Privacy Policy

WinyMarket AI ("we", "us", or "our") operates the WinyMarket AI Marketing Operating System — an AI-powered platform for content creation, scheduling, and distribution. This Privacy Policy applies to all users of our platform and any related services.

For any privacy-related questions, contact our Privacy Team at: privacy@winymarket.ai

2.1 Information You Provide Directly

• •Account information: Name, email address, and password when you register
• •Profile information: Brand voice guidelines, tone preferences, and other customisation settings
• •Content data: URLs, text, files, and other material you upload to the Content Brain
• •Communication: Messages you send to our support team
• •Payment information: Billing details processed securely through our payment provider (we do not store card numbers)

2.2 Information Collected Automatically

• •Usage data: Pages visited, features used, actions taken, and time spent on the platform
• •Device information: Browser type, operating system, screen resolution, and IP address
• •Session data: Login timestamps, session duration, and authentication events
• •Performance metrics: Analytics data you manually enter about published posts (likes, shares, reach, etc.)

2.3 Information from Third Parties

• •When you connect social media accounts for posting, we receive basic profile information and posting permissions from those platforms
• •Content extracted from URLs you submit is processed and stored to enable our AI features

We use collected information to:

• •Provide the Service: Process your content, generate AI outputs, manage your approval queues and scheduling
• •Personalise your experience: Apply your brand voice guidelines to AI generation, remember your preferences
• •Improve our AI: Your approved content and rejection feedback helps improve generation quality for you (we do not use your data to train shared AI models)
• •Communicate with you: Send account notifications, billing updates, and important service announcements
• •Provide customer support: Respond to your inquiries and resolve issues
• •Ensure security: Detect, prevent, and investigate fraudulent or abusive activity
• •Comply with legal obligations: Respond to lawful requests from authorities and meet regulatory requirements

We process your data on the legal bases of: (a) contract performance — to deliver the Service you signed up for; (b) legitimate interests — to improve the platform and ensure security; and (c) your consent — where explicitly given.

When you use AI generation features, your source content and preferences are sent to Anthropic's API for processing. This processing is subject to Anthropic's usage policies and data handling practices. We encourage you to review Anthropic's Privacy Policy.

Important: Do not upload content containing sensitive personal data (health records, financial details, government IDs, or similar) to the Content Brain. The platform is designed for marketing content only.

Generated content created by the AI, along with your edits and approval decisions, is stored in your account to power the learning feedback loop that improves future content quality specifically for you.

We do not sell your personal data. We share your information only in the following circumstances:

• •Service providers: Trusted vendors who help us operate the platform (hosting, payment processing, email delivery). All providers are bound by data processing agreements.
• •AI providers: Content submitted for AI processing is sent to Anthropic. See Section 4 above.
• •Social platforms: When you use posting features, content is shared with the relevant social media platform via their official APIs.
• •Team members: Within your organisation, content and analytics are visible to users with appropriate roles (Admin, Staff).
• •Legal compliance: If required by law, court order, or government authority, or to protect the rights, property, or safety of WinyMarket AI, our users, or the public.
• •Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different Privacy Policy.

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• •Account data: Retained for the lifetime of your account, plus 90 days after deletion to allow for account recovery
• •Content Brain items: Retained until you archive or delete them (Admin permission required for deletion)
• •Generated posts: Retained indefinitely to support analytics and AI learning, unless you request deletion
• •Analytics data: Retained for 24 months to support trend analysis
• •Login logs: Retained for 90 days for security purposes

When your account is deleted, we will delete or anonymise your personal data within 30 days, except where retention is required for legal compliance.

We use the following types of cookies and storage mechanisms:

• •Session cookies: Essential for maintaining your authenticated session. These cannot be disabled without breaking the Service.
• •Preference cookies: Remember your settings and UI preferences between visits
• •Analytics cookies: Help us understand how the platform is used in aggregate (no third-party advertising cookies)

You can control cookies through your browser settings, but disabling session cookies will prevent you from staying logged in.

We implement industry-standard security measures to protect your data:

• •All data transmitted between your browser and our servers is encrypted using TLS/HTTPS
• •Passwords are hashed using bcrypt with appropriate salt rounds — we never store plain-text passwords
• •Authentication tokens use cryptographically signed JWTs with a rolling expiry
• •Database access is restricted to authorised systems and personnel only
• •Regular security reviews and dependency updates are performed

Despite our best efforts, no security system is impenetrable. In the event of a data breach affecting your personal data, we will notify you in accordance with applicable law.

Depending on your location, you may have the following rights regarding your personal data:

• •Access: Request a copy of the personal data we hold about you
• •Correction: Request correction of inaccurate or incomplete data
• •Deletion: Request deletion of your personal data, subject to legal retention requirements
• •Portability: Receive your data in a structured, machine-readable format
• •Restriction: Request that we limit processing of your data in certain circumstances
• •Objection: Object to processing based on legitimate interests
• •Withdrawal of consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at privacy@winymarket.ai. We will respond within 30 days.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at privacy@winymarket.ai and we will delete it promptly.

WinyMarket AI operates primarily in Kenya. Your data may be processed by our service providers in other countries. When we transfer data internationally, we ensure appropriate safeguards are in place in accordance with applicable data protection law.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• •Updating the effective date at the top of this page
• •Sending an email notification to your registered address for significant changes
• •Displaying a notice on the platform

Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

For any privacy questions, data requests, or concerns, please reach out to us: