Privacy Policy

1Introduction

Optimizer Pro ("we," "us," or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, share, and protect your information when you visit our website, use our AI-powered content generation platform, or interact with any of our services (collectively, the "Service").

We designed this policy to be transparent, concise, and easy to understand. If you have questions after reading it, please contact us at Contact Support.

2Scope

This Privacy Policy applies to all individuals who:

• Visitors: browse our website without creating an account.
• Users: create an account and use the Service (including free and paid tiers).
• Customers: purchase a paid subscription plan.

This policy does not cover third-party websites, applications, or services linked from our platform, each of which is governed by its own privacy practices.

3Information We Collect

3.1 Information You Provide

• Account Data: name, email address, and profile information you provide during registration.
• LinkedIn Profile Data: basic profile information (name, photo, headline), email address, and posting permission you grant us via LinkedIn OAuth.
• User-Generated Content: prompts, drafts, generated posts, bio text, and any content you create or save within the Service.
• Billing Information: payment card details, billing address, and transaction history processed through Nardopay. We do not store full card numbers on our servers.
• Support Correspondence: messages, attachments, and metadata related to customer support requests.

3.2 Automatically Collected Information

• Device Information: device type, operating system, screen resolution, and unique device identifiers. We generate a browser fingerprint from these signals (user agent, screen, timezone, language) and use it to detect and prevent credit limit abuse across multiple accounts on the same device. This fingerprint is stored server-side and associated with your account for fraud prevention purposes.
• Browser Information: browser type, version, language preference, and installed plugins.
• IP Address: used for security, fraud prevention, and approximate geolocation.
• Usage Analytics: pages viewed, features used, time spent on pages, click paths, and interaction patterns.
• Error Data: error reports, stack traces, and performance telemetry collected by Sentry for error monitoring and debugging.
• Cookies & Similar Technologies: see our Cookie Policy for details.

3.3 Information from Third-Party Sources

• Google OAuth: when you sign in with Google, we receive your name, email address, and profile picture from Google. We use this information solely for account creation, authentication, and to personalize your experience. We do not access your Gmail, Google Drive, Calendar, Contacts, Photos, YouTube, or any other Google service data. We do not sell your Google data and we do not share it with third parties for advertising.
• LinkedIn OAuth: basic profile data and the ability to publish posts on your behalf. We do not access your post history, connections list, or engagement metrics through OAuth.
• Nardopay: payment confirmation data, subscription status, and billing events.

3.4 Google API Services User Data Policy

Optimizer Pro's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We request only the basic Google sign-in scopes needed to read your name, email address, and profile picture so we can create and secure your account.
• We do not use Google user data to serve advertising, and we do not sell Google user data.
• We do not allow humans to read your Google user data, except where you have given explicit consent, where necessary for security or to comply with law, or where the data has been aggregated and anonymized.
• We do not transfer Google user data to third parties except as needed to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior notice.
• You can review or revoke Optimizer Pro's access at any time from your Google Account permissions, or by deleting your Optimizer Pro account.

4How We Use Information

We use the information we collect for the following purposes:

• Service Delivery: operating, maintaining, and providing the features and functionality of the Service.
• Authentication: verifying your identity and managing account access via Supabase Auth and LinkedIn OAuth.
• AI Content Generation: processing your prompts, profile data, and style preferences through AI models to generate LinkedIn posts, bios, and related content.
• Product Improvement: analyzing usage patterns to improve our features, user experience, and AI model performance.
• Customer Support: responding to your inquiries, troubleshooting issues, and providing technical assistance.
• Security & Fraud Prevention: detecting, preventing, and addressing technical issues, abuse, and security threats.
• Billing & Payments: processing subscription payments, managing invoices, and handling refunds via Nardopay.
• Legal Compliance: fulfilling legal obligations, responding to lawful requests, and enforcing our terms.
• Marketing Communications: sending product updates, feature announcements, and promotional content (only with your explicit opt-in consent).

5Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data under the following legal bases:

6AI Processing and Generated Content

• User prompts, profile data, and writing samples may be transmitted to our AI providers, Groq API and Google Gemini API, for processing.
• AI outputs may be inaccurate, incomplete, or unsuitable for your specific use case. We make no guarantee of factual correctness.
• You bear full responsibility for reviewing all generated content before publishing or sharing it.
• We do not use your content to train third-party AI models. However, our AI providers may process data in accordance with their own privacy policies.
• AI-generated content does not constitute professional, legal, financial, or career advice.

7Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to operate our Service, remember your preferences, and analyze usage patterns. For comprehensive details about the specific cookies we use, their purposes, durations, and your choices for managing them, please refer to our Cookie Policy.

8Sharing and Disclosure

We do not sell your personal data. We share information only in the following circumstances:

8.1 Service Providers

We share data with trusted third-party vendors who assist in operating the Service:

• Supabase: authentication, database hosting, and user management.
• Nardopay: payment processing, billing, and subscription management.
• Cloudflare: content delivery, DDoS protection, and bot management (Turnstile).
• Upstash: rate limiting, caching, and session management via managed Redis.
• Groq: AI language model processing for content generation.
• Google Gemini: AI language model processing for content generation.
• Sentry: error tracking, performance monitoring, and session replay for debugging and reliability.
• Resend: transactional email delivery (password resets, notifications).

8.2 Legal Requests

We may disclose your information if required by law, court order, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

8.3 Corporate Transactions

In the event of a merger, acquisition, reorganisation, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you of any such change in ownership or control.

8.4 Consent-Based Sharing

We may share your information with third parties when you have given us your explicit consent to do so.

9International Data Transfers

Your personal data may be transferred to, stored, and processed in countries other than the country in which it was collected. When we transfer personal data from the EEA, UK, or Switzerland, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): approved by the European Commission and adopted by the UK Information Commissioner’s Office for international transfers.
• Adequacy Decisions: where the European Commission or UK authorities have determined that a recipient country provides an adequate level of data protection.
• Supplementary Measures: additional technical and organisational safeguards implemented where required by applicable data protection law.

Our third-party service providers operate globally. By using the Service, you acknowledge that your data may be processed in jurisdictions that may have different data protection standards than your own.

10Data Retention

We retain your personal data only as long as necessary to fulfil the purposes described in this policy, or as required by law. The following table outlines our standard retention periods:

11Security Measures

We implement industry-standard technical and organisational measures to protect your personal data, including:

• Encryption: data encrypted in transit (TLS 1.2+) and at rest using AES-256 encryption.
• Access Controls: role-based access control, multi-factor authentication for administrative access, and least-privilege principles.
• Monitoring: continuous security monitoring, automated threat detection, and regular security audits.
• Infrastructure Security: cloud infrastructure provided by reputable providers with SOC 2 Type II and ISO 27001 certifications.

While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk.

12Your Rights

12.1 GDPR Rights (EEA & Switzerland)

If you are located in the European Economic Area or Switzerland, you have the following rights under the General Data Protection Regulation:

• Right of Access: request a copy of the personal data we hold about you.
• Right to Rectification: request correction of inaccurate or incomplete data.
• Right to Erasure: request deletion of your personal data ("right to be forgotten").
• Right to Restriction: request that we limit the processing of your data.
• Right to Data Portability: receive your data in a structured, machine-readable format.
• Right to Object: object to processing based on legitimate interests or direct marketing.

12.2 UK GDPR Rights

If you are located in the United Kingdom, you have equivalent rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, including the rights listed above. You may lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

12.3 CCPA/CPRA Rights (California)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to Know: request details about the categories and specific pieces of personal information collected about you.
• Right to Delete: request deletion of your personal information.
• Right to Correct: request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: limit how we process sensitive categories of data.
• Right to Non-Discrimination: exercise your rights without receiving discriminatory treatment.

We do not sell personal information, nor do we share personal information for cross-context behavioural advertising as defined under the CCPA/CPRA.

12.4 India DPDP Act Rights

If you are located in India, you have the following rights under the Digital Personal Data Protection Act, 2023:

• Right to Access: obtain a summary of your personal data being processed and the processing activities.
• Right to Correction: request correction of inaccurate, incomplete, or misleading personal data.
• Right to Erasure: request erasure of personal data that is no longer necessary for the purpose it was collected.
• Right to Grievance Redressal: submit a grievance regarding our data processing practices.

To exercise any of these rights, contact us at Contact Support. We will respond within the timeframe required by applicable law (typically 30 days for GDPR, 45 days for CCPA/CPRA).

13Children’s Privacy

The Service is not directed to individuals under 18 years of age (or the age of majority in your jurisdiction, whichever is higher). We do not knowingly collect personal data from children. If you believe that a child has provided us with personal information, please contact us at Contact Support and we will promptly delete the information.

14Third-Party Services

The Service may contain links to, or integrations with, third-party websites, applications, and services that are not owned or controlled by Optimizer Pro. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party service you access through our platform. We are not responsible for the privacy practices or content of third-party services.

15Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Notify you via email or a prominent notice on our website before the changes take effect.
• Where required by law, obtain your consent to any material changes.

Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.

16Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

If you are in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.