Privacy Policy

Last updated: October 8, 2026

This Privacy Policy explains how WickedSelf LLC, a Delaware limited liability company doing business as SmashTheFeed ("SmashTheFeed", "we", "us" or "our"), collects, uses, discloses and protects personal information, and the choices and rights you have. It applies to our website at smashthefeed.com, our dashboard and related services, emails we send, and the integrations described below (together, the "Service").

Capitalized terms not defined here have the meaning given in our Terms of Service.

1. Our role

• Controller / "business". We decide how and why personal information is processed for: visitors to our website; people who contact us; the businesses that subscribe ("Customers") and the individuals who use the Service for them ("Users"), such as owners, managers and staff; and billing, security and service-improvement purposes.
• Processor / "service provider". When a Customer uses the Service, we process personal information about that Customer's own customers, prospects, reviewers, commenters, followers and the people who appear in its photos and videos, on the Customer's behalf and under its instructions. For that information the Customer is the controller, and our Data Processing Addendum applies. If you are one of a Customer's customers and want to exercise privacy rights, please contact that business directly; we will help it respond.

2. Information we collect

2.1 Information you give us

• Account and contact information: name, business name, email address, time zone, sign-in records, and the role and locations a User can access.
• Business profile information: website address, brand voice, offers, services, audience, contact methods, phrases to avoid, questions your customers ask, and other details you enter during onboarding or later.
• Content: photos, videos and audio you upload (which may show or include the voices of you, your staff or your customers), captions and edits you write, posts you approve, skip or reject, and questions you ask in the dashboard's chat.
• Billing information: plan, billing history and the last digits and type of your card. Card numbers are collected and stored by our payment processor, Stripe, not by us.
• Communications: messages you send us and the details of support requests.

2.2 Information we collect automatically

• Device and usage information: IP address (our own rate-limiting records keep only a keyed one-way hash of it; our hosting and sign-in providers log it for security), browser and device type, pages and features used, timestamps, and referring pages.
• Error and diagnostic information: when something fails, technical details such as the error message, the page or job involved, browser and device type. We send this to our error-monitoring provider without default personal identifiers.
• Cookies and similar technologies: see our Cookie Notice.

2.3 Information from Connected Platforms you authorize

• Meta (Facebook and Instagram): Page and Instagram account identifiers, names and handles; an access token (encrypted at rest); your posts, captions and media; post, account and audience metrics such as reach, views, plays, shares, saves, follows, profile visits and link taps; and comments on your posts, which may include commenters' names, handles and comment text.
• Google: with your sign-in, your Business Profile account and location identifiers and names, and reviews of your business, including reviewer names and review text. We also obtain public business details and reviews through Google's Places service.
• Booking, scheduling and customer-management systems (for example Mindbody, and in the future others such as Square, Jobber or Housecall Pro): records of new customers, appointments and bookings, which may include names, email addresses and phone numbers. We convert contact details into one-way hashes as they arrive and do not keep them in readable form.
• Other platforms we may add (for example TikTok, advertising platforms, or messaging and email providers): the account, content, performance and contact data needed for the feature you turn on, as described when you connect it.

2.4 Information from other sources

• Public web content: the text and images on your public website and listings, which we read to understand your business.
• Reviews you paste: reviews from sites such as Yelp or Nextdoor that you copy into the Service.
• Search data: common questions people search for about your type of business and area, obtained from a search-data provider. We do not send personal information to obtain it.

3. How we use information

We use personal information to:

• Provide the Service: create and secure accounts; analyze your business, reviews and comments; generate content plans, captions and insights; analyze and transcribe uploaded media; publish content you approve or set to publish automatically; measure results; and send you weekly briefs, upload links, sign-in codes and account notices.
• Learn what works for your business: analyze the performance of your posts, and booking results where connected, to improve the recommendations we give you.
• Improve the Service: troubleshoot, monitor quality, test and develop features, and create de-identified or aggregated statistics and learnings that do not identify you or any individual.
• Bill and administer accounts: process payments, prevent fraud and manage subscriptions.
• Protect the Service and others: detect and prevent abuse, security incidents and violations of our terms; enforce our agreements; and comply with law and legal process.
• Communicate with you: respond to requests and send service, security and policy updates. If we send marketing emails, you can unsubscribe at any time.

Legal bases (EEA, UK and Switzerland). Where these laws apply, we rely on: performance of a contract (to provide the Service); our legitimate interests (security, improving the Service, de-identified analytics, and business communications), balanced against your rights; compliance with legal obligations; and consent where required (for example, for non-essential cookies), which you may withdraw at any time.

4. Artificial intelligence

The Service uses artificial intelligence models provided by third parties (see our Subprocessors page) to generate and review content, analyze photos and video frames, transcribe audio, summarize reviews and comments, and answer questions about your results. Information is sent to these providers only to perform those tasks for you. We do not use your content to train our own general-purpose AI models, we use AI providers under business terms that do not permit them to train their models on the content we send, and where a provider offers a setting to exclude content from model improvement, we use it. Before reviews and comments are sent to an AI model, we remove email addresses, phone numbers and social media handles where we can detect them. AI output can be wrong; see Section 8 of our Terms.

5. Google API data (Limited Use)

SmashTheFeed's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve user-facing features of the Service that you request; we do not use it for advertising; we do not sell it; we do not allow humans to read it except with your consent, for security purposes, to comply with law, or when it has been aggregated and de-identified for internal operations; and we do not use it to train general-purpose AI models.

6. Meta Platform data

We use data obtained from Meta's platforms only to provide the Service to the Customer that connected the account, in line with the Meta Platform Terms. We do not sell it, and we do not use it to build profiles of individuals for advertising. To ask us to delete data we obtained through Meta, see Section 10.

7. How we disclose information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only as follows:

• Service providers (subprocessors) that host, store, process, transmit or analyze data for us under contracts that limit their use of it, including cloud hosting, database and file storage, AI model, transcription, payment, email delivery, error monitoring and search-data providers. They are listed on our Subprocessors page.
• Connected Platforms you authorize, to publish your content and retrieve your data.
• Your organization: Users with access to a Customer's account can see that account's content and data, and franchise or multi-location Customers can see data for the locations they manage.
• Legal and safety: to comply with law, legal process or a lawful government request; to enforce our agreements; or to protect the rights, property or safety of SmashTheFeed, our Customers or others.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, subject to this Policy's protections.
• With your direction or consent.

We may also share de-identified or aggregated information that cannot reasonably identify any person.

8. Retention

We keep personal information only as long as needed for the purposes in this Policy, including:

• Account, profile and content data: while the Customer's account is active, and then until deleted under Section 10 or our normal deletion cycles.
• Reviews and comments collected for analysis: up to one year after collection, after which they are deleted automatically.
• Hashed booking records and performance metrics: while the account is active and as needed to measure results over time.
• Billing records: as long as tax, accounting and legal obligations require.
• Security, sign-in and error logs: for limited periods set by us and our providers.
• Backups: until they are overwritten on our providers' normal backup schedules.

We may keep de-identified or aggregated information indefinitely.

9. Security

We use administrative, technical and organizational safeguards designed to protect personal information, including encryption in transit, encryption of access tokens at rest, private storage for uploaded media with short-lived signed links, database access controls, keyed hashing of IP addresses in our rate-limiting records and of booking contact details, least-privilege access, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee security. If we learn of a breach affecting your personal information, we will notify you and regulators as required by law.

10. Your choices and deleting data

• Account deletion: a Customer can delete its account from the Billing page. This cancels the subscription and deletes the account's plans, posts, uploads, channel connections, brand profile, subscription records and User access. Some records, such as historical performance statistics, may be kept as described in Section 8 unless you ask us to delete them.
• Disconnecting platforms: you can disconnect Meta, Google or other platforms at any time, which removes the stored access token. If you remove our app in your Facebook settings, Meta notifies us and we disconnect the affected channels automatically.
• Requests: to request access, correction or deletion of your information, including data obtained through Meta or Google, email privacy@smashthefeed.com. For data deletion requests related to Meta, you can also remove our app under Facebook Settings & Privacy → Settings → Apps and Websites. We confirm completion of valid deletion requests.
• Emails: you can unsubscribe from marketing emails using the link in them. Service emails (such as sign-in codes, weekly briefs and billing notices) are part of the Service.

11. Your privacy rights

Depending on where you live, you may have the right to:

• know or access the personal information we hold about you and how we use and disclose it;
• correct inaccurate information;
• delete your information;
• receive a portable copy of your information;
• opt out of the sale or sharing of personal information, targeted advertising, and certain profiling (we do not sell or share personal information or use it for targeted advertising);
• limit the use of sensitive personal information (we do not use it for purposes that require this right);
• object to or restrict certain processing, and withdraw consent (EEA, UK and Switzerland); and
• not be discriminated against for exercising these rights.

How to exercise them. Email privacy@smashthefeed.com. We will verify your request by confirming control of the email address associated with your information, and may ask for more information if needed. You may use an authorized agent; we may require proof of the agent's authority and verify your identity directly. We respond within the time required by law (for example, 45 days under California law, extendable as permitted). If we deny your request, you may appeal by replying to our decision with the subject "Appeal"; if you are not satisfied with the outcome, you may contact your state attorney general or data protection authority.

Global Privacy Control. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of personal information for that browser.

Requests about a Customer's customers. If we receive a request about information we process for a Customer, we will refer it to that Customer or help it respond, as our Data Processing Addendum provides.

12. California notice

This section supplements this Policy for California residents under the California Consumer Privacy Act, as amended ("CCPA"). In the past 12 months we have collected these categories of personal information: identifiers (such as name, email, account identifiers, hashed IP address); customer records (such as billing details); commercial information (such as plan and billing history); internet or other electronic network activity (such as usage and error information); audio, visual and similar information (such as uploaded photos, videos and audio); professional or employment-related information (such as business name and role); and inferences about content performance and audience interest. Sources, purposes and disclosures are described in Sections 2, 3 and 7. We disclose each category to service providers for the business purposes described above. We have not sold or shared personal information, and we have no actual knowledge of selling or sharing personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that require a right to limit. Retention is described in Section 8.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

13. Other U.S. states

Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) may exercise the rights in Section 11 as those laws provide, including the right to appeal. Nevada residents may submit a request not to have their information sold; we do not sell personal information.

14. International transfers

We are based in the United States, and our data is stored and processed in the United States and in other countries where our providers operate. Those countries may have different data protection laws than where you live. Where required, we use appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

15. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where that age applies). Customers must not upload children's personal information except images of minors whose parent or guardian has consented. If you believe a child has given us personal information, contact us and we will delete it.

16. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, if changes are material, notify Customers by email or in the Service before they take effect.

17. Contact us

WickedSelf LLC (SmashTheFeed)
Email: privacy@smashthefeed.com