Privacy Policy

Version and validity

• Version and effective date: 30 October 2026
• Last updated: 30 October 2026
• Issued by: CS Digital Wonders LLC ("CS Digital Wonders", "we", "us"), a limited liability company organized under the laws of the State of Wyoming, USA, which operates SemPost. Address: 30 N Gould St Ste N, Sheridan, WY 82801, USA.
• How we announce changes: before a material change takes effect, we tell you by email . Smaller changes, such as clearer wording, are listed in the "Changes" section at the end of this page. Section 26 explains this in full.
• Languages: this policy is published in English (/legal/privacy) and in Turkish (/tr/legal/privacy) with the same content. If the two differ, the Turkish version prevails for people who live or are established in Turkey and the English version for everyone else, as in our Terms of Service.

1. Summary

• SemPost turns products from your store, or from any product page address you give us, into social media posts, pictures, videos and music. It schedules or publishes them on the social accounts you connect.
• For your account, sign-in, security, billing records and the emails we send, we decide how your data is used. For this data we are the controller.
• For the content in a workspace (products, posts, media, data of connected social accounts) we act on the instructions of the workspace's customer. For this data we are a processor (section 5).
• We do not sell personal data. We do not use it for advertising. We do not train AI models on it.
• Our servers are in the United States. Some of our service providers work in other countries (section 15).
• You can delete your account and your workspace and download your data in the app , or ask us by email (sections 18 and 19).
• For privacy questions write to [email protected].

2. Your right to object

Where we process your personal data on the basis of our legitimate interests, you have the right to object at any time, on grounds relating to your particular situation. Section 6 marks each of these uses with "legitimate interests". If you object, we stop, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

We do not use personal data for direct marketing today. If we ever do, you can object at any time, without giving reasons, and we will stop.

To object, write to [email protected]. Section 18 lists your other rights.

3. Who we are and how to contact us

• Controller: CS Digital Wonders LLC, a limited liability company organized under the laws of the State of Wyoming, USA.
• Privacy questions and requests: [email protected]
• Support: [email protected]
• Legal notices, and requests from authorities: [email protected]
• Security problems: [email protected]
• Postal address, also for written requests: CS Digital Wonders LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA
• European Union and United Kingdom: please contact us directly, at [email protected] or at our postal address.
• Turkey: people in Turkey can also read our KVKK Information Notice and apply through our KVKK Application Form.
• Data protection officer: we have not appointed one. Please send privacy questions and requests to [email protected].

4. What this policy covers and terms we use

Services. This policy covers:

• the SemPost app at app.sempost.ai;
• the Shopify app "SemPost: AI Social Media Posts", which runs inside Shopify admin from embed.sempost.ai;
• our website www.sempost.ai, with its help center at www.sempost.ai/docs (docs.sempost.ai leads there);
• the emails we send;
• admin.sempost.ai, the administration site that only our staff use.

People. It covers:

• customers and the members of their workspaces ("users");
• people who are invited to a workspace;
• Shopify store owners and staff who open SemPost from Shopify admin;
• anyone who types an email address into our sign-up, sign-in or password forms;
• visitors to our websites;
• people who contact us;
• people whose data appears in content that our customers process with SemPost (section 8).

Not covered. Social networks, Shopify, Link (Stripe), and the stores and websites you connect have their own privacy policies. This policy does not cover what they do with data under those policies.

Terms we use:

• Workspace: the shared space in SemPost where a team works. Each workspace has at least one owner.
• Customer: the person or business that holds a workspace.
• Member: a user who belongs to a workspace, with one of the roles viewer, editor, admin or owner.
• Global Admin: our staff who operate SemPost through the separate administration site.
• Zernio: the social API gateway through which SemPost connects to social networks.
• Link: the Stripe service that sells SemPost plans and credit packs on our website as the merchant of record.
• Personal data: any information about an identified or identifiable person.

5. Our role: controller or processor

A controller decides why and how personal data is processed. A processor processes personal data on behalf of a controller and on its instructions.

Where we are a processor, the customer decides why and how the data is processed, and the customer's own privacy notice applies. Our Data Processing Agreement sets out our duties to the customer. If your data is in a customer's content and you want to use your rights, please contact that customer. If you contact us, we will pass your request to the customer, or answer it ourselves where we are the controller.

6. The personal data we process

For each category below we explain the data, the purpose, the legal basis, where the data comes from, who receives it and how long we keep it. Section 14 lists the recipients in full and section 16 lists all retention periods.

Legal bases. We use these terms:

• Contract: the processing is needed to provide the service you signed up for, or to take steps you ask for before signing up (GDPR Art. 6(1)(b); KVKK m.5/2-c).
• Legal obligation: a law requires the processing (GDPR Art. 6(1)(c); KVKK m.5/2-ç).
• Legitimate interests: the processing is needed for our legitimate interests, or those of the customer, and these are not overridden by your interests, rights and freedoms (GDPR Art. 6(1)(f); KVKK m.5/2-f). We name the interest each time. You can object (section 2).
• Legal claims: the processing is needed to establish, exercise or defend a right (KVKK m.5/2-e; under the GDPR we rely on legitimate interests for this).
• Consent: you have agreed (GDPR Art. 6(1)(a); KVKK m.5/1). We do not rely on consent for any processing described in this policy today.

6.1 Account

• Data: email address; name; interface language; theme; password, stored only as an Argon2id hash; account status; failed sign-in counters and lock state; last sign-in time; when your email was verified; when you accepted the Terms of Service and which version; which announced change to the Terms we last emailed you about.
• Purpose: to create your account, let you sign in, show the app in your language and theme, and contact you about your account.
• Legal basis: contract.
• Source: you, through the sign-up form or when you accept an invitation. For Shopify, see section 11.
• Recipients: our hosting and email providers. Cloudflare Turnstile receives a check token and your IP address when a form runs the bot check (section 6.3).
• Retention: until you delete your account .
• Good to know:
  • If someone tries to sign up with an email address that already has an account, we send that address an "account exists" email and do not create a second account.
  • You cannot sign in until you verify your email address.
  • When you choose a password, we check whether it appears in known data breaches using the Have I Been Pwned service. We send only the first five characters of a one-way (SHA-1) hash of the password, never the password itself.
  • You can change your name, interface language and theme in your profile. To correct anything else, such as your email address, contact us.

6.2 Two-factor authentication

• Data: the secret for your authenticator app, stored encrypted; ten recovery codes, stored only as keyed hashes; records that stop a code from being used twice.
• Purpose: to protect your account with a second step at sign-in.
• Legal basis: contract; legitimate interests (keeping accounts secure) where a workspace requires two-factor authentication for its members.
• Source: you.
• Retention: deleted when you turn off two-factor authentication or delete your account.

6.3 Sessions, sign-in security and abuse prevention

• Data:
  • Sessions: IP address; browser information (the user agent, up to 300 characters); when the session started and was last used; when it ends or was ended. We store only a one-way (SHA-256) hash of the session token. An app session ends after 7 days without use, and after 30 days at most.
  • Login attempts: the email address typed in (also when no account uses it), IP address, browser information, whether the attempt succeeded and why it failed.
  • Email link tokens: the email address, the purpose and a hash of the token. Verification links work for 48 hours; password reset links for 1 hour.
  • Short-lived security records in memory: IP address or email address for rate limits (up to 1 hour); a hash of the email address for counting failed sign-ins (15 minutes); temporary tokens for the second sign-in step (5 minutes).
  • Bot check: Cloudflare Turnstile runs on sign-up, on sign-in after 3 failed attempts, on the forgot-password, reset-password and resend-verification forms, when you accept an invitation, and on the admin sign-in. Cloudflare receives the check token and your IP address.
• Purpose: to keep accounts and the service secure, to detect and stop password guessing and abuse, and to let you see and end your sessions.
• Legal basis: contract (sessions); legitimate interests (protecting accounts and the service against unauthorised access and abuse); legal obligation where a law requires us to keep traffic data.
• Source: you and your browser, automatically.
• Recipients: Cloudflare (bot check); our hosting provider.
• Retention: sessions that expired or were ended: 30 days ; login attempts: 90 days ; email link tokens: 7 days after they expire ; records in memory expire by themselves.
• Good to know: after 10 failed sign-ins an account is locked for 15 minutes, and for longer after each further lock. A password reset or change ends your other sessions. In the app you can see your sessions (IP address and browser) and end one session or all others.

6.4 Workspace, team and invitations

• Data: workspace name, language, time zone and country (country is optional); who created the workspace; plan and trial dates; subscription status (section 6.9); memberships and roles; invitations: the invitee's email address, the role offered, who sent the invitation, a hash of the invitation token and its expiry (7 days).
• Purpose: to run the workspace and apply its plan limits; to let owners and admins manage the team; to decide which features are available in the workspace's region. Some features depend on the region, for example comment-to-DM. We take the region from the workspace's country or, if no country is set, from its time zone.
• Legal basis: contract; for invitees, legitimate interests (letting a workspace invite the people it works with).
• Source: you; for an invitee's email address, the member who sends the invitation.
• Recipients: our email provider. The invitation email shows the inviting member's name and email address and the workspace name.
• Retention: workspace data until the workspace is deleted ; invitations 30 days after they are accepted, withdrawn or expire .

6.5 Store connections and product data

• Data:
  • Store connection: the store's address, connection type, Client ID, the secret and access tokens (encrypted), the permissions granted and the currency.
  • Product data: product titles, descriptions, prices, images, stock, discounts, and the product's ID or page address; for automation rules, the daily price of the products a rule uses and details of store events (product title and image); the product a video project is about.
  • Imported product pages: the page address and what we read from it. For each website we keep a one-way digest of its host name, whether it is one of your stores, and a monthly count. This lets our staff see how many different stores a workspace creates content for.
• Purpose: to read your products and create content from them.
• Legal basis: contract. For personal data that appears in product content, we act as processor (section 5).
• Source: your store (Shopify, your own Shopify app, WooCommerce) through its interface for apps; public product pages whose address you give us.
• How we read:
  • Shopify: we ask only for permission to read products, inventory and discounts, and optionally markets, publications, languages and translations. We never ask for customer or order data (section 11).
  • WooCommerce: a read-only key, or the public Store API without a key.
  • Product pages: only public https addresses. Our server reads the page and up to two related addresses on the same site. It identifies itself as "SemPostBot/1.0". The website sees our server's IP address, not yours. We refuse Etsy pages, because Etsy's rules do not allow reading them.
  • Product lists are kept in a cache for up to 10 minutes.
• Retention: keys and tokens until you disconnect the store; product data while the workspace exists. Both are deleted with the workspace.

6.6 Content you create and publish

• Data: AI-generated text, images, videos and voiceovers; files you upload; posts (text, media and options such as the first comment, link and UTM tags, comment-to-DM settings and message text); who created, approved or reviewed a post and review notes; scheduled time; the link to the published post; errors; a log of each post's status changes ("post events"); brand settings (brand name, voice, banned words, hashtags, logo); automation rules and their run history; which music track was used in which video; consent and confirmation records (section 6.12).
• Purpose: to create, review, schedule and publish content, to show its history and to keep your settings. We record which music track is used in which video so that we can find every video concerned if a copyright claim is made.
• Legal basis: contract. For personal data in content we act as processor (section 5).
• Source: you and your team; AI providers (the outputs); your store.
• Recipients: AI providers (section 13); Zernio and the social networks you publish to; Cloudflare R2, where media is stored.
• Uploads: we re-encode uploaded images and remove their embedded metadata, such as camera details and location. Videos are converted to at most 1080p.
• Storage: media is kept in a private storage bucket and opened only through short-lived links: 5 minutes in the app, 1 hour for AI providers, 24 hours for the backup gateway. Media uploaded to Zernio for publishing may be reused there for up to 6 days.
• Content Credentials: files made with AI carry a C2PA record signed by SemPost. The record states that SemPost created the file, whether it is fully or partly AI-generated, and a title. Anyone can read the record once the file is public, for example at contentcredentials.org/verify. When a post contains AI-generated media, we also tell the network, so it can show its AI label. Our AI Content Policy explains this.
• Retention: content while the workspace exists; you can delete posts that have not been sent; media as set out in section 16. Post events are kept after the workspace is deleted, for as long as the accounting and tax laws that apply to us require records to be kept, and then name the workspace only by its ID.

6.7 Social accounts and analytics

• Data: the account's username, display name, link to its profile picture, account ID, when access expires, connection health, Pinterest board, time zone and content language, and which member connected it; the Zernio profile ID and an encrypted key that works only for the workspace's Zernio profile; analytics: for each post, an excerpt of its text (up to 280 characters), a thumbnail link, the link to the post and its metrics, including posts made outside SemPost up to 365 days back; daily follower counts.
• What we do not store: network passwords, network access tokens (Zernio holds them), or data about individual followers or commenters.
• Purpose: to publish to your accounts and to show analytics and the best times to post.
• Legal basis: contract. For personal data we act as processor (section 5).
• Source: the social network, through Zernio.
• Retention: while the account is connected. Analytics are refreshed every hour; analytics from YouTube and Google Business Profile are never older than 30 days . When you disconnect an account, we delete the data received from LinkedIn at once; for the other networks, we delete the account's name, picture and analytics within 7 days . When we disconnect accounts automatically because the workspace's plan closed, their name, picture and analytics history stay as long as the workspace exists; the YouTube, Google Business Profile and LinkedIn rules above still apply . Section 10 explains connection and disconnection.

6.8 Comment-to-DM

Comment-to-DM sends one private message to a person who comments on your Instagram or Facebook post with a keyword you choose. It is off by default and available only in some regions.

• Data: the keywords, the message, the link, the button text and an optional public reply. They are stored with the post.
• Who received a message: this list is kept only by Zernio. SemPost stores no data about the people who comment.
• Links: link tracking is off. The link does not pass through a Zernio redirect, so nobody tracks who clicks it.
• Legal basis: we act as processor for the customer. The customer decides to use the feature and is responsible for having a legal basis and informing the people concerned.
• Stopping: when you stop the automation, or disconnect the account, Zernio deletes the automation.

6.9 Billing, plans and credits

• Data: Stripe customer and subscription IDs; subscription status, billing interval and period, cancellation, payment-failure and grace-period details; the record of each cancellation Stripe reports to us (the subscription, when it was cancelled, when the plan ends and when we confirmed it by email) and the yearly renewal we last reminded the owners of; billing alerts (Stripe IDs, charge ID, amount, currency, reason; for a withdrawal, the refund due and the credits taken back); the workspace's billing channel (Stripe or Shopify); for Shopify billing, the Shopify subscription details copied to the workspace and Shopify usage charges (type, meter, quantity, amount, billing period); credit holds and the credit ledger (amounts, reason, which member did it); our AI cost records with the provider's request ID.
• Purpose: to sell and run plans, extra social accounts and credit packs; to prevent double charges; to handle refunds and disputes; to track our costs; to give the free trial only once per account and once per store.
• Legal basis: contract; legal obligation (accounting and tax records); legitimate interests (controlling our costs; preventing misuse of the free trial).
• Source: you; Stripe; Shopify; our systems.
• Recipients: Stripe (Link) and Shopify (section 12).
• Retention: while the workspace exists. The credit ledger and billing alerts are kept after the workspace is deleted, for as long as the accounting and tax laws that apply to us require records to be kept, and then name the workspace only by its ID. Records of cancellations are kept for three years after the cancellation, also after the workspace is deleted. For the trial rule, see section 16.

6.10 Emails we send

• Kinds: account emails (email verification, "account exists", password reset, password changed, invitation, two-factor authentication turned on or off, new recovery codes); the notice of a material change to our Terms of Service, sent to every account holder before it takes effect; the confirmation of a purchase on our website, sent to the member who bought; the acknowledgement of a withdrawal made in the app, sent to the address shown when it was confirmed; to workspace owners, the reminder 30 days before a yearly plan renews and the confirmation of a cancelled subscription; emails to workspace owners and admins about social access that is about to expire, failed posts, posts delayed because the social gateway is briefly unavailable, posts waiting for approval, stores that need reconnecting, automation (four kinds), failed payments and closed plans; emails when an account is deleted, when a workspace is going to be deleted or its deletion is taken back, and when a data export is ready ; the warning to the owners of a workspace without an open plan that has not been used for 150 days (section 16).
• Purpose: to run the service and keep you informed about your account and workspace.
• Legal basis: contract; legitimate interests (security notices).
• Recipient: Resend, our email provider: it receives the recipient's address, names, the workspace name and the links in the email.
• No marketing: all our emails are service emails; we do not send marketing emails. If we ever want to send them, we will first ask for your separate consent.
• No tracking: our emails carry no tracking pixel and no tracked links; open and click tracking is off at Resend. Our logo is embedded in the email, not loaded from a server.
• Retention: we do not keep copies of the emails we send through Resend.

6.11 Audit log

• Data: who did what and when in a workspace or on our administration site (about 110 kinds of actions); the user's IP address and browser information; what the action was about and details, which may include reasons written by our administrators and store or shop addresses.
• Purpose: accountability and security: to let owners and admins see what happened in their workspace, and to investigate problems and abuse.
• Legal basis: legitimate interests (keeping a reliable record of actions and protecting the service); legal obligation where a law requires us to keep traffic data.
• Who sees it: workspace owners and admins see their workspace's log, with members' IP addresses shortened ; Global Admin sees all entries with full IP addresses (section 9).
• Retention: 2 years. IP address and browser information are cleared after 1 year , and at once when the person's account is deleted . Entries cannot be changed once written, except for clearing this information .

6.12 Consent and acceptance records

• Data:
  • when you accepted the Terms of Service, which version, and where: at sign-up, when accepting an invitation, through Shopify, or again in the app after a material change to the Terms (section 38 of the Terms of Service);
  • for accounts opened from Shopify: when the account is first opened in Shopify admin, we record the Terms of Service as accepted through Shopify . Every page of the app links to our Terms of Service, this policy and our KVKK Information Notice;
  • before a purchase on our website (a plan, a credit pack or an extra social account): that you asked for the service to start at once and accepted what this means for your right of withdrawal, with the payment it belongs to; where the purchase may be a consumer's in Turkey, also that you confirmed reading the Turkish pre-contract information form and distance service contract, with their version;
  • a withdrawal you make in the app ("Withdraw from contract here"): the name you gave, the purchase it is from, the email address the acknowledgement went to, when you confirmed it, the IP address and browser used, what followed (the share used, the refund due, credits taken back, the subscription ended) and when we sent the acknowledgement;
  • for automation rules that upload to YouTube: who gave permission for automatic uploads, when, and which version of the permission text;
  • for automation rules that post to Google Business Profile: who gave permission for automatic posts, when, and which version of the permission text;
  • for YouTube channels: who confirmed, and when, that the channel does not publish content made for kids;
  • for direct posting to TikTok: the choices you made and the confirmation that you saw TikTok's declaration; these are stored with the post;
  • with each acceptance of the Terms and each confirmation given before a purchase: the time, the version of the text, and the IP address and browser information used.
• Purpose: to prove what was agreed and when a withdrawal was made, to refund it, and to meet the rules of the platforms we publish to.
• Legal basis: legal obligation and legitimate interests (being able to prove consent, acceptance and withdrawal); legal claims.
• Retention: your acceptances of the Terms are kept while your account exists and are deleted with it; a purchase's own record keeps the version of the Terms in force when you bought. The confirmations given before a purchase are kept while your account exists; if you delete your account, they stay, no longer linked to you and without the IP address and browser information, until three years after the purchase, because consumer law requires us to be able to prove the information and consent given before a purchase. A withdrawal made in the app is kept for three years after it was made; if you delete your account earlier, your name, email address, IP address and browser information are removed from it. A daily job deletes these records when their three years are over. Permissions and confirmations stored with an automation rule, a YouTube channel or a post are deleted with that item, and at the latest with the workspace.
• About this policy: we do not ask you to accept this privacy policy. It informs you. When you sign up, you accept only the Terms of Service; a separate line links to this policy and to our KVKK Information Notice .

6.13 Technical logs and backups

• Application logs: structured logs of the app. Email addresses and secrets (tokens, passwords) are masked. For slow or failed requests we log only the address path, the method and the status.
• Web server log: IP address, time, method, address path without its query part, status, referring page without its query part, and browser information. The error log may contain the full request line.
• Database log: statements that take longer than 500 milliseconds. Such an entry can include the values used in the statement, which can be personal data .
• Purpose: to run the service securely, find faults and investigate abuse.
• Legal basis: legitimate interests (secure and reliable operation); legal obligation where a law requires us to keep traffic data.
• Retention: we keep logs only as long as we need them to run the service securely and to look into faults and abuse; our server deletes older log files automatically as it rotates them .
• Backups: the database is backed up to Cloudflare R2. Backups are encrypted (AES-256) before they leave our server. A full backup is made every Sunday, a differential backup every day, and changes are saved at least every 5 minutes. We keep 4 full backups, which is about 4 weeks. Cached data and media files are not backed up. Data you delete can remain in the backups until they expire, about 4 weeks later; in the meantime it is not used for anything else.

6.14 Website visitors

• Data: your IP address and browser information, which Cloudflare processes to deliver and protect www.sempost.ai and docs.sempost.ai; visit counts from Cloudflare Web Analytics, which does not use cookies.
• What the sites do not have: sign-in, cookies of their own, or forms that ask for personal data. You contact us by email. The only thing the sites keep in your browser is your choice of a light or dark theme.
• Purpose: to deliver and protect the sites and count visits.
• Legal basis: legitimate interests (operating and improving our websites securely).
• More: see our Cookie Policy.

6.15 When you contact us

• Data: what you send us, such as your name, email address, message and attachments, and our reply.
• Purpose: to answer you, handle rights requests and complaints, and keep a record that we did.
• Legal basis: legal obligation (rights requests and complaints); legitimate interests (answering other questions).
• Retention: after your request or question is settled, for as long as a complaint or a legal dispute about it is still possible.

7. Where the data comes from and whether you must provide it

Sources. We get personal data:

• from you, when you sign up, use the app or contact us;
• from your browser or device, automatically (IP address, browser information, cookies: section 22);
• from the member who invites you (your email address);
• from Shopify, when you open SemPost from Shopify admin (section 11);
• from your stores, through their interfaces for apps;
• from public web pages whose address you give us (publicly accessible sources);
• from social networks, through Zernio (account details and analytics);
• from Stripe (Link) and Shopify, about payments and subscriptions;
• from Cloudflare (the result of the bot check);
• from AI providers (the content they generate for you).

What you must provide.

• To create an account you must give an email address, a name and a password. Without them we cannot open an account. Accounts opened from Shopify do not need a password.
• To buy a plan or credits you must give the payment details that Link or Shopify asks for.
• Connecting a store or a social account is optional, but SemPost cannot read products or publish without one. Instead of a store, you can give product page addresses.
• The workspace country and two-factor authentication are optional, unless your workspace requires two-factor authentication.

8. Data about other people in your content

Content you process with SemPost can include personal data of other people. Examples:

• product pages you import, which may show names, reviews or photos of people;
• photos of models or customers in your product images;
• names or other details in a voiceover text you write;
• excerpts and thumbnails of posts made outside SemPost, read for analytics;
• usernames and profile pictures of the social accounts you connect, which may belong to a creator;
• the email addresses of people you invite;
• names and email addresses of your Shopify staff;
• people who comment on your posts and receive a comment-to-DM message (through Zernio).

For this data we act as processor for the customer (section 5). The customer must have a legal basis to use it, must inform the people concerned where the law requires, and must have the rights it needs, for example to use a person's photo. Our Acceptable Use Policy and AI Content Policy set the rules.

People shown in AI-generated scenes are synthetic: they do not depict real persons. SemPost does not offer features that recognise people by their face or voice, and does not make avatars or voice clones of real people. If such features are added, we will ask for separate, explicit consent where the law requires.

If you are one of these people and want to use your rights, contact the customer. You can also write to us at [email protected] and we will pass your request on.

9. What your team and our staff can see

Members of a workspace. Every member of a workspace can see the names, email addresses and two-factor authentication status of all other members. Roles are viewer, editor, admin and owner; higher roles can do more.

Owners and admins. Workspace owners and admins can see the workspace's audit log: which member did what and when. They see members' IP addresses only in shortened form (for IPv4 the first three parts, for IPv6 the first three groups) . They do not see members' browser information. Actions taken by our support staff appear in the log without the staff member's name, address or notes.

Invitations. The invitation email shows the inviting member's name and email address and the workspace name.

Our staff (Global Admin). Our staff work through the separate administration site admin.sempost.ai. It is protected by Cloudflare Access, mandatory two-factor authentication and, for sensitive actions, a second step that is no older than 15 minutes. Global Admin sees the full audit log with full IP addresses. Staff can suspend or lock accounts and reset two-factor authentication when this is needed for security or support; these actions are recorded in the audit log. When a request reaches us by email, staff can also delete an account or start the deletion of a workspace, with a written reason and a fresh second step; this too is recorded in the audit log .

10. Social accounts and Zernio

How connecting works. SemPost connects to social networks through Zernio, our social API gateway. When you connect an account, you sign in on the network's own page and grant access to the app shown on that page. Today this is Zernio's app. For Instagram you can sign in with Facebook (needed for Instagram music) or with Instagram. Supported networks are Instagram, Facebook, Threads, TikTok, Pinterest, LinkedIn, YouTube, Google Business Profile and Bluesky.

Who holds the access tokens. SemPost does not store the access tokens of the social networks. Zernio holds them. SemPost stores the Zernio profile ID of the workspace, an encrypted Zernio key that works only for that profile, and the account details listed in section 6.7. We send Zernio the workspace ID (as a reference) and a profile name made from it, and the posts, media, options and comment-to-DM messages to be published. We do not send Zernio your email address.

Disconnecting. When you disconnect an account, it is deleted at Zernio together with its comment-to-DM automations. We delete the data received from LinkedIn at once; for the other networks, we delete the account's name, picture and analytics within 7 days . Posts you made through SemPost stay in your workspace's history. Disconnecting does not delete posts already published on the network: delete them on the network if you want.

When accounts are disconnected automatically. 48 hours after a trial ends without a paid plan, and 48 hours after a plan closes (for example after a failed payment, a cancellation at the end of the period, or the removal of the Shopify app), we disconnect the workspace's accounts at Zernio. Their name, picture and analytics history stay in SemPost as long as the workspace exists, so they are there again when you reconnect the accounts; analytics from YouTube and Google Business Profile are still never older than 30 days, and data from LinkedIn is deleted at once . While a workspace waits to be deleted, its accounts stay connected until it is deleted permanently (section 19) .

Zernio itself. Zernio is operated by ZERNIO SOFTWARE SL, Carrer de Mallorca 2A, 17230 Palamós (Girona), Spain (VAT number ESB88719281). Its terms (zernio.com/tos, version of 9 October 2026) apply to our use of Zernio. Its data processing agreement (zernio.com/dpa, version of 19 October 2026) is part of those terms, so it applies without a separate signature, and Zernio processes the data under it on our behalf. Zernio keeps its main database in London (on Amazon Web Services, through PlanetScale) and media files in Western Europe (on Cloudflare); some of its own service providers are in the United States and are covered by the EU-US Data Privacy Framework or by standard contractual clauses. Zernio lists its own sub-processors at zernio.com/subprocessors and tells us about new ones 14 days in advance. It must tell us about a personal data breach within 72 hours. When our use of Zernio ends, it deletes the data within 10 business days, from its backups within 30 days and from its logs within 90 days.

11. Shopify

Install and sign-in. When a store installs the SemPost app and someone opens it in Shopify admin, Shopify gives us that person's email address, first and last name, language, whether they are the store owner and whether Shopify has verified the email address. We use a verified email address to open a SemPost account without a password, or to link the existing account with that address. An unverified email address neither opens nor links an account. The store owner becomes the owner of the workspace; other staff become editors. If a staff member opens SemPost for a new store before the owner does, that person is an admin until the owner arrives. We also receive the store's address, name, time zone and Shopify ID. Each request from inside Shopify admin carries a short-lived token from Shopify instead of a cookie. When you open SemPost in a new tab from Shopify, we use a one-time code that is valid for one minute.

Permissions. The app reads products, inventory and discounts, and optionally markets, publications, languages and translations. It has no permission to read your store's customers or orders. If we ever add a feature that needs customer or order data, we will follow Shopify's protected customer data rules and update this policy first.

Shopify's privacy requests. Shopify sends apps privacy requests about store customers. We check each request's signature and reject requests with a wrong signature.

• Customer data request and customer erasure: we record the store, the request type, the number of orders named and the times, and mark the request as answered; we keep nothing about the customer. SemPost receives no customer or order data from Shopify, so it has nothing of that kind to return or delete. We do not search your workspace's content for the customer: if you wrote a customer's details into your own content, such as a post text, you can change or delete that content yourself.
• App removed: when the app is removed, we delete the store's tokens and the store connection. If Shopify billed the workspace, its plan closes, and its social accounts are disconnected 48 hours later.
• Shop erasure (48 hours after removal): Shopify asks us to erase the store's data. An hourly job first checks with Shopify that the app has been gone for at least 48 hours. If the install created the workspace and no purchase was ever started for it on our website (which gives a workspace a customer record at Stripe), we erase the whole workspace: its social profiles at Zernio, its media, its data, and the users who belong to no other workspace. Otherwise we remove only the store and its install. Shopify allows 30 days for this.
• What remains after erasure: the record of Shopify's privacy requests (store address), a one-way digest of the store's Shopify ID so that the trial is given only once per store, and the records listed in section 16 that name the workspace only by its ID.

Billing. Shopify bills App Store installs (section 12).

12. Payments

On our website: Link (Stripe). Plans and credit packs bought on our website are sold by Link, a Stripe service, as the merchant of record. Link shows the checkout page, collects your card, billing address and tax ID, calculates and handles tax, sends receipts and invoices, gives payment support, handles refunds in some cases and disputes, and deals with requests to delete payment data. The checkout page and the customer portal run on Stripe's own pages. Link and Stripe process this data as independent controllers under their own privacy policies.

• What we send to Stripe: the workspace name (as the customer name), the email address of the member who buys, and the workspace ID.
• What we keep: Stripe customer and subscription IDs, the subscription status and dates, and billing alerts (section 6.9). We do not receive or keep card data, billing addresses or tax IDs. We do not keep the content of Stripe's notifications to us.
• Cancellation reasons: if you cancel in the customer portal, Stripe asks for a reason and keeps it.
• Refunds after using credits: if you ask for a refund after using credits, we may send Stripe a summary of the workspace's credit use (what was generated on which day). Stripe decides.
• Questions to Link: if you contact Link about a payment, Link may ask us for information about your purchase. We answer with what is needed.
• Deletion at Link: if you ask Link to delete your payment data, Stripe cancels the subscription, deletes the personal data in its records for this purchase and tells us by email. The workspace then has no plan, and its owners get an email.

Shopify App Store. If you installed SemPost from the Shopify App Store, Shopify bills you as part of your Shopify invoice, under Shopify's terms and privacy policy. We read the subscription from Shopify (plan, period, trial end, cancellation, pending change). We report usage charges for credit packs and extra social accounts to Shopify; these reports contain no personal data.

13. AI processing

What we send and to whom. SemPost uses AI providers to create content. Which provider processes your data depends on the feature and on the models chosen in the workspace's AI settings.

What we do not send. We do not send AI providers your account details, such as your email address or password, or payment data.

Provider settings. For the Gemini API we use the paid tier and ask Google not to store requests where the interface allows it. fal keeps the files it generates on its own servers; we copy them to our storage. Our music engine, which runs on a separate server, receives only musical notes and stores nothing.

Training. SemPost does not use your content or personal data to train AI models. Under their terms for business customers, Anthropic and Google (for the paid Gemini API) do not use what we send them through their APIs to train their models. fal.ai and the developers of the models it offers process what we send under fal.ai's terms for business customers (fal.ai Terms of Service).

Labels. Files made with AI carry a signed C2PA record, and posts with AI media carry the network's AI flag (section 6.6).

Your control. AI output can be wrong; check it before it is published. Your workspace's approval rule decides whether a person must approve each post.

14. Who receives personal data

We share personal data only as described in this policy. The current list of our service providers, with their location and the transfer safeguard used, is on our Sub-processors page.

Configured in our code but not in use: ElevenLabs (text-to-speech), Upload-Post (a backup social gateway) and Brevo (an alternative email provider). They receive no data. We will update the Sub-processors page before we start to use any of them. GitHub, where our code is kept and tested, receives no personal data.

Each service provider receives only what it needs for its service, and its terms with us set how it may use and protect the data.

Business transfers. If our company merges with another company, is acquired, or sells all or part of its assets, personal data may pass to the new owner as part of that transaction. We will tell you before this happens.

15. International transfers

Where data is processed. Our servers are in the United States. Cloudflare's network carries all traffic. Media files are stored in Cloudflare R2 without a fixed region: Cloudflare chooses where to keep them, which may be outside the European Union and Turkey. Database backups are also stored in Cloudflare R2, encrypted before they leave our server. Our service providers process data in the countries shown on the Sub-processors page. So if you are in the European Union, the United Kingdom, Turkey or another country, your data is transferred to the United States and to other countries.

Safeguards. We transfer personal data only with a safeguard that the law of your country accepts:

• From the EU and EEA: to recipients certified under the EU-US Data Privacy Framework, on the basis of the European Commission's adequacy decision; otherwise under the European Commission's standard contractual clauses (2021).
• From the United Kingdom: under the UK extension to the Data Privacy Framework for certified recipients, or under the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
• From Turkey: under KVKK Article 9: where the Personal Data Protection Board has made an adequacy decision, on that basis; otherwise with the standard contracts announced by the Board, which must be notified to the Authority within 5 business days of signature. Transfers based on the exceptions in Article 9(6) are made only occasionally. Our KVKK Information Notice explains this.

Copies. You can ask for a copy of the safeguards we use by writing to [email protected]. We may black out commercial terms that are not about data protection.

16. How long we keep data

We keep personal data only as long as we need it for the purposes in section 6, or as long as a law requires. A daily job applies the periods below .

Free trial. The free trial on the web is given once per account. To apply this rule we keep no record, and no digest, of the email addresses of deleted accounts.

Link (Stripe), Shopify and the social networks keep their own records under their own policies. Our service providers keep data only as long as their terms with us allow (for Zernio, see section 10).

17. Security

We protect personal data with technical and organisational measures. The main ones:

• Encryption: connections are encrypted (TLS 1.2 or 1.3) between your browser and Cloudflare and between Cloudflare and our server. Secrets and tokens, and the secret for two-factor authentication, are encrypted in the database. Passwords are stored as Argon2id hashes; session, link and invitation tokens as SHA-256 hashes; recovery codes as keyed hashes. Backups are encrypted before they leave our server, and Cloudflare R2 encrypts the files it stores.
• Separation: each workspace's data is separated in the database by row-level security. The database role that serves workspaces cannot read the tables of user identities and platform settings. Key logs, such as the audit log and the credit ledger, cannot be changed once written (section 6.11 explains the one exception). The administration site is separate from the app.
• Sign-in protection: optional two-factor authentication, which a workspace can require; mandatory two-factor authentication and a fresh second step for our staff; account locks after repeated failures; a bot check; sessions that end after inactivity; checks against known breached passwords.
• Request protection: protection against cross-site request forgery, rate limits, a guard that stops our server from being sent to private network addresses, and signature checks on every incoming notification from Stripe, Shopify and other services.
• Network: the administration site is behind Cloudflare Access; our server accepts web traffic only from Cloudflare; the database and the cache are reachable only from the server itself.
• Logs: we mask email addresses and secrets in application logs.

No system is completely secure. SemPost does not hold security certifications. If a personal data breach puts your rights at risk, we will inform the competent authority and, where the law requires, you, within the time limits of the law. To report a security problem, write to [email protected]. More details are on our Security and Responsible Disclosure page.

18. Your rights

Under the GDPR and the UK GDPR you have the right to:

• access your personal data and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure ("right to be forgotten");
• restriction of processing;
• data portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another controller;
• object to processing based on legitimate interests, and to direct marketing at any time (section 2);
• withdraw consent at any time where we rely on consent, without affecting earlier processing (we do not rely on consent today);
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (section 23);
• complain to a supervisory authority (section 20).

Under the KVKK (Turkey), Article 11, you have the right to:

• learn whether your personal data is processed;
• request information about it if it is;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Turkey or abroad to whom it is transferred;
• ask for correction if it is incomplete or inaccurate;
• ask for deletion or destruction under the conditions of Article 7;
• ask that correction, deletion or destruction be notified to the third parties who received the data;
• object to a result against you that arises only from automated analysis of your data;
• claim compensation if you suffer damage because of unlawful processing.

How to apply under the KVKK is explained on our KVKK Application Form page.

Under US state privacy laws. Depending on where you live, you may have the right to know what personal information we collect and how we use and disclose it, to access it, to correct it, to delete it, to receive a portable copy, and to opt out of the sale or sharing of personal information, targeted advertising and certain profiling. We do not sell or share personal information, and we do not use it for targeted advertising or for profiling with legal or similarly significant effects. We will not treat you differently because you use your rights. If we refuse a request, you can appeal by replying to our answer; we will tell you the result in writing. An authorised agent can make a request for you if you confirm your identity and the agent's authority.

California. You can review and update your profile in the app (section 6.1) and ask us to correct other data. Section 26 explains how we tell you about changes, and section 25 how we respond to Do Not Track signals.

Elsewhere. If you live in another country, you may have similar rights under your local law. Write to us and we will help.

How to use your rights.

• In the app: delete your account or workspace, download your data, change your profile, end sessions, disconnect stores and social accounts (section 19) .
• By email: [email protected]. Please write from the email address of your account if you have one.
• By post: CS Digital Wonders LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.
• For the KVKK: the channels on our KVKK Application Form page.

We may ask for information to confirm your identity. We ask only for what we need, and we use it only for this.

Response times.

• GDPR and UK GDPR: without undue delay and within one month. If a request is complex or there are many requests, we may extend this by up to two more months; we will tell you within the first month.
• KVKK: as soon as possible and within 30 days at the latest, free of charge.
• US state laws: within 45 days; where the law allows, we may extend this once by 45 days and will tell you.

Answers are free. Under the GDPR we may charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive.

19. Deleting and downloading your data

Delete your account . In Settings › Profile at app.sempost.ai (inside Shopify admin this button is not shown). You confirm with your password and, if you use it, your two-factor code. If you are an owner of a workspace, you first hand over ownership or delete that workspace. If your account was opened from Shopify and has no password, you first set a password with "Forgot your password?" on the sign-in page. The workspaces you belong to keep the content created there, because it belongs to the workspace. These records name you only by an internal identifier, not by your name or email address: who created or approved a post or another item, and who took an action recorded in the credit ledger. Once your account is deleted, the identifier no longer leads to you, so your name is no longer shown with them. Audit log entries about your actions stay, with your IP address and browser information cleared. The confirmations you gave before a purchase and the withdrawals you made in the app stay until three years after the purchase or the withdrawal, no longer linked to you and without your name, email address, IP address and browser information (section 6.12).

Delete a workspace . Only the owner can, in Settings › Workspace, by typing the workspace name and confirming with their password and, if they use it, their two-factor code.

• An active Stripe subscription is cancelled first, without waiting for the end of the period. The Terms of Service and the Refund and Cancellation Policy say whether a refund applies.
• If the workspace pays through Shopify, or SemPost's Shopify app is installed in it, you first remove the app in Shopify admin. A workspace that the Shopify app created, and for which no purchase was ever started on our website, is then erased about 48 hours later (section 11); otherwise only the store is removed and the workspace stays, and you can then delete it in Settings › Workspace or ask us.
• When you ask, the workspace closes at once: publishing, automation and content generation stop.
• You can undo the deletion for 7 days. During these days its social accounts stay connected at Zernio, so you do not need to connect them again if you undo the deletion. On the 7th day the workspace is deleted permanently, and its social accounts are disconnected and deleted.

What permanent deletion removes : the workspace's profile at Zernio; all of the workspace's files in our storage; the workspace and all data linked to it; users who belong to no other workspace, with their sessions, codes, tokens and login attempts. In the audit log, the deleted person's IP address and browser information are cleared.

What remains, and why : the audit log, the credit ledger, post events and billing alerts, which then name the workspace only by its ID; for three years, the confirmations given before purchases, the withdrawals made in the app and the records of cancellations. We keep them to prove what happened, for accounting and to defend legal claims (section 16). Link (Stripe) and Shopify keep their own records under their own policies. Deleted data can remain in our backups until they expire, about 4 weeks later. Posts already published on social networks stay there until you delete them on the network.

Download your data .

• Workspace (owners and admins, in Settings › Workspace): a ZIP file with JSON files: the workspace and its settings; members (name, email address, role) and invitations; store connections (without secret keys or tokens); social accounts; posts (text, time, status, link) and their history; automation rules with their runs and events; analytics; brand settings; the credit ledger and credit packs; the audit log as the app shows it; a list of media files with download links that work for 24 hours.
• Personal (every user, in Settings › Profile): your profile, memberships, sessions, sign-in attempts made with your email address, consent records, the withdrawals you made in the app and the audit entries of actions you performed.
• We prepare the file in the background and email you when it is ready. You download it in the app while signed in; the email itself does not open the file. The file is deleted 24 hours after it is ready. You can ask once a day.

By email. You can also write to [email protected] to have your data deleted or to get a copy. Our staff can delete an account, or start the deletion of a workspace, with the same deletion as in the app; this needs a written reason and a fresh second step . For a copy, we help you download it in the app; if you cannot sign in, we answer your request another way.

Meta (Facebook, Instagram, Threads) users: see our Data Deletion Instructions.

20. Complaints

To us. If you are unhappy with how we handle your personal data, please tell us first. You can complain:

• by email to [email protected];
• by post to CS Digital Wonders LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.

We confirm that we received your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome without undue delay.

To an authority.

• EU and EEA: the data protection authority of the country where you live or work, or where the alleged infringement took place. The European Data Protection Board lists them at edpb.europa.eu.
• United Kingdom: the Information Commissioner's Office, ico.org.uk/make-a-complaint.
• Turkey: the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), kvkk.gov.tr. Under KVKK Article 14 you must first apply to us. If we reject your application, if you find our answer insufficient, or if we do not answer in time, you can complain to the Board within 30 days after you learn our answer, and in any case within 60 days after the date of your application.
• United States: the attorney general or privacy agency of your state, where your state's law provides for this.

21. Children

SemPost is only for people aged 18 or over. It is not directed at children. We do not knowingly collect personal data from children. If you believe that a person under 18 has given us personal data, contact us and we will delete it.

22. Cookies and similar technologies

The app uses only cookies that it needs to work, and a few cookies that remember your preferences, such as your language. We do not use advertising or tracking cookies. Our Cookie Policy lists every cookie and browser storage item, what it does and how long it lasts.

23. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

Some automatic checks protect you and the service: an account is locked for a while after repeated failed sign-ins; a bot check may appear; posts made by automation rules are held as drafts when a check finds, for example, a price claim or a product that is no longer available. These checks do not decide about your rights. A person can review them: contact us, or edit and approve the post yourself. Stripe runs its own fraud checks on payments as an independent controller.

24. Platform-specific information

SemPost connects to these platforms through Zernio. The rules below apply to the app that receives access to your account on each platform.

YouTube

• SemPost uses the YouTube API Services. By using SemPost's YouTube features, you agree to be bound by the YouTube Terms of Service.
• Google's processing of your data is described in the Google Privacy Policy.
• What we access and store: your channel's name, picture and ID; the videos we publish for you; and the analytics of your videos (an excerpt of the title or description, a thumbnail link, the link and the metrics), including videos you published outside SemPost (section 6.7).
• How we use and share it: to publish the videos you schedule or approve, and to show analytics and the best posting times to the members of your workspace. We share it with Zernio, which connects to YouTube for us, and with our hosting and storage providers. We do not use it for advertising.
• Automatic uploads: an automation rule can upload to YouTube only after a member has given specific permission for that rule; we store who gave it, when and the text version. You can stop the uploads at any time by removing the YouTube account from the rule.
• Revoking access: besides disconnecting the account in SemPost, you can revoke access at any time on Google's security settings page: security.google.com/settings/security/permissions.
• Deletion: if you disconnect your channel in SemPost or ask us to delete its data, we delete the YouTube data we store within 7 days . The YouTube analytics we store are never older than 30 days: they are refreshed while access works, and deleted when they can no longer be refreshed, for example after you revoke access on Google's page . The channel's name and picture stay until you disconnect the channel in SemPost or ask us to delete them.
• Devices and third-party content: SemPost shows no advertisements. Some images in the app, such as post thumbnails and profile pictures, load directly from the servers of social networks, our social gateway and stores (section 25). What SemPost stores on your device is explained in the Cookie Policy.
• Contact: questions or complaints about our privacy practices go to [email protected].

Google APIs (YouTube and Google Business Profile)

• Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
• We use this data only to provide the features you see in SemPost. We do not transfer it except to provide these features, for security purposes, to comply with the law, or as part of a merger, acquisition or sale of assets with your prior consent. We do not sell it, and we do not use it for advertising or to assess creditworthiness.
• Our staff do not read this data, unless you agree for specific data, it is necessary for security (for example to investigate a bug or abuse), or the law requires it.
• If we change how we use Google user data, we will tell you and ask for your consent to the updated policy before we use the data in the new way.

Google Business Profile

• We use Google Business Profile data only to publish the posts you schedule or approve and to show their analytics.
• Under Google's policies, data from the Business Profile APIs may be stored for at most 30 days. The Business Profile analytics we store are therefore never older than 30 days: they are refreshed while access works, and deleted when they can no longer be refreshed . The profile's name and picture are kept while the profile is connected.
• Automatic posts: an automation rule can post to your Business Profile only after a member has given specific permission for that rule; we store who gave it, when and the text version.
• You can disconnect your Business Profile at any time in SemPost. The connection is then deleted at Zernio, and we delete its data within 7 days .

Meta: Facebook, Instagram and Threads

• We access the account and analytics data described in section 6.7, publish the posts you schedule or approve and, if you turn it on, run comment-to-DM through Zernio (section 6.8).
• You can connect Instagram with Facebook or with Instagram. With Facebook you choose which pages to connect; Instagram music is available only with this method.
• To delete your data, see our Data Deletion Instructions. To report a security problem, write to [email protected] or see our Security and Responsible Disclosure page.

TikTok

• We access your account's name, picture and posting information (such as your daily posting limit), publish the videos and photos you schedule or approve and show their analytics.
• By default, posts go to TikTok as drafts, and you publish them in the TikTok app. If you choose direct posting, you set the privacy level yourself (nothing is pre-selected), choose whether others may comment, duet or stitch, declare any commercial content, and see TikTok's declaration before you save. We send these choices to TikTok with the post.
• We do not put our brand or watermark on content sent to TikTok.

LinkedIn

• We access your account's name and picture, publish the posts you schedule or approve and show their analytics. Under LinkedIn's rules every post that an automation rule prepares for LinkedIn needs a person's approval.
• When the account is disconnected, we delete the data collected from LinkedIn at once. If you ask us to delete it, we do so without delay once we have confirmed your request.

Pinterest

• We access your account name, picture and boards, publish the Pins you choose and show the analytics of your own Pins. Under Pinterest's rules you choose each Pin that is published; automation rules never publish Pins without your approval.
• We do not use Pinterest data to train AI models.
• When you disconnect the account, we delete its name, picture and analytics within 7 days .

25. Do Not Track and tracking by others

Do Not Track. We do not track you across other websites, and we do not use advertising technology. SemPost works the same whether or not your browser sends a Do Not Track signal.

Others. We do not allow other companies to collect personal data about your activity across websites through SemPost. Some third parties do receive data when you use SemPost:

• Cloudflare, which protects our sites and runs the bot check;
• Shopify, whose App Bridge script runs when you use SemPost inside Shopify admin;
• social networks, our social gateway and stores, from whose servers the app loads images; we ask your browser not to tell them which page you are on, but they see your IP address and browser information, as with any image;
• Cloudflare Web Analytics on our public website, which does not use cookies.

The app has no analytics, tag manager, error-tracking, chat or advertising scripts.

26. Changes to this policy

• We may update this policy when our service or the law changes. The date at the top shows when the current version took effect.
• Material changes: we tell you by email at least 30 days before they take effect .
• Other changes: we list them in the "Changes" section below.
• Consent: this policy is information, so we do not ask you to accept it. Where a change needs your consent, for example a new use of data received from Google APIs, or a new processing that the law allows only with consent, we ask for it separately, and the service does not depend on it.
• Earlier versions are available on request.

Changes