Privacy Policy

About Genna & this policy

Genna is an AI social media assistant that helps creators and businesses plan, generate, schedule, and publish content, and manage messages and analytics across connected social media platforms.

This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the choices and rights you have. It applies to our websites genna.co and genna.com.br, our web and mobile applications, our APIs, and any related services (together, the “Services”).

Genna is operated by [Genna Tecnologia Ltda.] (Brazil) and, for users outside Brazil, by [Genna Inc.] (United States) (together, “Genna”, “we”, “us”, “our”). Depending on where you are located, one or both of these entities acts as the controller of your personal information (the party that decides why and how it is processed). Registered details, addresses, and identifiers should be confirmed with counsel before publishing.

Who this covers

This policy covers our account holders and their authorized users (“you”). If you interact with a Genna customer’s social media presence (for example, you send a direct message that Genna helps manage), that customer is the controller of your information and their own privacy notice applies; Genna acts as a processor on their behalf.

Summary in plain language

The short version

We collect the information you give us (account and billing details), the information needed to connect and act on your social accounts (secure access tokens, profile data, content, and analytics), and standard usage data. We use it to run the Services you ask for, to help you create and schedule content that you review and approve, keep the platform secure, and meet legal duties. You review and approve everything before it is published, and Genna does not post to any connected platform without your consent. We do not sell your personal information, and we do not use the private content of your accounts to train foundation AI models. You can disconnect any platform, export or delete your data, and exercise your rights under Brazilian (LGPD), European (GDPR/UK GDPR), and United States (CCPA/CPRA and other state) laws at any time.

This summary is provided for convenience only. It does not replace the full policy below, which controls.

Key terms

Personal information — Any information relating to an identified or identifiable individual. Also called “personal data” under GDPR and “dados pessoais” under LGPD.

Processing — Any operation performed on personal information, such as collecting, storing, using, sharing, or deleting it.

Controller — The party that determines the purposes and means of processing. For your account data, Genna is the controller.

Processor / operator — A party that processes personal information on behalf of a controller. Genna acts as a processor when it manages your audience’s data on your instruction.

Connected platform — A third-party social media service you authorize Genna to access, such as Instagram, Facebook, TikTok, YouTube, or X.

Access token — A secure credential issued by a connected platform that lets Genna act within the scope you approved, without ever seeing your platform password.

Information we collect

Information you provide

• Account and identity data: name, email address, phone number, username, password (stored only as a salted hash), profile photo, company name, country, and language preference.
• Billing data: plan, transaction history, billing address, and tax identifiers. Card numbers are collected and processed directly by our payment processor (Stripe); Genna does not store full card numbers.
• Content you create or upload: drafts, captions, images, video, audio, hashtags, prompts, brand guidelines, and scheduling instructions.
• Support and communications: messages you send us, survey responses, and records of your requests.

Information from connected platforms

When you connect a social account, we receive, within the scope you approve, items such as: your profile and page/channel identifiers, access tokens, published and scheduled content, comments and direct messages you ask Genna to manage, audience and engagement metrics, and advertising insights where you enable them. The exact fields differ by platform and are listed in Section 06.

Information we collect automatically

• Device and connection data: IP address, browser and operating system, device identifiers, and time zone.
• Usage data: features used, pages viewed, actions taken, and diagnostic logs.
• Cookies and similar technologies: as described in Section 13.

Information from other sources

We may receive limited data from our service providers (for example, fraud and delivery signals from Stripe), from partners who refer you, and from public sources, always consistent with this policy and applicable law.

Sensitive data

Genna does not ask you for special-category or sensitive personal information (such as health, religion, political views, or biometric identifiers). Please do not upload such information unless it is strictly necessary for a post you have chosen to publish, in which case you are responsible for having a lawful basis to do so.

How & why we use your information

We use personal information for the purposes below. For users in the EU, UK, and Brazil, we also identify the legal basis we rely on.

Purposes and legal bases (GDPR Art. 6 / LGPD Art. 7)

Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal. Where we rely on legitimate interests, you may object as described in Section 12.

Connected social media platforms

Genna is designed to work across the major social networks. You choose which accounts to connect, and you can disconnect any of them at any time. Connecting an account authorizes Genna, through the platform’s official API and the permissions you approve, to carry out the actions you request (such as publishing a post, reading comments, or retrieving analytics). We request the narrowest set of permissions needed for the features you use, and we handle the data we receive in line with each platform’s developer terms and this policy.

General principles for every platform

• We access your platform data only to provide features you have enabled, and only within the scope of the permissions you granted.
• We never receive or store your platform passwords. Access is granted through secure tokens that you can revoke at any time from the connected platform or from your Genna settings.
• We do not use data obtained from one platform to build advertising profiles, and we do not sell platform data.
• When you disconnect a platform or delete your Genna account, we delete or de-identify the associated tokens and cached platform data as described in Section 10, and we honor deletion signals that platforms send us.
• Your use of each platform through Genna remains subject to that platform’s own terms and privacy policy.

Per-platform breakdown

What Genna accesses on each platform, why, and how to revoke it

YouTube API Services notice

Genna uses YouTube API Services. You can review the YouTube Terms of Service and the Google Privacy Policy, and you can revoke Genna’s access to your Google data through the Google security settings page at any time.

Platform names, APIs, and settings paths are the property of their respective owners and may change; where a platform updates its requirements, we update our handling accordingly.

AI, automation & content generation

Genna uses artificial intelligence to help you draft captions, generate or edit images, suggest posting times, summarize comments, and prepare replies that you review or that you configure within rules you approve. AI features assist you; they do not act on their own.

• You review, approve, and publish. AI features act only on your instructions and inputs. You decide what is published, and nothing is posted to a connected platform without your review and approval. Scheduling and auto-reply features carry out only the specific content and rules you approved. You are responsible for reviewing generated content before it goes live.
• Foundation model training. We do not use the private content of your connected accounts, your uploads, or your audience’s messages to train third-party foundation AI models, and we do not permit our AI subprocessors to do so.
• Service improvement. We may use aggregated or de-identified signals to improve our own features. Where required, we ask for your consent first.
• AI subprocessors. To provide AI features we send the specific inputs needed for a task to vetted providers under contracts that restrict their use of that data to serving your request. These providers are listed on request and in our subprocessor list.
• Automated decisions. Genna does not make decisions that produce legal or similarly significant effects about you without human involvement. Where any meaningful automated decision-making applies, you may request human review as described in Section 12.
• Disclosure duties. You are responsible for labeling AI-generated or AI-assisted content where a platform or applicable law requires it.

How we share information

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under California law. We disclose information only as follows:

• Service providers (processors): hosting and cloud infrastructure, payment processing (Stripe), email and messaging delivery, analytics, customer support tooling, and AI providers, each bound by contract to process data only on our instructions.
• Connected platforms: to carry out the actions you request, such as publishing a post you created.
• At your direction: with people or tools you choose to connect.
• Legal and safety: to comply with law, respond to lawful requests, enforce our terms, or protect the rights, safety, and property of Genna, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy and notice where required.

A current list of our subprocessors is available on request at privacy@genna.co.

International data transfers

Genna operates in Brazil and the United States and may process data in other countries where we or our providers operate. When we transfer personal information across borders, we use safeguards recognized by law:

• From the EU/UK: Standard Contractual Clauses (and the UK Addendum/IDTA), adequacy decisions where available, and supplementary measures where appropriate.
• From Brazil: transfer mechanisms permitted under LGPD Art. 33, including standard clauses, specific contractual guarantees, or your consent where required.

You may request a copy of the relevant safeguard by contacting us.

How long we keep data

We keep personal information only for as long as needed for the purposes described in this policy, then delete or de-identify it. Typical periods:

• Account data: for the life of your account and up to a reasonable period afterward for backups and dispute resolution.
• Access tokens and cached platform data: deleted or de-identified promptly after you disconnect a platform or close your account, subject to short technical backup cycles.
• Billing records: retained for the periods required by tax and accounting law.
• Logs and security data: retained for a limited period for reliability and abuse prevention.

Where law requires longer retention, we keep the minimum necessary and restrict further use.

How we protect data

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit and at rest, access controls and least-privilege permissions, secure storage of credentials, monitoring and logging, and staff confidentiality obligations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the competent authorities where the law requires.

Your privacy rights

Depending on where you live, you have some or all of the rights below. We do not discriminate against you for exercising them.

Rights available to most users

• Access the personal information we hold about you and obtain a copy.
• Correct inaccurate or incomplete information.
• Delete your information, subject to legal exceptions.
• Port your information to another service in a structured, machine-readable format.
• Object to or restrict certain processing, including direct marketing.
• Withdraw consent where processing is based on consent.

Brazil (LGPD)

In addition to the above, you may request confirmation that we process your data, information about with whom we share it, anonymization, blocking, or deletion of unnecessary or excessive data, and information about the consequences of refusing consent. Our Data Protection Officer (Encarregado) can be reached at privacy@genna.co. You may also contact Brazil’s National Data Protection Authority (ANPD).

Europe and the United Kingdom (GDPR / UK GDPR)

You may lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office). Where processing is based on consent or contract and carried out by automated means, you also have the right to data portability.

United States (California and other states)

If you are a California resident, you have the right to know, delete, correct, and to opt out of “sale” or “sharing” of personal information and of certain profiling. We do not sell or share personal information as defined by the CCPA/CPRA. Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws have comparable rights, including the right to appeal a decision on your request. You may use an authorized agent, and you may submit an opt-out preference signal (such as Global Privacy Control), which we honor.

How to exercise your rights

Email privacy@genna.co or use the tools in your account settings. We will verify your identity and respond within the timeframes set by applicable law (generally up to 30 days under LGPD, one month under GDPR, and 45 days under US state laws, each extendable where permitted). If we decline a request, we will explain why and, where available, how to appeal.

Cookies & similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Services, and understand usage. We group them as strictly necessary, functional, and analytics cookies. Strictly necessary cookies are always on because the Services will not work without them. For other categories, we ask for your consent where required and provide controls through our cookie banner and your browser settings. Withdrawing consent may affect some features.

Children & teens

The Services are intended for businesses and adults. They are not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 in the EU/UK, or the equivalent age of digital consent in your country; in Brazil, we apply the LGPD’s special protections for children and adolescents). If you believe a child has provided us personal information, contact privacy@genna.co and we will delete it.

Third-party links & services

The Services may link to or integrate with third-party websites and services, including the connected platforms in Section 06 and our payment processor. Those third parties operate under their own terms and privacy policies, and we are not responsible for their practices. We encourage you to review them.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you by email or an in-product notice before the changes take effect. Your continued use of the Services after an update means you accept the revised policy, unless the change requires your consent, in which case we will ask for it.

Contact & complaints

For any privacy question or request, or to reach our Data Protection Officer (Encarregado):

Privacy team — privacy@genna.co

Data Protection Officer — privacy@genna.co

Controllers — [Genna Tecnologia Ltda.], [address], Brazil · [Genna Inc.], [address], United States

You also have the right to complain to a supervisory authority: in Brazil, the ANPD; in the EU, your local Data Protection Authority; in the UK, the Information Commissioner’s Office (ICO); and in the United States, your state Attorney General. We appreciate the chance to address your concerns first, so please consider contacting us before you file.