Privacy Policy

a) Data you provide directly

• Name and email (when you sign up or connect via Meta login)
• Facebook, Instagram and TikTok assets you manage (Pages, business accounts, advertiser accounts)
• Content and interactions (posts, comments, messages) that you choose to manage through RYPL
• Knowledge-base material you upload so the AI can answer accurately (product details, FAQs, website content)
• Contact form: first and last name, email address, and your message
• Withdrawal form: full name, email address, order or subscription ID, and the service you are withdrawing from

Both forms are protected by Cloudflare Turnstile. The check happens in your browser and with Cloudflare; we act on the result but do not store it. The two forms then treat your IP address differently:

• Contact form: your IP address is used only in memory, as the key that limits how many messages one sender can submit per minute. It is not written to the message we receive and is not retained afterwards.
• Withdrawal form: your IP address and the date and time of submission are recorded together with your withdrawal statement, so there is evidence of when the statement was made. This is the durable record the law requires.

b) Data we receive via platform APIs

With your authorization, we may process:

• Managed Pages, accounts and advertiser-account metadata
• Posts, ads, comments, and user interactions on the assets you connect
• Private messages from Messenger/Instagram Direct (if you enable them)
• TikTok ad comments and related metadata via the TikTok Marketing API (if you connect a TikTok advertiser account)

c) System/technical data

Collected automatically when you access the Service:

• IP address, device/browser info, OS
• Access time/date, referrer, and interaction logs
• Security and session identifiers (cookies, tokens, Cloudflare security headers)
• Advertising click identifiers carried in the URL (e.g. oppref from ads shown in ChatGPT) and partner referral codes (aff), as described in section 4

We request Meta and TikTok permissions strictly to provide the automation and moderation features of RYPL. Examples:

• Meta: pages_manage_posts, pages_manage_engagement, pages_messaging, instagram_manage_comments, etc.
• Optional Meta permissions for advertising (ads_management, pages_manage_ads) are only used if you enable ad-related features
• TikTok: Marketing API scopes needed to read and manage comments on the ads you connect

We never request more access than necessary. Your data is not shared with unauthorized third parties.

We process data based on:

• Contractual necessity — to deliver the Service you subscribe to, and to handle a withdrawal from that contract
• Legal obligation — to keep records the law requires (e.g. withdrawal statements, invoices)
• Legitimate interest — to secure and improve the Service (fraud and spam prevention, performance monitoring, product development) and to answer messages you send us
• Consent — for non-essential cookies and advertising identifiers (section 4) and where the law otherwise requires it (e.g. connecting your Meta or TikTok account via OAuth). You can withdraw consent at any time

You may withdraw platform authorization at any time by disconnecting RYPL from your Meta or TikTok account.

• Essential cookies (security, session, checkout, your cookie choice) are always set. Without them, login and payments won't work
• Functional storage — a partner referral code you arrive with is kept for the browser session and attached only to the app.rypl.is sign-up and affiliate links, so the partner who referred you is credited
• Marketing and analytics — the OpenAI Ads attribution cookie (oppref, 30 days) and, when enabled, Google Analytics, Meta Pixel and Hotjar are set only after you accept them in the cookie banner. A Global Privacy Control signal is honoured as a decline

You can change your choice at any time on the Cookie Policy page, which also lists every cookie and storage key we use.

• Account and connected-platform data: retained while your subscription is active; after cancellation or inactivity it may be deleted after 60 days
• Contact form messages (name, email, message text): kept in our support mailbox for up to 12 months. The sender's IP address is not part of that record
• Withdrawal statements and their acknowledgments, including the IP address and timestamp of submission: kept for as long as the law requires us to evidence them
• Rate-limiting records (IP address and a request count): held only in server memory, never written to disk, and deleted by a scheduled cleanup that runs every minute while any record exists. A record therefore lives at most two minutes: its one-minute window, plus the wait for the next cleanup
• You may request deletion anytime at [email protected]; we will erase data within 24 hours where legally permitted

We use these providers to run the website and the Service. Each may process limited personal data under its own policy:

• Cloudflare — security, CDN, performance, and Turnstile bot protection on our forms
• Lemon Squeezy — checkout, payments, VAT compliance
• Resend — transactional email: delivering contact-form messages to us and sending withdrawal confirmations to you
• OpenAI — the AI models that draft replies. The comment thread, the post it belongs to, and the knowledge-base material you configure are sent to OpenAI to generate a reply. OpenAI Ads attribution uses the oppref click id described in section 4
• Meta and TikTok — the platform APIs through which your Pages, accounts and ads are connected
• Google Analytics, Meta Pixel, Hotjar — analytics and marketing, loaded only with your cookie consent and only when enabled on the Site
• code.market, Product Hunt, There's An AI For That — “Featured on” badges and widgets that load from those vendors' servers and may receive your IP address and browser details

Under the GDPR (and the UK GDPR where it applies) you have the right to:

• Access — obtain a copy of the personal data we hold about you
• Rectification — have inaccurate data corrected
• Erasure — have your data deleted where we no longer need it
• Restriction — limit how we use your data while a dispute is resolved
• Portability — receive data you gave us in a structured, machine-readable format
• Objection — object to processing based on legitimate interest, including any direct marketing
• Withdraw consent — at any time, without affecting processing that already took place
• Automated decisions — we do not make decisions about you based solely on automated processing that have legal or similarly significant effects

To exercise any right, email [email protected]. We may ask you to verify your identity. We respond within one month; for complex requests we may extend this by two further months and will tell you if so.

You can also lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority in your country of residence.

California and other US residents

If you are a California resident you have comparable rights under the CCPA/CPRA: to know, delete and correct your personal information, to opt out of its sale or sharing, and not to be discriminated against for exercising those rights. We do not sell personal information. The only advertising-related identifier we use on this website is the OpenAI Ads click id, which is set only with your consent and can be refused or withdrawn at any time; a Global Privacy Control signal is treated as an opt-out.

By using RYPL, you agree that:

• You are solely responsible for the Meta and TikTok assets you connect and for all content/actions performed via your accounts
• RYPL does not verify ownership of connected accounts and is not liable for bans, suspensions, or restrictions imposed by Meta or TikTok
• We are not liable for reputational, regulatory, or financial consequences of your use of the Service, including the publication of User Content
• Use of fake, unauthorized, or abusive accounts is prohibited and may lead to termination

The Service is not intended for children under 13. We do not knowingly collect such data; if discovered, it will be deleted.

Your data may be processed outside the EEA (e.g., by Cloudflare, Lemon Squeezy, Resend, OpenAI, Meta, TikTok and Google). We rely on safeguards such as Standard Contractual Clauses as required by GDPR.

• As-is service — The Service is provided “as is” and “as available” without warranties
• No indirect damages — We disclaim liability for indirect, incidental, consequential, or punitive damages, including loss of goodwill, reputational harm, or business interruption
• User accountability — You are solely responsible for how you use RYPL and for any outcomes
• Third-party risks — We are not liable for actions of third-party providers or policy changes they implement
• Aggregate limit — Our total liability shall be limited to the amount you paid for the Service in the 12 months preceding the claim

We may update this Policy to reflect legal, technical, or product changes. Updates will appear on this page with a new date. Material changes may be notified via the Site or by email.

This Policy is governed by the laws of Poland. Disputes shall be resolved exclusively in the courts of Poland. This does not limit the rights you have under mandatory law in your country of residence, including the right to complain to your local supervisory authority.

Email: [email protected]

Website: https://rypl.is