Privacy Policy
This policy explains what personal data Weekbird collects, why, who processes it and the choices you have. It covers weekbird.app, app.weekbird.app, the Weekbird API, MCP server, ChatGPT app and browser extension.
1. Who is responsible
- Your account, billing and use of the Service: OD Bosnadev vl. Mirza Pasic, a sole proprietorship registered in the Federation of Bosnia and Herzegovina is the controller.
- Content and audience data in your workspace: the workspace's customer is the controller and Weekbird processes it on their behalf. This covers posts, media, connected channels and the comments and messages Inbox collects from your audience. Business customers can request a data processing agreement at privacy@weekbird.app.
- EU representative: None appointed. EU residents can contact us at privacy@weekbird.app.
2. What we collect
| Data | What it includes |
|---|---|
Account | Name, email address, profile image, language, timezone, notification preferences. Password (stored only as a hash) or one-time sign-in codes (stored hashed, valid 10 minutes). Two-factor settings. |
Workspace | Workspace name, who it is for (yourself, a team or clients), members and roles, invitations. |
Sign-in and security | Sessions with the IP address and browser they came from, sign-in attempt counts used for rate limiting, and a record of important account and workspace actions. |
Connected channels | The account ID, name, handle and avatar the network returns, and the access credential it issues. Credentials are encrypted. We never ask for your network passwords. |
Content | Posts, drafts, schedules, media, ideas, plans, labels, comments between team members and approvals. |
Audience data (Inbox, analytics) | If you turn them on for a channel: comments, mentions and messages people send to that channel, with their public name, handle and avatar, and post performance figures the network provides. |
AI requests | The prompts you send to AI features, the content they act on, and the results. |
Billing | Your plan, subscription status, trial and refund records, and the customer and subscription references Dodo Payments gives us. Dodo collects your card and billing details; we never receive card numbers. |
Support | Messages you send us and any error reference you choose to include. |
We do not use advertising trackers, sell personal data, or build marketing profiles of you or your audience.
3. Why we use it
| Purpose | Legal basis (EU/UK GDPR) |
|---|---|
Provide the Service: accounts, workspaces, publishing, Inbox, analytics, AI features | Contract |
Send account email: sign-in codes, password resets, invitations, notifications you enable | Contract |
Keep the Service secure: rate limits, abuse prevention, audit records | Legitimate interests |
Billing, tax and accounting | Contract and legal obligation |
Support and service messages | Contract and legitimate interests |
Comply with law and enforce our terms | Legal obligation and legitimate interests |
4. Who receives it
- Service providers that host, store, send email and run features for us, under contracts that limit their use of the data. They are listed on our Subprocessors page.
- The networks you connect. When you publish, reply or request analytics, we send the needed content to that network. Its own privacy policy then applies.
- Dodo Payments, our Merchant of Record, which processes your purchase as an independent controller under its privacy policy.
- Your workspace. Members of a workspace see the content and audience data in it, according to their role.
- Authorities, when the law requires it, and a buyer of the Service if it is sold, under this policy.
5. Google and YouTube data
If you connect YouTube or Google Business Profile, Weekbird uses YouTube API Services and Google APIs to publish content, read channel and profile details, and show performance and comments you ask for. By connecting, you agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.
Weekbird's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, sell it, or use it to train AI models.
You can revoke Weekbird's access at any time in your Google account permissions or by disconnecting the channel in Weekbird.
6. Other networks and deleting network data
Weekbird uses each network's official interface and follows its developer terms, including the Meta Platform Terms, TikTok Developer Terms, LinkedIn API Terms and X Developer Agreement. To delete data Weekbird received from a network:
- Disconnect the channel in Weekbird. Its credential is deleted at once; content and audience data from it are removed with the workspace or on request.
- Or remove Weekbird in the network's own app settings (for Facebook and Instagram: Settings, Apps and websites). The credential then stops working.
- Or email privacy@weekbird.app and we will delete it within 30 days.
7. AI features
When you use an AI feature, the prompt and the content it needs are sent to the AI provider named on our Subprocessors page to produce the result. We send requests with provider-side storage turned off where the provider allows it. We do not use your content, your audience's messages or AI results to train models. Inbox AI only runs on a channel after you allow it.
8. Cookies
We use only cookies and browser storage needed to sign you in and remember your settings. See Cookies.
9. How long we keep data
| Data | Kept |
|---|---|
Account and workspace data | While the account or workspace exists. You can delete either in settings. |
Inbox comments and messages | At most 90 days after they arrive, or less if you set a shorter period. |
Inbox reply drafts | 30 days |
Incoming network notifications | 7 days |
Sessions and security records | While your account exists |
Uploaded media after deletion | Removed from storage within 7 days |
Encrypted backups | Up to 30 days, then overwritten |
Billing records | As long as tax and accounting law requires |
10. Where data is stored and international transfers
Our application and database run on servers in Germany. Media and backups are stored with Cloudflare R2 in Western Europe. Some providers, such as our email and AI providers, may process data outside the European Economic Area. Where they do, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses.
11. Security
Connections are encrypted in transit. Network credentials are encrypted at rest. Backups are encrypted. Sign-in supports two-factor authentication, sign-in attempts are rate limited, and staff access to customer workspaces is limited, logged and time-bound. If a breach affects your personal data, we will notify you and the authorities as the law requires.
12. Your rights
Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent you gave. You can export and delete your account and workspaces in settings, or email privacy@weekbird.app. We answer within one month.
If your data is in a customer's workspace (for example, you messaged a brand that uses Weekbird), contact that customer first; we will help them respond. You can also complain to your local data protection authority.
We do not sell or share personal data for cross-context behavioural advertising, as those terms are defined in California law.
13. Children
Weekbird is not for anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
14. Browser extension
The Weekbird Connections extension is used only to connect networks that have no official sign-in for apps. When you use it to connect such a network, it reads that site's session cookies and sends them to Weekbird over an encrypted connection, where they are stored encrypted and used only to act for you on that network. It reads nothing else.
15. Changes
We will post changes here with a new effective date, and email account owners before material changes take effect.
16. Contact
OD Bosnadev vl. Mirza Pasic, a sole proprietorship registered in the Federation of Bosnia and Herzegovina. Email privacy@weekbird.app.