How We Protect Your Privacy

Protomate ("Protomate", "we", "us", "our") is a social media automation service for e-commerce store owners and marketing agencies, operated by VISIONALTECH UK LTD, a private limited company registered in England and Wales under company number 13564223, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For the purposes of the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and applicable data protection law, VISIONALTECH UK LTD is the data controller of the personal data described in this policy.

Contact for privacy matters: contact@protomate.app(subject line: "Privacy Request").

This policy explains what personal data we collect when you use Protomate (the website at protomate.app, the web application, and related services), why we collect it, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have.

It does not cover third-party websites or services we link to, or the social media platforms you choose to connect (such as Facebook, Instagram, Pinterest, TikTok, or WordPress), which are governed by their own privacy policies.

Information you give us

• Account data: your name, email address, and password (stored only in hashed form via our authentication provider).
• Billing data: your plan, billing country, and subscription status. Card details are collected and processed directly by our payment provider (Stripe) and are never stored on our systems.
• Store and brand data:your store's web address, business name, logo, brand colours, product catalogue, brand voice answers, target audience, languages, and any promotional details you provide. Where this includes personal data (for example, a name in a product description) we process it on your behalf.
• Content you create or approve: captions, images, videos, schedules, and feedback you submit within the service.
• Support and communications: the content of messages you send us.

Information we collect automatically

• Usage data: pages viewed, features used, and actions taken within the service, used to operate and improve the product.
• Device and technical data: IP address, browser type, device type, and similar technical identifiers.
• Cookies and similar technologies: see section 6 below. On our marketing pages, analytics and marketing cookies are only set with your consent.

Information from connected accounts

When you connect a social media or publishing account, we receive access tokens and account identifiers needed to publish on your behalf (for example, Facebook Page IDs, Instagram Business account identifiers, Pinterest board IDs, TikTok account identifiers, and WordPress site credentials). We request only the permissions necessary to provide the service. You can disconnect these accounts at any time.

We do not intentionally collect special category data (such as data revealing health, religion, or political opinions). Please do not submit such data into the service.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can ask us for more detail about that balancing at any time.

Where we rely on consent (for non-essential cookies and marketing), you can withdraw it at any time without affecting processing carried out before withdrawal.

Protomate uses artificial intelligence to generate captions, images, and videos and to scan the store information you provide. To do this, the content and brand information you submit is sent to our AI sub-processors (listed in section 7) for the sole purpose of generating output for you.

We do not use your content to train our own models. Our AI sub-processors act under contract and are not permitted to use your content for their own purposes beyond providing the generation service to us, in accordance with their terms.

We use strictly necessary cookies to make the service work (for example, to keep you logged in, remember your locale preference, and remember your cookie choices). On our marketing pages, we use analytics and, where applicable, marketing cookies only with your consent, managed through our cookie banner using Google Consent Mode v2.

We do not load non-essential cookies before you consent, and you can change or withdraw your choices at any time using the "Cookie settings" link in our footer.

Analytics and marketing providers used on marketing pages are listed in section 7.

We share personal data with trusted third parties who process it on our behalf, under contract, and only as needed to provide the service. Our current sub-processors are:

We may also disclose personal data where required by law, to enforce our terms, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you and this policy will continue to apply to your data).

We do not sell your personal data.

We are established in the United Kingdom, and several of our sub-processors are located outside the UK and the European Economic Area (EEA), including in the United States.

Where we transfer personal data outside the UK or the EEA, we ensure an appropriate safeguard is in place, which may include:

• transfers to countries covered by a UK "adequacy" decision or an EU adequacy decision;
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;
• the EU Standard Contractual Clauses (SCCs) for transfers concerning EEA users;
• for transfers to the USA, reliance on the relevant data protection framework and/or the SCCs/IDTA as applicable.

You can request more information about the specific safeguards applied to a given transfer by contacting us at contact@protomate.app.

We keep personal data only as long as necessary for the purposes described:

• Account and store data: for the life of your account, then deleted or anonymised within 90 days of account closure, unless we must keep it longer for legal reasons.
• Billing and transaction records: retained for the period required by tax and accounting law (in the UK, generally 6 years).
• Support communications: up to 2 years after resolution.
• Marketing-consent and cookie records: for the duration of the consent plus a reasonable period to evidence compliance.
• Connected-account tokens: until you disconnect the account or close your account (deleted within 24 hours of disconnection for Pinterest; immediately on disconnection for other channels where technically feasible).

Under UK and EU data protection law, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• eraseyour data ("right to be forgotten"), in certain circumstances;
• restrict or object to our processing, in certain circumstances;
• data portability — receive your data in a structured, commonly used, machine-readable format;
• withdraw consent at any time, where we rely on consent;
• not be subject to solely automated decisions producing legal or similarly significant effects (our content generation does not fall into this category, as it does not make decisions about you).

To exercise any of these rights, contact us at contact@protomate.appwith subject "Data Rights Request". We will respond within one month, as required by law. We will not charge a fee unless your request is manifestly unfounded or excessive.

Complaints.If you are unhappy with how we handle your data, you can complain to a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO), www.ico.org.uk. If you are in the EEA, you may complain to your local data protection authority. We would appreciate the chance to address your concerns first, so please consider contacting us before doing so.

We take appropriate technical and organisational measures to protect your personal data, including encryption in transit, hashed credentials, encrypted OAuth tokens at rest, access controls, and use of reputable infrastructure providers. No system is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to notify you and the relevant authority of any breach where legally required.

Protomate is not intended for anyone under the age of 16 (or the applicable age of digital consent in your country). We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us at contact@protomate.app and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you by email or in-app notice. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.

VISIONALTECH UK LTD
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Privacy contact: contact@protomate.app

Website: protomate.app

For platform-specific requests, include one of these subject lines:

• "Data Rights Request" — GDPR / UK GDPR rights
• "Data Deletion Request" — account or data erasure
• "Meta Data Request" — Facebook / Instagram data questions
• "Pinterest Data Request" — Pinterest data questions