Privacy Policy

• Your account: email address, your name if you give one, and a hashed version of your password. We never store the password itself.
• Your brand: everything you tell your manager during onboarding and in the Brain — your voice, audience, products, restrictions, plus any reference images or logos you upload.
• Your content: the posts, captions and images your manager produces, your approvals, edits and rejections, and the reasons you give — which is what it learns from.
• Your connected account: if you connect Instagram, we store the account id, its username, and an access token, encrypted at rest.
• Usage: what each AI request cost, per brand, so you can see where your tokens went.
• Product activity: while Mayastic is in beta, which screens you open and which actions you take (for example opening Create or saving your strategy), linked to your account. Only our team sees it, to decide what to improve. It is recorded on our own servers, with no third-party analytics.

One cookie, for your session, so you stay signed in. Your browser also remembers your theme preference locally. There is no advertising, analytics or tracking cookie, and no third-party tracker on this site.

We don't sell your data, we don't share it for advertising, and we don't use your photos, brand material or posts to train AI models. Two services process it because the product cannot work otherwise:

• OpenAI receives your brand context and the instructions needed to plan, write and generate images. Your brand material is sent as data, kept separate from our own instructions.
• Meta (Instagram) receives the posts you publish, and gives us the account information you authorized.

We may also disclose data if the law requires it. If we ever add another processor, this list changes with it.

When you connect Instagram we ask Meta only for what publishing needs: to see the Facebook Pages you manage, to read the basic profile of the professional Instagram account linked to a Page, and to publish content to it.

• We publish what you approved. If you switch on automatic mode, or grant autonomy for a specific pillar after a streak of clean approvals, your manager publishes under the rules you set — and tells you each time it does.
• We never read your direct messages, and we don't post to anything other than the account you connected.
• You can disconnect at any time from Settings, or revoke our access from Instagram itself. Either one stops publishing immediately.

• Access tokens are encrypted at rest with AES-256-GCM and never written to logs.
• Passwords are hashed with scrypt and a per-user salt.
• Every query is scoped to your workspace and brand on the server.

We keep your brand data and content while your account exists, because that history is what stops your manager from repeating itself and what it learns your voice from. Usage records are kept for billing history. Product activity is deleted after 180 days.

There is no self-service delete button yet, so deletion is by request: email from the address on your account and we will delete your account, your brand data, the content produced for it and any connected account within 30 days, and confirm when it's done.

To cut off access without deleting anything, disconnect Instagram in Settings, or remove Mayastic from your Instagram account's permissions.

If this policy changes in a way that affects you, we'll say so in the app rather than quietly editing this page. Questions about any of it: .

This service is operated by and isn't intended for children.