Privacy Policy

For each Instagram, Facebook, YouTube or TikTok account you connect: the account or channel name, its ID, profile picture, and basic profile information. For Facebook and Instagram, also the platform's ID for the person who granted the connection, which we need to act on data-deletion requests Meta forwards to us

Messages, comments, posts, videos and media content from the accounts you connect, limited to what you authorize us to access

Information about how you use our service, including feature usage and interaction patterns

IP address, browser type, device information, and authentication tokens

Records of your communications with our support team

When someone opens a campaign link shared through Paloom, we record the time of the click, the browser type, the referring page and a keyed one-way hash of the visitor's IP address, used only to count unique clicks. The IP address itself is not stored, and the hash cannot be reversed without a secret key that is never kept alongside the data.

When you connect an Instagram or Facebook account, we access your profile information, posts, comments, and messages through the Meta Graph API, in accordance with the Meta Platform Terms.

If you remove Paloom in your Instagram or Facebook settings, the connection stops working and Paloom asks you to reconnect it. If you also ask Meta to delete your data, Meta forwards the request to us and shows you a confirmation code and a link where you can follow it. We then delete the data of every account you connected to Paloom with that login on that platform: its posts, comments, messages and media, and, within about a day, the parts of your AI profile built from it. Your Paloom account and the accounts you connected from other platforms stay; to delete those, delete your Paloom account. Some requests need a manual check first, for example when an account was connected again after the request or when we cannot yet tell whether an older connection is yours; the status page shows them as in progress until they are done.

When you connect a TikTok account, we access its profile information (name, username, profile picture, bio, verification status and follower, following and video counts), your videos with their captions, cover images, links and like and comment counts, and the comments on your videos, including each commenter's name, username, profile picture and TikTok ID, through TikTok's official API. We use them to show the comments in your inbox, to draft reply suggestions in your tone of voice (see AI Service Providers under Data Sharing), to post the replies you choose to send and to show statistics about your comments. You can revoke Paloom's access at any time in your TikTok account's settings.

When you connect a YouTube channel, we access your channel information, the public comments on your videos, and video metadata through the YouTube Data API Services in order to display, manage, and reply to comments on your behalf.

Your YouTube channel's ID, name, handle and profile picture; the titles, descriptions, thumbnails and publication dates of your videos; and the comments and replies on your videos, including each commenter's display name, profile picture and channel ID. We request a single Google permission (the youtube.force-ssl scope) and do not access your Gmail, contacts, Google Drive or any other Google service.

Only to provide the features you see in Paloom: showing your YouTube comments in your inbox, drafting reply suggestions in your tone of voice, posting the replies you choose to send, and showing statistics about your comments. We do not use Google user data for advertising, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

Google user data and the access tokens Google issues to us are stored in our database, hosted by Supabase, and are transmitted over encrypted connections. Each customer's data is isolated from every other customer's and is only visible in your own Paloom account.

To draft a reply suggestion, the text of the comment and the context of the video are sent to our AI service provider OpenRouter, which forwards the request to the AI model provider we select. Supabase stores the data as our hosting provider. We do not sell Google user data and do not transfer it to anyone else, except where the law requires it.

We keep the data for as long as your YouTube channel is connected. When you disconnect the channel, we revoke and delete the access tokens and stop retrieving data; comments already imported stay in your workspace until you delete your Paloom account, which permanently deletes all of it, or until you ask us to delete it earlier. The one exception is a commenter's name and profile picture while another Paloom customer's inbox still shows that person; they are deleted within 14 days once none does (see Data Retention).

You can disconnect your channel at any time in Paloom under Settings, or revoke access in your Google account's security settings. To have your Google user data deleted, delete your account in Paloom or write to support@paloom.studio.

You sign in with your Paloom email address and password, or with Google or Apple. The first time you sign in with Apple, Apple shares your name once, and we save it to your Paloom account. Paloom accounts are created on the web, not in the app.

Your sign-in session and your app settings, such as language and display mode. Signing out removes the session; uninstalling the app removes everything the app stored on the device.

With each request, the app sends its platform (iOS or Android) and version number to our servers, so we can tell you when an update is required.

The app checks for updates with Expo (650 Industries, Inc., USA), the service that delivers them. These checks carry the app's platform, version, update channel and a random installation identifier that is not linked to your Paloom account.

The app contains no advertising and no analytics or tracking tools, sends no push notifications, and does not access your camera, photos, contacts or location.

In the app, open Settings and tap Delete account, then confirm in your account settings in the browser. You can also delete your account on the web or by email; deletion removes your account and its data as described under Data Retention.

You explicitly consent to our processing of the data of the accounts you connect, including AI-assisted analysis and reply drafting

Processing necessary to provide our service as agreed

To improve our service quality and security

OpenRouter (OpenRouter, Inc., USA), which forwards requests to the AI model providers we select (currently including OpenAI and Google) for content analysis and reply generation (subject to their privacy policies)

Supabase for data storage and authentication; Expo for delivering updates to the mobile app

When required by law or to protect our rights

Until you delete your account or withdraw consent

Comments, messages and content imported from Instagram, Facebook, YouTube and TikTok are kept while the account is connected and afterwards until you delete your Paloom account or request earlier deletion

The name, username and profile picture of a person who comments on or sends a message to an account connected to Paloom are kept as long as any Paloom inbox still shows a comment or conversation of theirs, including the inboxes of other Paloom customers the same person has written to. Deleting your account or a connected account's data removes their comments and messages from your inbox, but these details only once no inbox shows them any more. They are then deleted automatically within 14 days

Up to 2 years for service improvement

For as long as the offer the link belongs to exists; deleted together with the offer or the account

Your customer record and invoices with our payment provider Stripe are kept after you cancel your subscription or delete your account, because tax and commercial law require us to keep them, currently for up to ten years (GDPR Art. 17(3)(b))

Request a copy of your personal data

Correct inaccurate or incomplete data

Request deletion of your personal data

Limit how we process your data

Receive your data in a structured format

Object to processing based on legitimate interests

Withdraw consent at any time