Legal
Privacy Policy
Last updated: May 25, 2026
We take your privacy seriously. This policy explains exactly what data we collect, why we collect it, who can see it, and how to delete it. We use plain language so you can actually read it.
1. Information We Collect
When you create an account, we collect your name, email address, and authentication credentials. When you use the Service, we collect the configurations, creator usernames, and content briefs you create. If you connect a messaging channel (WhatsApp Business or Instagram), we collect the messages, account name, and access credentials for that channel. We do not collect any data beyond what is required to operate the Service.
2. Meta Platform Data (WhatsApp & Instagram)
IntentOS integrates with the official Meta Business APIs to provide inbox functionality. When you connect your WhatsApp Business Account or Instagram Business Account, we access: (a) messages sent to your connected business account, (b) your business account name and identifier, (c) a Meta-issued access token that allows us to send replies on your behalf. We use this data solely to display messages in your IntentOS inbox and to send replies you compose. We do not use Meta platform data for advertising, profiling, or any purpose beyond delivering the inbox feature. We do not share Meta platform data with any third party. You can disconnect any channel at any time from the IntentOS inbox, which immediately revokes our access and deletes your message history. To delete all stored data, see the Data Deletion section below or visit intentos.eu/data-deletion.
3. Public Social Media Data
IntentOS also analyzes publicly available content from third-party platforms (TikTok, Instagram public profiles) for the Research module. This data is the same data any user can see by visiting a public profile. We do not access private accounts or private messages through this module.
4. How We Use Your Data
Your data is used solely to deliver the Service: storing your configurations, returning your AI analyses, displaying your inbox messages, and authenticating you across sessions. We do not sell, rent, or share your personal data with third parties for marketing purposes.
5. Third-Party Processors
We use the following processors to deliver the Service: Supabase (database and authentication), Vercel (hosting), Meta (WhatsApp Business API and Instagram Messaging API), Apify (data collection from public social platforms), Google Gemini (video analysis), Kimi by Moonshot AI (concept generation), and Resend (transactional email). Each is contractually bound to handle your data only as needed for the Service.
6. Data Storage and Security
Your data is stored on encrypted servers in EU data centers (operated by Supabase and Vercel). We use row-level security to ensure each user can access only their own data. All connections use TLS 1.2 or higher. Account passwords are hashed and never stored in plain text.
7. Your Rights (GDPR)
You have the right to access your personal data, request correction or deletion, restrict processing, and receive a portable copy of your data. To exercise any of these rights, email privacy@intentos.eu. We respond within 30 days.
8. Cookies
IntentOS uses only essential cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics that profile users. We may add privacy-respecting analytics (such as Plausible or self-hosted PostHog) in the future.
9. Data Deletion
You can delete your data at any time: (1) From the dashboard — Settings → Delete Account removes all your data immediately. (2) From the inbox — click Disconnect next to any channel to delete that channel's message history. (3) By email — send a request to privacy@intentos.eu and we will process it within 30 days. Full details at intentos.eu/data-deletion.
10. Data Retention
We retain your account data for as long as your account is active. When you delete your account, all associated configurations, creators, scraped videos, and concepts are permanently deleted within 30 days. Backups are rotated within 90 days.
11. Children
IntentOS is not intended for users under 16. We do not knowingly collect data from minors. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
12. Changes to This Policy
We will notify you of material changes to this policy via email. Continued use of the Service after changes constitutes acceptance.
13. Contact
For privacy questions, contact privacy@intentos.eu. For general inquiries, hello@intentos.eu.