Privacy Policy

StoryLayer ("we," "us," or "our") is a social media automation platform operated by Afore Travel Ltd. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at storylayer.ai and our services.

Account Information: When you create an account, we collect your name, email address, and password. If you sign up via a third-party service (e.g., Google), we receive your name and email from that provider.

Social Media Credentials: When you connect social accounts (Instagram, X/Twitter, LinkedIn, Ghost), we store OAuth access tokens and account identifiers needed to publish content on your behalf. We never store your social media passwords.

Content Data: We store the content you create, including captions, images, templates, scheduling preferences, and publishing history.

Usage Data: We collect standard analytics data including pages visited, features used, browser type, and IP address to improve our services.

Third-Party Data: When you connect data sources (e.g., SnowSure, Open Meteo), we fetch data from those APIs on your behalf to generate content. This data is processed in real time and stored only as part of your generated content.

We use your information to:

• Provide, maintain, and improve StoryLayer's services
• Publish content to your connected social media accounts
• Generate AI-powered content based on your guidance and connected data sources
• Send you service-related communications
• Analyse usage patterns to improve the platform
• Comply with legal obligations

Meta Platform Data Disclosure

What We Collect from Facebook and Instagram:

• Instagram account information (username, profile picture, account ID)
• Instagram Business or Creator account data (page name, category, follower count)
• Facebook Page information (page name, page ID, page access tokens)
• Post performance data (impressions, reach, engagement, link clicks) retrieved via the Meta Graph API after content is published

We do NOT collect:

• Personal messages or direct messages
• Friend lists or follower lists
• Personal Facebook profile data unrelated to your connected business account

How We Use Facebook and Instagram Data:

• To publish content to your connected Instagram and Facebook accounts on your behalf
• To retrieve post performance analytics after publishing
• To display your connected account information within the StoryLayer dashboard

We do not sell Facebook or Instagram data to third parties. We do not use this data for advertising or ad targeting purposes.

How Long We Keep Facebook and Instagram Data:

• Access tokens: Stored until you disconnect your account or delete your StoryLayer account, at which point they are permanently deleted
• Post analytics: Retained according to your plan's analytics retention period (Free: 7 days, Starter: 30 days, Pro: 90 days, Agency: 365 days)
• Account information: Deleted within 30 days of account disconnection or account deletion

Your Rights Regarding Facebook and Instagram Data:

• You can disconnect your Instagram or Facebook account at any time in the StoryLayer dashboard under Social Accounts
• You can request full deletion of your Facebook and Instagram data by visiting storylayer.ai/data-deletion or by emailing privacy@storylayer.ai
• Disconnecting your account revokes StoryLayer's access token immediately
• If you remove StoryLayer from your Facebook connected apps, we will receive a deletion callback and process full removal of your Facebook and Instagram data within 30 days

Facebook Platform Policy:
StoryLayer's use of Facebook and Instagram data is governed by the Meta Platform Terms and Meta Developer Policies.

We do not sell your personal information. We share data only with:

• Social media platforms — to publish content you have approved
• AI providers (OpenAI) — to generate content; no personally identifiable information is sent
• Infrastructure providers (Vercel, Supabase) — to host and operate our services
• Payment processors — to handle billing, if applicable

We retain your account data for as long as your account is active. Content and analytics data are retained according to your plan tier. You may request deletion of your data at any time (see Section 9).

We implement industry-standard security measures including encryption in transit (TLS), encrypted database storage, and row-level security policies. Access tokens for connected social accounts are stored encrypted and are never exposed in client-side code.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Request data portability
• Withdraw consent at any time

You can delete your data at any time by:

• Disconnecting social accounts from your StoryLayer dashboard
• Deleting your StoryLayer account from Settings
• Visiting storylayer.ai/data-deletion for detailed instructions
• Emailing us at privacy@storylayer.ai to request full data deletion

Upon account deletion, all your data (including stored tokens, content, and analytics) will be permanently removed within 30 days.

We use essential cookies for authentication and session management. We use Google Analytics to understand usage patterns. You can control cookies through your browser settings.

StoryLayer is not intended for users under 16. We do not knowingly collect information from children.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the platform.

If you have questions about this Privacy Policy or your data, contact us at:

Afore Travel Ltd
Email: privacy@storylayer.ai
Website: storylayer.ai