Privacy Policy

Pulpi is a service published by ICRAFT SAS (“we”, “us”), the controller of your personal data. This Privacy Policy explains what information we collect, why, who it is shared with and how you can retrieve it or have it deleted when you use Pulpi (the “Service”).

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

2.1 Account Information

• Email address and display name (via Firebase Authentication)
• Organization and brand profile information you provide
• Billing information processed through Stripe (we do not store card numbers)

2.2 Social Media Account Data

• OAuth tokens and refresh tokens for connected social media platforms
• Social media profile information (usernames, profile URLs, follower counts)
• Content you create, schedule, or publish through the Service
• Engagement metrics and analytics from connected platforms

2.3 Usage Data

• Log data (IP address, browser type, pages visited, timestamps)
• Feature usage patterns and interaction data
• Error reports and performance metrics

• Content generation: your brand information and instructions are sent to AI models to write and illustrate your content.
• Publishing: to schedule and publish content to your connected social media accounts on your behalf.
• Engagement: to perform automated engagement actions (likes, comments, follows) as you configure them.
• Analytics: to provide performance insights and recommendations for your social media strategy.
• Service improvement: to monitor, maintain and improve the reliability and performance of the Service.
• Communication: to send you notifications, alerts and updates related to the Service.

We integrate with the following third-party services:

• Google Firebase and Google Cloud: authentication, database (Firestore) and infrastructure.
• Social networks: Instagram, Facebook, X, LinkedIn, Pinterest, YouTube and TikTok — for the accounts you connect.
• AI model providers: Google (Gemini), Groq, Mistral AI, Anthropic and Hugging Face, as well as models run on ICRAFT SAS’s own infrastructure. They receive the brand information and instructions needed to write and illustrate your content.
• Stripe: payment processing. Your payment details are handled directly by Stripe.
• Vercel: application hosting.
• Cloudflare: storage of the images and videos of your content.
• Resend: delivery of the Service’s emails.
• Telegram: only if you turn on Telegram notifications.

Each third-party service has its own privacy policy governing the use of your information. We encourage you to review their policies.

We implement industry-standard security measures to protect your data:

• All OAuth tokens and sensitive credentials are encrypted at rest using AES-256-GCM encryption.
• All data in transit is encrypted via TLS 1.2+.
• Access to production systems is restricted and monitored.
• Firebase security rules enforce strict access controls on all database collections.
• API endpoints are protected by authentication and rate limiting.

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

• Account, sites and content: kept, with their statistics, for as long as your account exists, then erased when you delete it.
• Network connection tokens: kept while the network stays connected; erased on disconnection or with the account.
• Images and videos: files already produced for your content are not erased automatically with the account; write to us and they are removed from our storage within one month.
• Record of the deletion: the date, email address and IP address of the request are kept as evidence.
• Backups: erased data may remain in our backups until they expire.
• Invoices: kept for ten years, as accounting law requires.
• Technical logs: kept by our hosting providers for the period set by their services.

If you are a resident of the European Economic Area (EEA), you have the following data protection rights:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data, subject to legal retention obligations.
• Right to data portability: You may request an export of your data in a structured, machine-readable format.
• Right to object: You may object to the processing of your personal data for certain purposes.
• Right to restrict processing: You may request that we limit the processing of your personal data.

To exercise any of the rights described above, you may:

• Export your data: in Settings, “Your data” card, “Export my data” button. You receive a machine-readable file.
• Delete your account: in Settings, “Your data” card, “Delete my account” button. Your current subscription is cancelled in the same step.
• Correct your information: from your account and site settings, or by writing to us.
• Contact us directly: email contact@pulpi.ai

Open Settings, “Your data” card

We reply within one month. If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

Pulpi keeps in your browser what it needs to work: your session (Firebase Authentication), your language and your cookie choice. These cannot be turned off. Depending on how you reach us, the following are added:

• Referral measurement: if you arrive through a referral link or from a published post, cookies remember that link — pulpi_ref (60 days), pulpi_post, pulpi_utm_source and pulpi_utm_campaign (30 days) — so that a subscription can be credited to the right person.
• iCraft referral programme: a script served by ICRAFT SAS (refer.icraft.dev) keeps the referral code in your browser’s local storage for 30 days.
• Agency portals: on an agency subdomain, the pulpi_agency cookie (1 day) remembers the portal so its colours can be applied.

The referral measurement cookies are set, and the referral script is loaded, only after you choose “Accept” in the banner. Until you choose, nothing is set. If you choose “Refuse”, any that existed are deleted. We use no advertising cookies and load no third-party audience analytics.

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

Your data may be processed in the European Union and in the United States by the providers listed in section 4. Where data is transferred outside the European Economic Area, those transfers are covered by the safeguards the GDPR provides, in particular the Standard Contractual Clauses approved by the European Commission.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the revised policy.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: