Privacy Policy

What we collect

• Account details: your name, email address and password (stored hashed by our authentication provider; we never see it).
• Workspace content you add: brands and clients, content pillars, ideas, scripts, captions, posts, schedules, photos, videos, cover images, notes, approval links and the comments clients leave on them.
• Client contact details you choose to enter, such as the email address a review link is sent to.
• Connected social accounts: when you connect Instagram, Facebook, TikTok or YouTube, we receive an access token and basic profile details (account ID, name or username, profile picture) from that platform, plus the IDs and links of posts Meza publishes for you.
• Technical data needed to run the service: session cookies, IP address and device/browser details in server logs.

We do not use advertising or analytics cookies, and we do not track you on other websites.

How we use it

• To run Meza: save your work, show your calendar and feed preview, and keep you signed in.
• To publish the posts you schedule to the social accounts you connected, at the time you chose, and to show you whether each post was published.
• To send emails you ask for (review links, reminders, client responses) and service emails about your account.
• To generate AI suggestions (ideas, scripts, captions, classifications) when you use those tools.
• To keep Meza secure, fix problems and comply with the law.

We do not sell your personal information, and we do not use it for advertising.

Data from Instagram, Facebook, TikTok and YouTube

Meza only asks for the permissions it needs to publish content you create and to show you your own accounts and posts. We use data from these platforms only to provide those features to you. We never sell it, never use it for advertising, and never share it with anyone except the service providers below that are needed to run Meza.

Access tokens are stored encrypted and are only used by our servers. You can disconnect an account at any time in Settings → Connections; we then delete its tokens. You can also revoke Meza's access directly from each platform's settings.

YouTube: Meza uses YouTube API Services. By connecting a YouTube account you agree to the YouTube Terms of Service (www.youtube.com/t/terms), and Google's Privacy Policy (policies.google.com/privacy) applies to Google's handling of your data. You can revoke Meza's access at myaccount.google.com/permissions. When you revoke access or disconnect, we delete the YouTube data we stored within 7 days.

Meza's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Who we share data with

We share data only with providers that help us run Meza, under contracts that limit their use to providing their service to us:

• Supabase: database, authentication and file storage.
• Vercel: hosting and server functions.
• Resend: sending emails.
• Anthropic: AI features. The text you send to an AI tool is processed to generate a response, under terms that do not allow it to be used to train their models.
• Stripe (once paid plans launch): payments. Meza never sees or stores your full card number.
• The social platforms you connect (Meta, TikTok, Google/YouTube): when you publish, the content and settings of that post are sent to the platform you chose.

People you invite to your workspace, and clients you send a review link to, can see the content you share with them. We may also disclose information if the law requires it or to protect the safety of our users.

How long we keep it

We keep your data while your account is active. When you delete your account or ask us to, we delete your data within 30 days, except where we must keep something by law (for example, billing records). Backups that contain it are overwritten within a further 30 days.

Your choices and rights

You can view and edit most of your data in Meza at any time. You can ask us for a copy of your data, to correct it, or to delete it by writing to info@mezaonline.com. See how to delete your data at mezaonline.com/data-deletion.

If you live in California or another US state with a privacy law, you have the right to know, access, correct and delete your personal information, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioral advertising.

Security

Data is encrypted in transit (HTTPS). Social account tokens and review-link secrets are also encrypted at rest. Access to workspace data is limited to members of that workspace by database rules. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Children

Meza is for people 18 and older. We do not knowingly collect data from children under 13; if you believe a child gave us data, contact us and we will delete it.

Changes

If we change this policy, we will update the date above and, for important changes, let you know by email or in the app before they take effect.