Genr8 ("we", "us", or "our") is a content generation platform operated by Mohammad Khairi bin Ali, registered in Malaysia under the Companies Commission of Malaysia (SSM). This Privacy Policy explains how we collect, use, and protect your personal data when you use our service at genr8.my and our web application.

By using Genr8, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our service.

1. Information We Collect

We collect the following types of information:

• Account information: Your name, email address, and password (hashed) when you register.
• Business information: Your business name, niche, and audience details you provide during onboarding.
• Social platform tokens: OAuth access tokens for connected social accounts (Threads, Instagram, Facebook, TikTok, Twitter/X). These are stored encrypted and used only to publish content on your behalf.
• Platform profile data: Your social profile ID, username, and profile name retrieved via connected platform APIs.
• Content data: Captions, drafts, and posts you generate or approve within Genr8.
• Usage data: Log data including pages visited, features used, and timestamps — for improving the service.
• Payment information: Billing details processed via Stripe. We do not store full card numbers.

2. How We Use Your Information

• To provide and operate the Genr8 service
• To publish content to your connected social accounts only after you explicitly approve each post
• To personalise AI-generated content to your voice, language, and niche
• To send service-related notifications (e.g. publish confirmations, billing receipts)
• To improve and debug the platform
• To comply with legal obligations

We never publish content without your explicit approval. Every post requires user action before it reaches any social platform.

3. Meta Platform Data

When you connect your Threads, Instagram, or Facebook account, Genr8 accesses your account via Meta's official APIs under the following permissions:

• threads_basic — to read your Threads profile ID and verify account connection
• threads_content_publish — to publish posts you have reviewed and approved
• threads_manage_insights — to show you post performance data within Genr8
• threads_delete — to delete posts you request to remove

We use Meta platform data only for the purposes listed above. We do not sell, transfer, or use Meta platform data for advertising, data brokers, or any purpose unrelated to providing the Genr8 service.

You can revoke Genr8's access to your Meta accounts at any time via Threads Settings → Apps and Websites or Facebook Settings → Apps.

4. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
• OAuth tokens: Deleted immediately when you disconnect a social account or delete your Genr8 account.
• Generated content: Retained in your queue until you delete it or your account is closed.
• Logs: Retained for up to 90 days for debugging and security purposes.

5. Data Sharing

We do not sell your personal data. We share data only with:

• Meta Platforms: To publish content via their APIs on your behalf
• OpenAI / Anthropic: Caption generation prompts (no personally identifiable information is included in prompts)
• Stripe: Payment processing
• Railway / Vercel: Hosting infrastructure
• Sentry: Error monitoring (anonymised)

6. Data Security

We implement industry-standard security measures including:

• HTTPS encryption for all data in transit
• Encrypted storage for OAuth tokens
• Password hashing using bcrypt
• Access controls limiting who within our team can access user data

7. Your Rights (PDPA Malaysia)

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Withdraw consent for data processing (this may limit or end your ability to use the service)
• Request deletion of your account and associated data

To exercise any of these rights, contact us at hello@genr8.my. We will respond within 14 business days.

8. Cookies

We use session cookies to keep you logged in. We do not use third-party advertising cookies. You can disable cookies in your browser settings, though this may affect your ability to use the service.

9. Children's Privacy

Genr8 is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with their information, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification. Continued use of Genr8 after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your personal data, contact us at:

• Email: hello@genr8.my
• Business: Mohammad Khairi bin Ali (SSM Enterprise)
• Website: genr8.my

---

This Privacy Policy is governed by the laws of Malaysia. Disputes are subject to the jurisdiction of Malaysian courts.