Privacy Policy

1. Who this policy covers

This policy applies to the woaa.social business portal at business.worldofaiagent.com, its API, and the public website at main.worldofaiagent.com (together, the “Service”). It covers business owners, their team members, and people whose data appears in content a business manages through the Service. The woaa.social consumer app has its own privacy policy.

For your account and workspace information, woaa.social decides how the data is used. For personal data contained in content your business uploads or receives through connected accounts, such as customer comments, we process it on your business's behalf and according to your instructions.

2. What we collect

• Account data: your name, email address and password (stored only as a salted hash). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Workspace data: your business name, website, the documents, images and other sources you add, the facts you confirm, brand settings, campaigns, drafts, posts, team members and their roles.
• Connected account data: when you connect a social account, we receive an access token (stored encrypted), the account's ID, name and handle, and, as the platform permits, the posts we publish for you, their results, and comments or messages on them.
• Search and website data: if you connect Google Search Console or Google Business Profile, we receive search performance and profile data for the properties you choose.
• Billing data: your plan, billing status and invoices. Card details are collected and stored by Stripe, not by us.
• Usage and device data: IP address, browser and device information, pages visited, actions taken and timestamps, used to run and secure the Service.
• Communications: messages you send to support and feedback you submit in the portal.

3. How we use it

• To provide the Service: learning your business, planning campaigns, preparing and checking drafts with Kocco, publishing approved posts and reporting results.
• To send AI requests to the providers listed on our Subprocessors page, only as needed to produce what you asked for.
• To keep the Service secure, prevent abuse and fraud, and enforce our Terms and Acceptable Use Policy.
• To manage trials, subscriptions and billing.
• To send account emails such as email verification, password resets, invitations and important changes.
• To understand how the Service is used and improve it, using aggregated information where possible.
• To comply with legal obligations.

We do not sell personal data, and we do not use your business content, documents or posts to train AI models.

4. Legal bases

Where the GDPR or similar laws apply, we rely on: performing our contract with you (providing the Service); our legitimate interests (security, fraud prevention, improving the Service), balanced against your rights; your consent, where we ask for it, which you can withdraw at any time; and legal obligations (for example tax and accounting records).

5. Who we share it with

• Service providers that host, secure, bill, email and process AI requests for us, listed on our Subprocessors page. They receive only the data needed for their task.
• Platforms you connect, when you approve a post or reply for publishing on them.
• Your team: members of your workspace can see workspace data according to their role.
• Legal and safety: when required by law, or to protect the rights, safety and security of our users, the public or the Service.
• Business transfers: if woaa.social is involved in a merger, acquisition or sale of assets, data may transfer under the same protections described here.

6. Data from connected platforms

We use data received from Meta (Facebook, Instagram, Threads), TikTok, X, LinkedIn, Bluesky, Mastodon and Google only to provide the features you use: publishing your approved posts, showing their results, drafting replies and reporting search performance. We do not sell this data, use it for advertising, or use it to train AI models.

woaa.social's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke our access at any time from the platform's own settings. See Data deletion for steps.

7. International transfers

Our servers are hosted in Hetzner data centers, and some of our providers process data in other countries, including the United States. Where the law requires safeguards for these transfers, we rely on the transfer mechanisms our providers make available.

8. How long we keep it

We keep account and workspace data for as long as your account is active. When a workspace is deleted, its data, including connected account tokens, is removed from our active systems; copies in backups expire on their normal schedule. We keep billing records and limited security logs for as long as the law or legitimate security needs require.

9. Security

We use HTTPS for all traffic, encrypt connected account tokens at rest, store passwords only as salted hashes, and limit access by role. No system is perfectly secure, and we cannot guarantee absolute security. Read more on our Security page.

10. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion and correction, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

Workspace owners can export workspace data from Settings, Account, Retention and export. To make any other request, email [email protected] from the address on your account. We will verify your identity before acting. If your data is in a workspace managed by a business, we may refer your request to that business.

11. Children

The Service is for businesses and is not directed at children. You must be at least 18 years old to create a business account. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the Service changes. We will update the date above, and for material changes we will notify workspace owners by email or in the portal before they take effect.

13. Contact

Questions about privacy: [email protected]. You can also reach us through our Support page.