This Privacy Policy explains what information Woila collects, how we use it, and the choices you have. Woila is operated by Woila Inc., a company incorporated in Canada and based in Ottawa, Ontario. Woila Inc. is the controller of the personal data described in this policy and is accountable for it. We collect only what we need to operate the Service.
1. Information we collect
Account info (name, email) via Clerk authentication. Billing info (email, payment method tokens, invoice history) via Stripe — we never see or store full card numbers. Content you upload (product images, ad creatives) and content generated for you. Usage metadata (which features you use, credit consumption, error logs). Connected platform tokens (encrypted at rest using AES-256-GCM) for any Meta or TikTok accounts you link. For a linked Meta account (Facebook and Instagram) we store your Meta user ID, the access token and Page access tokens for the Pages you grant, the list of Facebook Pages, Instagram Business accounts and ad accounts you authorise, and the campaign, ad set, ad, creative and performance data for the ad accounts you connect. If you enable engagement automation we also store the comments, mentions and direct messages your connected Pages and Instagram accounts receive — including the sender's platform ID, display name and message text — together with the replies we send on your behalf, so the automation can avoid repeating itself and you can audit what was sent. For a linked TikTok account we also store your TikTok profile (display name, username, avatar, bio, verified status), your follower, following, like and video counts, and per-video metrics (views, likes, comments, shares) for your public posts. We record a daily snapshot of these figures so the Marketing tab can show trends over time — TikTok's API returns only current totals, not history.
2. How we use your information
To provide the Service: authenticate you, run generations, publish to your connected platforms, bill you, and support you. To operate the Service: monitor errors, prevent abuse, and improve features. We do not sell personal data. We do not use your uploaded content to train third-party models. We may use aggregated, de-identified usage data for product analytics.
3. Service providers (subprocessors)
Clerk (authentication), Stripe (payments), Microsoft Azure (hosting, storage, database), OpenAI (LLM and moderation), Google (Gemini API — image and video generation), fal.ai (background removal), Black Forest Labs / Flux (background generation), SendGrid (transactional email), Meta Graph API (when you connect Facebook/Instagram), and TikTok (Login Kit, Display API and Content Posting API, when you connect TikTok). Each provider is bound by their own privacy terms and data processing agreements.
4. Data retention
Account data is retained while your account is active. Free-tier blob assets are deleted after 90 days of inactivity. Billing records are retained for 7 years for tax compliance. Disconnecting a platform deletes the data we hold from it. For Meta, disconnecting revokes our permissions at Meta and deletes the stored access and Page access tokens, the cached list of Pages, Instagram accounts and ad accounts, and the comment, mention and message events we recorded from those accounts. The same deletion runs automatically if you remove the app from your Facebook settings, or submit a data deletion request through Facebook — we act on Meta's deauthorisation and data deletion callbacks and return a confirmation code you can use to check the status. Disconnecting Meta does not affect your Woila account, your uploaded content, or any other platform you have connected. For TikTok, disconnecting revokes and deletes the stored access and refresh tokens, the cached profile and follower statistics, and the daily performance snapshots we recorded from your account. On account deletion, we delete your account data and all associated content within 30 days, except where retention is required by law.
5. Your rights
You can access, correct, export, or delete your personal data at any time. Use the Manage Account dialog (top-right of the app) for self-service, or email us. You can revoke a connected platform at any time — for Meta, use "Disconnect Meta" in the Marketing tab account menu, or remove Woila from your Facebook Settings under Apps and Websites; either revokes our access immediately and deletes the Meta data described above. For TikTok, use "Disconnect TikTok" in the Marketing tab account menu, or remove the app from your TikTok account settings; either revokes our access immediately. Where applicable (EEA, UK, California, etc.), you have the right to object to processing, restrict processing, withdraw consent, or lodge a complaint with your local supervisory authority.
6. Account deletion
You can delete your account from the Manage Account dialog. Account deletion triggers automated removal of your products, creations, conversations, connected platform tokens, and uploaded blobs. Active subscriptions are cancelled at the end of the current billing period; no refunds are issued for the unused portion of the current period unless required by law.
7. Security
We use TLS in transit, AES-256 at rest, and AES-256-GCM for sensitive third-party tokens. Access to production systems is restricted and audited. We will notify affected users of any breach within 72 hours of confirmation, where required by law.
8. Cookies and tracking
We use first-party cookies only — for authentication (Clerk session) and basic preference storage. We do not use third-party advertising cookies.
9. International transfers
Your data may be processed in regions where our subprocessors operate (primarily the United States and EU). Where required, we rely on Standard Contractual Clauses or equivalent safeguards.
10. Changes to this policy
We may update this policy. Material changes will be notified by email or in-product banner at least 14 days before they take effect.
Questions? Contact us at [email protected]
Woila Inc., Ottawa, Ontario, Canada