Privacy Policy

Welcome to Tuezday AI (“Company,” “we,” “us,” or “our”). We are committed to protecting your personal data and respecting your privacy rights globally. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (tuedayai.com) and use our SaaS platform (collectively, the “Services”).

1. Our Role in Data Processing

Under the General Data Protection Regulation (GDPR) and similar global privacy frameworks, the entity determining the purpose of data processing is the Data Controller. For the personal data you provide to create an account and manage your subscription, Tuezday AI acts as a Data Controller. When our platform processes social media data or posts content to third-party platforms on your behalf, we act as a Data Processor under your explicit instructions.

2. Information We Collect

We collect information in three primary ways to ensure the functionality and security of our Services:

A. Information You Provide to Us

• Account & Contact Data: First and last name, email address, phone number, and authentication credentials (passwords).
• Financial Data: Billing address and payment information. This is securely processed directly by our payment provider (Stripe); we do not store full credit card numbers on our servers.
• Profile & Content Data: Information you provide to build your “brand voice,” including text context, preferences, and linked social media handles.

B. Information Collected Automatically

• Technical Data: IP addresses, browser type and version, time zone settings, operating system, and device information.
• Usage Data: Information regarding your interaction with our website, products, and services (e.g., clickstream data, feature usage).
• Cookies & Tracking Technologies: We use strictly necessary cookies to maintain your session and security, as well as analytical cookies to understand website traffic.

C. Information from Third Parties

If you register or log in using third-party OAuth providers (e.g., Google, X/Twitter, LinkedIn, Reddit), we receive your basic profile information (such as name and email address) in accordance with those providers’ privacy policies. Furthermore, we access and interact with social media APIs solely on your behalf when you connect your accounts to our platform.

3. Legal Basis for Processing (GDPR Compliance)

We process your personal data under the following lawful bases:

• Performance of a Contract: To provide our SaaS functionality, create your account, orchestrate your social media profiles, and process subscriptions.
• Legitimate Interests: To analyze and improve our platform, ensure cybersecurity, prevent fraud, and send you important service updates.
• Consent: To send promotional emails, utilize non-essential cookies, or when you explicitly connect third-party social accounts. You maintain the right to withdraw your consent at any time.
• Legal Obligation: To comply with applicable laws, tax regulations, or lawful government requests.

4. How We Share Your Information

We respect your privacy and do not sell your personal data. We share information strictly with trusted third-party service providers (acting as Sub-Processors) who are bound by strict confidentiality and data protection agreements:

• Infrastructure & Hosting: Supabase (Auth, Postgres, Storage), Railway, Redis.
• Payment Processing: Stripe.
• Communications: Resend (transactional and marketing emails).
• AI & Language Models: OpenAI, Anthropic, Google, and LiteLLM infrastructure for content generation. Note: Data sent to these APIs via Tuezday AI is used strictly for generating your content and is not utilized by these providers to train their foundation models.
• Social Media Platforms: X (Twitter), LinkedIn, and Reddit APIs (data is shared only when you actively instruct our platform to post or interact).
• Analytics & Diagnostics: Sentry (error tracking).

5. International Data Transfers

Tuezday AI operates globally, and our servers (via Supabase and Railway) may be located in the United States and other regions. If you access our Services from the European Economic Area (EEA), the UK, or Switzerland, your data may be transferred outside your jurisdiction. We ensure such transfers are protected by appropriate legal safeguards, primarily through the use of European Commission-approved Standard Contractual Clauses (SCCs) and robust Data Processing Agreements (DPAs) with our sub-processors.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy. Active account data is retained until the account is deleted. Upon a request for account deletion, we securely erase or anonymize your personal data within 30 days, except where we are legally obligated to retain it for tax, legal, or accounting compliance.

7. Your Global Privacy Rights

Depending on your jurisdiction (including the EEA, UK, California, Brazil, etc.), you are entitled to comprehensive rights regarding your personal data:

• Right to Access / Know: Request a copy of the personal data we process about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): Request the permanent deletion of your personal data.
• Right to Restrict or Object: Object to our processing of your data, particularly for direct marketing purposes.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Withdraw consent at any time (this does not affect the lawfulness of processing based on consent before its withdrawal).

To exercise these rights: Please email us at support@tuezdayai.com. We will acknowledge and process your request within 30 days. We strictly prohibit any discrimination against users for exercising their privacy rights.

EEA/UK Residents: If you believe our processing of your personal data infringes data protection laws, you retain the right to lodge a complaint with the Supervisory Authority in your country of residence.

8. U.S. State-Specific Privacy Rights (CCPA/CPRA, VCDPA, CPA)

If you reside in California, Colorado, Connecticut, Utah, or Virginia, the following state-specific rights apply:

• No Sale or Sharing: We do not “sell” or “share” your personal information for cross-context behavioral advertising as defined by U.S. state laws.
• Sensitive Data: We do not collect sensitive personal information (such as precise geolocation, race, or biometric data) beyond what is strictly necessary to authenticate your account.

9. Automated Decision-Making

While our SaaS product utilizes Artificial Intelligence (LLMs) to draft content, we do not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning our users. All content generated is subject to your final human review and approval before publication.

10. Children’s Privacy

Our Services are strictly designed for businesses and users aged 18 and older. We do not knowingly collect personal information from children under the age of 13 (or 16 in the EEA/UK). If we discover that a child has provided us with personal information, we will delete such data from our systems immediately.

11. Policy Updates

We may periodically update this Privacy Policy to reflect changes in global legal requirements or our operational practices. We will notify you of any material changes via email or via a prominent notice within our SaaS dashboard prior to the changes taking effect.

12. Contact Us

Tuezday AI is the Data Controller responsible for your personal data. If you have questions regarding this policy or wish to exercise your data subject rights, please contact our Data Protection Officer (DPO) / Privacy Team at: