Privacy Policy

PsyTech · Last updated 4 November 2026

This policy explains what PsyTech (“we”, “us”) collects when you use Genrati (this website and service), why, who we share it with, and the control you have. Genrati is operated by PsyTech.

1. What we collect

  • Account details. Your email address, name and a sign-in identifier, provided when you create an account through our authentication provider.
  • Connected accounts. When you connect Instagram (through Instagram Login or Facebook Login), Facebook Pages (through Facebook Login), YouTube (through Google) or LinkedIn, we receive the account’s public identifier and name, the Facebook Page it is linked to, the permissions you granted, and an access token (and, for Google, a refresh token). Tokens are encrypted before we store them.
  • Comment automations. If you turn one on: the comments on your posts that match your keywords, the commenter's public username and ID, and a record of the reply and private message we sent for you. This activity log is deleted after 90 days.
  • Content you post. The videos, images, captions and schedule you submit for publishing, and the status of each post on each platform. Engagement counts for your posts are read to show your dashboard.
  • Comment Shield. If you turn it on for an Instagram account: the text of new top-level comments on your posts, the commenter’s public username and ID, our verdict (for example “abusive” or “scam”) with the reason, and what was done (kept, hidden, deleted or restored). We do not read replies, direct messages or comments made before you turned it on.
  • Activity records. A log of account actions such as connecting or disconnecting an account or deleting your data.
  • Technical data. IP address, browser and device information and request logs, used to run and secure the service, and the cookies described in our Cookie Policy.

We do not collect passwords for Instagram, Facebook or YouTube. You sign in on Meta’s and Google’s own pages.

2. How we use it

  • To provide the service: connect your accounts and, only on your instruction, publish content you have approved, read comments so we can run the automations and Comment Shield you turn on, and read engagement statistics.
  • To keep the service secure, prevent abuse and fix problems.
  • To communicate with you about your account and the service.
  • To meet legal obligations.

We do not sell your personal data, and we do not use it for advertising. Depending on where you live, our legal bases are performing our contract with you, our legitimate interests in operating and securing the service, your consent (for example when you authorise a connection), and legal obligation.

3. Who we share it with

We use service providers (“processors”) who handle data only to provide their service to us:

  • Supabase — database and file storage (region: Singapore).
  • Render — application hosting (region: Singapore).
  • Clerk — sign-up and sign-in (authentication).
  • Meta Platforms, Google / YouTube and LinkedIn — the platforms you connect. We exchange data with their APIs on your instruction.
  • Google (Gemini API) — when Comment Shield is on, the text of each new comment is sent to Google’s Gemini API so it can be classified (harassment, abuse, threats, scams). Only the comment text is sent, not the commenter’s name or your account details. We use it under Google’s paid API terms, which do not allow Google to use this data to train its models. We keep our own record of the verdict, not Google.
  • Anthropic — only if we switch the classifier to Anthropic’s Claude API, the same comment text would be sent there under Anthropic’s commercial terms. We will update this page first.

We may disclose information if required by law or to protect rights and safety. If we are involved in a business transfer we will tell you before your data becomes subject to a different policy.

4. Google and YouTube data

Genrati’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • We request YouTube access to upload videos to the channel you connect, and use it only for that.
  • We do not transfer this data to others except as needed to provide the service, comply with law, or with your consent, and we do not use it for advertising or sell it.
  • No human reads your YouTube data unless you ask for support, it is needed for security or to comply with law, or it is aggregated and anonymised.

By using YouTube features you are also bound by the YouTube Terms of Service and the Google Privacy Policy. You can revoke our access to your Google data at any time at security.google.com/settings/security/permissions, or by disconnecting the account in your dashboard.

LinkedIn data

When you connect LinkedIn we receive your name, email and profile identifier through Sign In with LinkedIn, and permission to publish posts on your behalf (and, where LinkedIn has approved it, to company pages you administer). We use it only to publish content you approve, we do not sell it, and you can disconnect at any time here or under LinkedIn's Settings → Data privacy → Permitted services. LinkedIn access lasts about 60 days, after which you reconnect.

5. Meta (Instagram and Facebook) data

We use data from Meta only to provide the features you request, in line with Meta’s Platform Terms, and we do not sell it or use it for advertising. You can remove our access at any time in your Facebook settings under Apps and Websites, or by disconnecting the account in your dashboard. Instructions for having your data deleted are on our Data deletion page.

6. Retention and deletion

  • Disconnecting an account deletes its stored tokens straight away.
  • A video you upload for posting is kept in private storage only until it has been published to every account you chose, then it is deleted. If a post fails the file is kept so you can retry, and it is removed when you delete your data.
  • Comment Shield records are deleted after 90 days, except items still waiting for your decision. Automation activity logs are also deleted after 90 days.
  • Deleting your account from the dashboard removes your profile, connected accounts, tokens, automations, Comment Shield records and activity logs immediately.
  • Copies may remain for a limited time in our providers’ encrypted backups and in server logs before they expire.
  • We keep information longer only where the law requires it.

7. Security

Access tokens are encrypted with AES-256-GCM before storage and are bound to your account so they cannot be reused elsewhere. Data is encrypted in transit, access to it is restricted per user in the database, and connections use HTTPS. No system is perfectly secure; if a breach affects you we will notify you and regulators as the law requires.

8. Your rights and choices

Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA, India’s DPDP Act or Singapore’s PDPA) you may have the right to access, correct, delete or export your data, to object to or restrict certain processing, to withdraw consent, and to complain to your data protection authority. You can download a copy of your data (a JSON file, with no access tokens in it) or delete it yourself from the dashboard, or email us and we will respond within 30 days. We do not discriminate against you for exercising these rights.

9. International transfers

Our infrastructure is in Singapore and our providers may process data in other countries. Where required we rely on appropriate safeguards such as standard contractual clauses.

10. Children

Genrati is for people aged 18 or over. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

11. Changes

We will post updates here and change the date above. For material changes we will notify account holders by email or in the dashboard.

12. Contact

Questions or requests: privacy@psytech.ai