Privacy Policy

This is a draft for legal review, not a finished legal document. It reflects the product's actual data handling as designed, but has not been reviewed by a lawyer and should not be published until it has been.

Last updated: 2026-09-20 (draft; the published date is set when counsel approves it)

1. What this policy covers

This Privacy Policy explains what data Universe Help ("we," "us," "the Platform") collects, how we use it, and what choices you have, for Owners, Collaborators, and visitors to our public website.

2. Data we collect

Account data

Name, email, password (hashed, never stored in plain text), role (Owner/Collaborator/Admin), and plan information.

Payment data

Card details are collected to start your free trial and process subscription charges. We do not store full card numbers ourselves — this is handled by our payment/subscription provider (RevenueCat and its underlying payment processor).

Connected platform data

When you connect a social media account (Instagram, Facebook, YouTube, etc.), we store an access token (encrypted, server-side only, never exposed to your browser) that lets us post and read data on your behalf, limited to what you've authorized.

Content data

Images, videos, captions, and posts you upload or create through the Platform.

Lead data

Comments, messages, and their AI-generated classification (hot/warm/cold) collected from your connected platforms. This data can include personal data of the people who wrote to you. We keep the original comments and messages for 90 days, then anonymize them: the personal content is removed and only the aggregate score and classification are kept. If you mark a lead as "converted", you can keep it longer at your discretion.

Device and session data

Information used to enforce device-login limits (e.g. device identifier, session tokens, login timestamps).

Activity logs

A record of actions taken by Admins, Owners, and Collaborators within the Platform, used for security, troubleshooting, and the in-product activity feed.

3. How we use this data

To provide the Platform's core features: posting content, scoring leads, generating SEO/content suggestions, and managing your team's access.
To process billing, including trial-to-paid conversion charges.
To send you notifications, per the notification rules you or your Owner have configured.
To maintain security — detecting suspicious logins, enforcing device limits, and investigating account issues via activity logs.
To improve the Platform (in aggregated or anonymized form where possible).

4. AI processing

Content you provide, and data from your connected platforms, may be sent to our AI provider(s) to generate captions, SEO analysis, competitor/backlink insights, and lead scoring.
We do not use your content to train third-party AI models beyond what's necessary to generate your requested output, except where explicitly disclosed.

5. Who can see your data

Collaborators only see the platforms, content, and data their Owner has explicitly granted them access to. Access is enforced on every action, not just at login.
Admins (our own staff) can access account data as needed for support, billing, or security investigations, through a separate administrative system with its own access controls.
We do not sell your personal data to third parties.
We share data with service providers only as needed to operate the Platform (e.g. hosting, payment processing, email delivery, AI processing) under contracts that limit their use of it.

6. Data retention

Public reviews, comments and posts from third parties that our research features analyze for you are kept in raw form for a short analysis window (30 days) and then deleted. We keep only counts, themes and short quotes without names or handles. [Counsel to confirm wording and the legal basis.]
Account and activity data is retained for as long as your account is active, and for a limited period after cancellation for legal, security, and dispute-resolution purposes.
If your plan expires, your workspace data is locked (you cannot use the Platform) for 90 days. If you do not buy a plan again in that time, the data is soft-deleted.
Lead data (comments and messages) is anonymized after 90 days, as described in section 2.
Deleted data (posts, accounts, platform connections) is soft-deleted — retained in a recoverable but hidden state before eventual permanent removal, per our internal data retention schedule.
Payment records, including failed payment attempts, are kept for as long as the law requires.

7. Your choices and rights

You can update your account information at any time.
You can disconnect a social platform, which stops us from accessing new data from it going forward.
We apply the same privacy rights to every user worldwide, using the strictest applicable standard as our baseline: the EU/UK GDPR, the California CCPA/CPRA, and India's Digital Personal Data Protection Act (DPDP).
You can ask us to access, correct, delete, or export your personal data. Send the request to satendrapatel2468@gmail.com. We handle these requests manually and respond within 30 days.

8. Children's privacy

The Platform is for people who are 18 or older. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it.

9. International data transfers

We operate from Nepal, and the Platform's primary data is hosted in the United States. We use service providers who may process data in other countries, including: AWS (hosting), Supabase (database and authentication), Cloudflare (network security and media storage), Vercel (web hosting), Google (AI processing and web search), RevenueCat and its payment processor (billing), Resend (email), Firebase (notifications), Sentry (error monitoring), and Mixpanel and PostHog (analytics, only with your consent). Where personal data leaves your region, we rely on the transfer mechanisms required by law (for example, standard contractual clauses). [Counsel to confirm the transfer mechanisms and the final subprocessor list.]

10. Cookies and analytics

Strictly Necessary cookies keep you signed in and secure. They are always on.
Analytics cookies (Mixpanel and PostHog) show us which features are used. They are off until you give consent, and you can withdraw consent at any time.
Functional/Preferences cookies remember your settings, if we use them.
We do not use advertising or retargeting cookies.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email before they take effect.

12. Contact

Questions about this policy, or requests regarding your data, can be sent to satendrapatel2468@gmail.com.

Flags for legal review:

Section 7 states a single worldwide baseline (GDPR + CCPA/CPRA + DPDP) and manual fulfillment by email within 30 days. Counsel should confirm that manual fulfillment is acceptable, and whether a self-service "delete my account" flow is needed as volume grows.
Section 6 uses 90 days for lead data and for locked data after plan expiry; the other periods follow the internal retention schedule (Memory.md, Architecture.md). Counsel should confirm all periods.
Section 9 lists the expected subprocessors and a United States primary hosting region. Counsel must confirm transfer mechanisms and the final subprocessor list, and the region defaults in PRD.md section 0.5 must match.
Section 2 (lead data) covers personal data of third parties who wrote to the user. Counsel should confirm the legal basis and whether the Owner is the controller and we are the processor (this ties to the DPA).
Confirm whether any connected social platform (e.g. Meta, TikTok) imposes its own required disclosures in your privacy policy as a condition of API access — these are common and are usually specified in each platform's developer terms.