Privacy Policy
Last updated 2026-10-26
Draft under legal review. It may change before Feeds opens to the public.
This policy explains how TheWiseMonkey LLC (“we”) handles personal data in Feeds. Contact for privacy questions and requests: [email protected].
1. Data about our customers
| Data | Why | Kept |
|---|---|---|
| Email, password hash, organization name | To run your account and sign you in | While the account exists, and up to 90 days after closure |
| API keys (as hashes), sessions (as hashes) | To authenticate requests | Until revoked or expired |
| Billing details | To charge plans and credits. Stripe holds card data; we never see full card numbers | As tax and accounting law requires |
| Usage records and request logs | To meter credits, prevent abuse, and fix problems | Up to 90 days for logs; the credit ledger for the life of the account |
| Emails we send you | Confirmation, password reset, billing notices | Sent through Resend; not kept by us |
The legal basis is the contract with you, and our legitimate interest in security and in preventing fraud.
2. Data in tracked posts
The Service delivers public posts from X and LinkedIn accounts that our customers choose. These posts can contain personal data of their authors and of people they mention: names, handles, public profile details, and the content of the posts.
- Source. We obtain public posts through third-party data providers, not by logging in to the platforms.
- Purpose and basis. We process them to deliver them to the customers who track the account, on the basis of legitimate interests: customers monitor public communication, and the data was made public by its author. Customers decide why they use it and are responsible for their own use.
- Retention. We keep a post while at least one customer tracks its account, and delete an account’s posts when the last tracker is removed. Request logs that include post data are deleted after at most 90 days.
- Your rights. If a post or profile about you is in Feeds, you can ask us to delete it, to stop processing it, or to tell you what we hold. Write to [email protected] with the account or post URL. We answer within 30 days.
We prohibit customers from using the Service to monitor private individuals; see the Acceptable Use Policy.
3. Service providers
We share personal data only with providers that help us run the Service, under contracts that limit their use of it:
- Oracle Cloud Infrastructure (hosting) and Cloudflare (network and security);
- Stripe (payments) and Resend (transactional email);
- linkdapi and twitterapi.io (public post data);
- Zoho (our email inbox).
We do not sell personal data and do not use it for advertising.
4. International transfers
We and some providers process data in the United States and other countries. Where the law requires it, transfers rely on the European Commission’s standard contractual clauses or an equivalent safeguard.
5. Security
Passwords are stored with scrypt; sessions, email links, and API keys are stored only as hashes. Data is encrypted in transit. Access to production systems is limited to the people who operate them.
6. Your rights
Depending on where you live, including under the GDPR and UK GDPR, you can ask to access, correct, delete, or export your data, to restrict or object to processing, and you can complain to your data protection authority. Write to [email protected].
7. Changes
We will post changes here and, for material changes, tell customers by email before they take effect.