Draft for legal review. Not yet approved by counsel.
1. Controller
Warmup Marketing LLC, Delaware, USA, is the data controller for personal data processed through the Warmup website and service.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email, name, password hash, plan, billing status | You |
| Connected accounts | Platform account identifiers, access tokens, profile and post metrics | Official platform authorizations |
| Tracked public accounts | Public profile data, public posts and their public metrics | Public pages of the platforms |
| Content | Briefs, drafts, approved posts, uploaded media | You and the AI features you use |
| Usage data | Pages viewed, actions in the service, device and browser information, IP address | Automatically |
| Payment data | Card details are processed by our payment provider; we store only the last four digits and the payment status | Payment provider |
3. Why we process it
- To provide the Service: connecting accounts, generating drafts, publishing, analytics. Legal basis: performance of a contract.
- To bill you and prevent fraud. Legal basis: contract and legitimate interest.
- To improve the Service and measure site traffic. Legal basis: legitimate interest, or consent where cookies are involved.
- To send service messages and, with consent, marketing. Legal basis: contract and consent.
- To comply with law. Legal basis: legal obligation.
4. AI processing
Content you submit for generation, transcription or analysis is sent to third-party AI providers acting as our processors. We contractually require that they do not use your content to train their models. Details are in our AI Use Policy.
5. Processors and recipients
We use providers for hosting and databases, media storage, background processing, payments, email delivery, AI generation and transcription, and website analytics. Each acts under a data processing agreement. We do not sell personal data.
6. International transfers
Our providers may process data in the United States and the European Economic Area. Where data leaves the EEA or UK we rely on adequacy decisions or standard contractual clauses.
7. Retention
Account data is kept while your account is active and for up to 12 months after deletion for legal and accounting purposes. Public metrics of tracked accounts are kept as historical series while the account is tracked. Usage logs are kept for up to 90 days. You can request earlier deletion where the law allows.
8. Your rights
Depending on where you live you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent. EEA and UK residents may complain to their supervisory authority. California residents have rights under the CCPA, including the right to know and to delete; we do not sell or share personal data for cross-context behavioural advertising without consent.
9. Cookies
We use necessary cookies and, only with your consent, analytics and marketing cookies. See the Cookie Policy for the full list and how to change your choice.
10. Security
We use encryption in transit, access controls, and least-privilege credentials. No system is perfectly secure; notify us immediately if you suspect unauthorised access to your account.
11. Children
The Service is not intended for anyone under 18 and we do not knowingly collect data from children.
12. Changes
We will post updates here and, for material changes, notify you by email or in the Service.