Your data
locked in a vault

LunSoul Social is the owner of the service and, under the Israeli Privacy Protection Law, the “database owner” of the data you share with us.

For any privacy question you can write directly to [email protected] with the subject “Privacy”, and we commit to getting back to you within 7 business days.

We collect only what is needed for the service to work for you:

• Account details: email address, name, and a profile picture if you signed in with Google.
• Business details: the business name, website address, logo, field of activity, product descriptions, the business story, the owner’s name. Whatever you choose to share in the voice interview or the form.
• Content you upload: images, videos, audio clips, files, logos.
• Output created for you: videos, images, scripts, post captions.
• Payment details: the cardholder name and the last four digits. The full card number is not stored with us, only at the HYP payment processor.
• Usage data: the dates you signed in, which features you used, the performance of the posts that went live.
• Device data: browser type, operating system, IP address (to detect abuse and protect against break-ins).

Our use of the data falls into clear categories:

• Operating the service: creating content for you, publishing it and tracking performance.
• Quality improvement: learning which phrasings and styles work for your business, so the system aims closer to your voice next time.
• Communicating with you: operational emails about the subscription, renewal reminders, breakage alerts and fault reports.
• Issuing invoices and collecting payment through the payment processor.
• Protection and security: detecting unusual use, blocking break-in attempts, answering law-enforcement requests within the law.
• Marketing and showing examples: full details in section 5.

We do not sell personal data to third parties, and do not let them market to you through us.

To provide the service, we work with industry-leading infrastructure providers. All of them are contractually bound to protect the data, not to use it for their own purposes, and to meet the security level the law requires:

• Card processing and recurring charges · a licensed Israeli payment processor, where your full card details are stored.
• AI content creation · leading model providers, for creating the talking presenter, cinematic scenes, post images, and writing scripts and captions.
• Voice synthesis · a provider specializing in creating voice recordings for personalized presenters.
• Social network connection · a secure intermediary that maintains the connection to Facebook, Instagram, YouTube and TikTok, and holds the account tokens instead of us.
• Content storage · encrypted cloud providers storing the videos and images you created.
• Database · a secure provider holding account details, history and credits.
• Operational email delivery · a dedicated business email provider.
• Fault monitoring and log management · infrastructure providers for detecting bugs and handling faults.

We update the list of categories from time to time as the service evolves. Want to see the commercial identity of a specific provider? Send a request to [email protected] and we will provide the details subject to our business confidentiality classification.

In the examples we use only material that passed through the system:

• The final video or image, as it came out of the output.
• The brand name and logo, from what you entered.
• A link to your website as credit for correct attribution.

We do not expose in the examples your email, your phone, your account details, the plan level you pay for, or the content of the voice interview. Examples are shown only from the public output that came out of the system and could have been published anyway.

Want your business out of the examples? No problem: email [email protected] and we remove it within 7 business days.

When you connect your social account, Facebook, Instagram, YouTube, TikTok or LinkedIn give us only the permissions you approve. The data that arrives from them is what we call “platform data” here. In practice we access:

• The account’s username and avatar, to show “connected as”.
• The ability to upload a new post to the account.
• Performance numbers of the posts that we published for you: views, likes, comments, shares, saves and watch rate.

We do not read your private messages, do not see your follower list, and do not touch old posts we did not create. You can disconnect the account at any moment with one click from the dashboard.

How to disconnect and delete. Disconnecting the account from the dashboard revokes our permission and deletes that account’s platform data within 30 days. You can also revoke access directly inside the platform itself, without going through us:

• Facebook and Instagram · Business tools settings
• YouTube and Google · myaccount.google.com/permissions
• TikTok · Account settings → Manage connected apps
• LinkedIn · Settings → Permitted apps and services

For proactive deletion of all your platform data, without deleting your account with us, send a request to [email protected] with the subject “Platform data deletion”. We carry it out within 30 days and confirm back by email.

Our use of the YouTube API is subject to the YouTube Terms of Service and the Google Privacy Policy. Our use of the Meta, TikTok and LinkedIn interfaces is subject to each platform’s terms and developer policies.

Our Chrome extension publishes the content you created to the Facebook groups you chose. It runs in your browser and uses the Facebook account you are already signed in to. We do not ask for, do not collect and do not store your Facebook username and password at any stage.

What we do keep when you use the extension:

• Names and IDs of the Facebook groups you are a member of, so you can choose where to publish.
• The profiles and business pages available to you for publishing.
• A record of the posts published: when, to which group, and whether they succeeded.

This data is used solely to operate the publishing service for you. It is not sold and not passed to any third party. Disconnecting the extension stops the collection, and deleting the account deletes it.

Retention periods depend on the type of data:

• Active account data: as long as you have an open account with us.
• Content you created (videos, images, scripts): 24 months from creation. After that the content moves to a reduced archive.
• Billing details and invoices: 7 years, as required by the Tax Authority.
• Technical logs: 90 days.
• The voice interview: the recording is deleted after 30 days; the text transcript is kept with the business profile.
• A closed account: a 90-day grace period after closure (for accounting reconciliation and backups), and then the data is deleted or anonymized.

Your data travels over encrypted channels only, and is stored encrypted in our databases. Access to the data is given only to authorized team members, only when there is an operational need, and always subject to an audit log.

Passwords are not stored with us. The account is opened with the email address you provided, and returning sign-ins use a one-time code by email or your Google account. If unusual access to the account is detected, we block it and send you an email alert.

In the event of a significant security incident that could affect you, we will notify you within 72 hours of detection, in line with the statutory reporting duty.

At any moment you may:

• Review the data held about you. Send an access request and we will send you an export within 30 days.
• Correct wrong data. Most details can be updated from the dashboard.
• Delete the account. Directly from account settings, or in writing to the support email.
• Receive a copy of the content you created before deletion. Send a request to the support email and we will send you a file with the videos and images.
• Remove your business from our public examples.
• File a complaint with the Privacy Protection Authority, if you feel something is not right.

Our site runs basic cookies to keep you signed in, and limited analytics cookies that measure the site’s performance. We do not run third-party advertising cookies that follow you across other sites.

The cookie banner that appears on your first visit lets you approve only the essential cookies. You can change the preference at any moment from the dashboard.

The service is intended for businesses, not for children. We do not knowingly collect data from minors under 18. If we learn that a minor signed up, we delete the account and destroy the data.

Some of our providers operate outside Israel, mainly in the United States and the European Union. The transfer is made under the standards required by Israeli law, through contracts with the providers that bind them to a level of protection similar to Israel’s.

Providers that also operate under the European GDPR are signed on the European Commission’s Standard Contractual Clauses (SCC).

We may update the policy from time to time, to reflect changes in the service, new providers or a legal requirement. A significant change is shown on the dashboard and sent by email at least 14 days before it takes effect.

Email:

[email protected]

Privacy inquiries:

Send to the same email with the subject “Privacy”, and we route the handling to the data officer.

Deletion or export requests:

The same email, with the subject “Deletion” or “Export”. An answer within 7 business days.