Privacy Policy

• Account & identity. When you sign in (via GoalKeepers single sign-on or email), we receive your name, email address, role, and the school/workspace you belong to.
• Brand & content. Your brand kit (logo, colours, fonts, contact details), the posts and designs you create, their captions and hashtags, and any images you upload or generate.
• Connected social accounts. When you connect Instagram, we receive and store — encrypted — an access token plus your Instagram account id and username. We use these solely to publish the content you create and schedule.
• Technical data. A session cookie that keeps you signed in, plus basic logs (timestamps, errors) needed to operate and secure the Service.

We use the information above only to provide and operate the Service — specifically to:

• Render, store and manage your posts, media and brand kit.
• Generate captions and images when you ask us to (see “AI features”).
• Schedule and publish posts to the social accounts you connect.
• Keep your account secure and provide support.

We do not sell your personal data, and we do not use it for advertising.

Captions and hashtags are generated by a language model. AI images are generated through OpenAI. When you use these features, only the brief/prompt and brand details you provide are sent to the model to produce your result. Your content is not used to train these models.

To publish on your behalf, the Service connects to Instagram through Meta’s Graph API using Facebook Login. With your explicit consent we request these permissions: instagram_basic, instagram_content_publish, pages_show_list, pages_read_engagement and business_management.

• We use these permissions only to identify your linked Instagram Business account and to publish the posts you create and schedule.
• The Page access token we receive is stored encrypted and is never shared or sold.
• You can disconnect Instagram at any time from Channels → Disconnect, which removes the stored token. You may also revoke access from your Facebook settings.

Our use of information received from Meta APIs follows Meta’s Platform Terms and Developer Policies.

We share data only with the providers needed to run the Service:

• Meta (Instagram / Facebook) — to publish the posts you schedule.
• OpenAI — to generate AI images from the prompt you provide.
• Hosting & database providers — to store your workspace data securely.
• GoalKeepers — for single sign-on and brand synchronisation.

We may also disclose information if required by law. We do not sell personal information.

We keep your data for as long as your workspace is active. You control your content — you can delete posts and media in the app, and disconnecting a channel removes its stored token immediately. To request deletion of your account and associated data, email us at privacy@prayaassessments.com.

All traffic is served over HTTPS. Sensitive secrets — connected-account access tokens and any saved API keys — are encrypted at rest using AES-256-GCM. Every workspace’s data is isolated, and the Service fails closed if a workspace can’t be determined.

We use a single, essential cookie to keep you signed in. We do not use third-party advertising or tracking cookies.

The Service is a tool for school staff and administrators. It is not directed to children and we do not knowingly collect personal information from them.

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above; continued use of the Service means you accept the revised policy.

Questions about this policy or your data? Email privacy@prayaassessments.com.