cookies: Authentication session (HttpOnly, Secure, SameSite=Lax) and CSRF protection — cannot be disabled without breaking the service
• •Functional storage: UI preferences in localStorage — never transmitted to third parties
• •No advertising cookies: We use zero third-party advertising, retargeting, or cross-site tracking cookies

You have the following rights in respect of your personal data. We will respond to all valid requests within 30 days (extendable by a further 60 days for complex requests, with advance notice):

We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive. We may need to verify your identity before processing a request.

Kenya Supervisory Authority: You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

We may send you product updates and feature announcements by email. You may opt out at any time by:

• •Clicking the unsubscribe link in any marketing email
• •Emailing support@winymarket.com with subject "Unsubscribe"

Opting out of marketing emails will not affect transactional emails (account verification, password reset, billing notifications) which are necessary for the service.

We may update this Privacy Policy to reflect changes in our practices or applicable legal requirements. We will notify you of material changes by:

• •Updating the effective date at the top of this page
• •Sending an email notification to your registered address, at least 14 days before significant changes take effect
• •Displaying an in-platform notice

For changes that materially affect your rights or how we use your data, we will seek fresh consent where required by law.

For any privacy questions, data requests, complaints, or concerns, please contact us: