Privacy Policy

1. Who we are

Celerscale is operated by Narverse Private Limited, a company incorporated in India, which is the data controller for the personal data described here. This policy explains what we collect, why, who processes it on our behalf, and what rights you have. It applies wherever you are, including the European Economic Area, the United Kingdom and the United States.

2. What we collect from you directly

We deliberately collect very little. There is no password and no profile to fill in.

• Your email address — it is how you sign in and how we reach you
• Your name, timezone and language, if you enter them in Settings
• Your brand profile: business name, tagline, content angles and tone rules, which are sent to AI models as context when you ask for copy
• Anything you type as a prompt, and any file you upload
• Feedback you submit through the product

3. How you sign in

Sign-in is handled by Supabase, our authentication provider. You enter an email address and Supabase sends a one-time link; there is no password for us to store or lose. We receive a signed token identifying you, which we verify on every request. We never see or handle a password.

4. Connected social accounts

If you connect TikTok, Instagram, YouTube or LinkedIn, we receive access on the permissions you approve. Connecting starts with you clicking Connect in Settings. Celerscale uses YouTube API Services for its YouTube integration. We do not receive your social-platform password.

• TikTok — user.info.basic to read and store your account identifier and display name; video.upload to send content to your TikTok inbox for you to finish posting; video.publish when direct posting is enabled; and video.list when TikTok analytics is enabled, to read and store views, likes, comments and shares for videos published through us
• YouTube — youtube.upload to upload your videos, and youtube.readonly to identify your channel, check upload processing and read video performance. We store your channel identifier, name or handle, subscriber count, uploaded video identifiers, publication status, and available view, like and comment counts
• Instagram — instagram_business_basic to identify the account, instagram_business_content_publish to publish to your professional account, and instagram_business_manage_insights when Instagram analytics is enabled
• LinkedIn — openid and profile to identify you, and w_member_social to publish to your member account. If enabled, r_member_social supports reading member posts; rw_organization_admin, w_organization_social and r_organization_social support selecting, publishing to and reading performance for organisations you administer
• We use connected-account details to show which account you selected, deliver the content you approved, track publishing status and display available analytics. For TikTok direct posting, we also read the creator information and posting options needed to show the permitted audience and interaction settings
• Publishing sends your selected media, captions and publishing settings to the platform you choose. We publish only what you submit, schedule, or authorise through an autopilot you configure
• We do not use platform data to train models, build advertising profiles, or enrich any third-party dataset

Our use of information received from Google APIs, and its transfer to any other app, adheres to the Google API Services User Data Policy, including its Limited Use requirements. TikTok and Google also process information under their own privacy policies.

• Google Privacy Policy
• Google API Services User Data Policy
• TikTok Privacy Policy
• TikTok Developer Terms of Service

5. Access tokens and disconnecting an account

Connecting an account gives us an access token and, usually, a refresh token. These let us use the permissions you approved without receiving your password.

• Tokens are encrypted at rest with AES-256-GCM and are not returned to your browser. We refresh them while the account remains connected
• Disconnect in Settings → Connections to stop new publishing and analytics requests for that connection. Content already sent to the platform may finish processing
• When disconnect completes, we clear the stored access and refresh tokens for that workspace. If the platform cannot confirm revocation, publishing stays paused and encrypted tokens are retained so you can retry disconnecting
• If the same social account is still connected in another workspace, that connection remains active. Disconnect it there too, or revoke access on the platform to remove access across workspaces
• Disconnecting does not erase the connection identity, publishing history or previously collected analytics, and does not delete content already published on YouTube or TikTok. Delete published content on the platform itself
• You can also remove our access in your Google Account permissions. On TikTok, open Settings and privacy → Security & permissions → Apps and services permissions, choose this app and remove access

To request deletion of connected-account data held by us, or ask a privacy question, email support@celerscale.com from your account email and identify the workspace and connected account. Removing platform access and asking us to delete stored data are separate actions.

• Revoke Google / YouTube access
• Manage TikTok app permissions
• Request deletion or contact privacy support

6. What we generate and store

Producing content means sending your prompt and your chosen inputs to an AI provider, and storing what comes back.

• Your prompts, brand context, uploaded media and generated output are stored in our private storage so you can edit and re-render them
• Generated media is served to your browser through short-lived signed links, not public URLs
• Deleting a content record or removing media from your library does not automatically erase its stored files. Files referenced by drafts or publications are retained. Contact support@celerscale.com to request erasure
• We keep a record of what each generation cost, so your credit balance can be explained

7. Processors we use

In addition to the social platforms you choose in section 4, we use the following service providers to operate Celerscale. We share the information needed for each service:

• Supabase — authentication and file storage
• MongoDB Atlas — the application database
• fal.ai — the gateway to the AI models that generate your content, which routes prompts to providers including OpenAI, xAI and ElevenLabs. They receive your prompts and inputs; they do not receive your account credentials or platform tokens
• Dodo Payments — payment processing. They handle card details directly; we never receive or store them
• Resend — delivery of transactional email such as failure notices

We do not sell your personal data, and we do not share it with advertisers or data brokers.

8. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following bases under the GDPR and UK GDPR:

• Performance of a contract — to create your account, generate and store your content, and publish it to the accounts you connect
• Consent — to connect a social account, and to send you optional email. You can withdraw it at any time by disconnecting or unsubscribing, without affecting what has already happened
• Legitimate interests — to keep the service secure, prevent abuse of the free trial, and understand aggregate usage. We weigh these against your rights and use the least data that works
• Legal obligation — to keep tax and accounting records for payments

9. International transfers

We operate from India and use providers in the United States, the European Union and India, so your data may be transferred outside your country.

• Where personal data leaves the EEA or the UK we rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where it applies
• We assess each provider before sending them data, and require them to process it only on our instructions
• You can ask for a copy of the safeguards we rely on by writing to support@celerscale.com

10. How long we keep things

We keep data for as long as it is doing a job, and no longer.

• Account data — while your account exists. Contact support@celerscale.com to request deletion of your account and associated data
• Content and generated media — kept to provide your library and support saved drafts and publications. Removing an item does not automatically erase its files, as explained in section 6
• Platform tokens — cleared when disconnect completes, with pending revocation handled as described in section 5
• Connection identity, publishing history and collected analytics — retained after disconnect to identify previous posts and support reconnection. You can request deletion as described in section 5
• Billing and credit records — kept as long as tax and accounting law requires, which is longer than your account may last

11. Your rights in the EEA and UK

You have the right to:

• Access the personal data we hold about you and receive a copy
• Have inaccurate data corrected
• Have your data erased
• Restrict or object to our processing, including processing based on legitimate interests
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time, without affecting processing already carried out
• Complain to your local data protection authority

Write to support@celerscale.com to exercise any of these. We reply within one month, as the GDPR requires, and we do not charge for it.

12. Your rights in the United States

If you live in California, Colorado, Connecticut, Virginia, or another state with a comprehensive privacy law, you have the right to know what we collect, to have it deleted, to correct it, and to receive a copy.

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA and CPRA
• We do not use your personal information for profiling that produces legal or similarly significant effects
• We will not treat you differently for exercising any of these rights
• Write to support@celerscale.com; we verify the request against your account email before acting on it

13. Security

Access tokens are encrypted at rest with AES-256-GCM. Stored media is reachable only through short-lived signed links. Every API request is authenticated against a verified token, and sensitive values are redacted from our logs. No system is perfect, and we do not claim otherwise — but these are the measures in place.

14. Children

The service is not directed at children. You must be at least 13, and at least 16 in the European Economic Area or the United Kingdom unless your country sets a lower digital age of consent and a parent or guardian has consented. We do not knowingly collect data from anyone younger; if we learn that we have, we delete it. Write to support@celerscale.com if you believe a child has given us personal data.

15. Changes to this policy

We may update this policy. The date at the top always reflects the current version, and where a change is significant we will tell you in the product or by email before it takes effect.

16. Contact

Narverse Private Limited, a company incorporated in India is the data controller for the personal data described here. For any question about this policy, or to exercise any right in it, contact support@celerscale.com.