Privacy Policy — Apricotter
Effective Date: May 25, 2026 Last Updated: August 18, 2026
1. Introduction
Apricotter ("we," "us," or "our") operates the Apricotter platform and website at apricotter.com. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.
By creating an account or using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.
2. Information We Collect
2.1 Account Information
When you sign up, we collect your name, email address, and billing information. Payment processing is handled by Stripe — Apricotter does not store credit card numbers or payment credentials.
2.2 Social Media Connections
When you connect your social accounts (Facebook, Instagram, TikTok), we receive and store OAuth access tokens issued by those platforms. We do not store your social media passwords. Tokens are stored server-side only, encrypted at rest, and never exposed in client-side code or public repositories. Tokens are used solely to publish your approved content to connected platforms — for no other purpose. All tokens are deleted within 30 days of account cancellation.
2.3 Source Material
You may upload books, manuscripts, author bios, headshots, character images, and other creative assets as source material for content generation. This material is stored and processed to deliver the Service.
2.4 Analytics and Audience Data
We collect analytics data from your connected social media accounts and website, including post performance, engagement metrics, click-through rates, and attribution data tracked via Matomo.
2.5 Communications
We collect the content of emails and messages you send us, including support requests and content approval communications.
2.6 Website and Usage Data
When you visit apricotter.com, we collect usage data through RudderStack, including pages visited, time on site, browser type, device type, IP address, and referral source.
2.7 Lead and Contact Data
If you submit an inquiry or contact form before becoming a client, we collect your name, email address, and the content of your inquiry. This data is retained for a minimum of seven (7) years.
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and improve the Service
- Generate social media content from your source material
- Publish approved content to your connected platforms
- Process billing and send transactional communications (receipts, content approvals, platform notifications)
- Send marketing communications — newsletters, product updates, promotions — where you have not opted out
- Track attribution from post to click to purchase on your behalf
- Respond to support requests
- Detect and prevent fraud or abuse
- Comply with legal obligations
4. AI Processing and Third-Party Models
To generate content on your behalf, Apricotter uses the following AI services:
4.1 Google Gemini API (Paid Tier)
Apricotter uses the Google Gemini API under a paid billing account (Tier 1). Under Google's Paid Services terms and the Google Data Processing Addendum, Google acts as a data processor on Apricotter's behalf. Google does not use your prompts or source material to train or improve its models. Inputs and responses are logged transiently solely for abuse detection and safety compliance, then deleted. Your data is not reviewed by human reviewers under the paid tier.
4.2 Open-Source Models (On-Premises)
Apricotter operates open-source AI models on its own GPU infrastructure (H100 servers). Data processed by these models does not leave Apricotter's systems and is not shared with any third party.
4.3 No AI Training on Your Data
Neither Google nor Apricotter's on-premises models use your source material — including manuscripts, author bios, images, or any client-provided content — to train general-purpose AI models. Apricotter does not sell, license, or otherwise provide your content to any AI training dataset.
4.4 Your Acknowledgment
By using the Service, you acknowledge that your approved source material will be transmitted to the Google Gemini API for the purpose of generating social media content on your behalf, under the data processing terms described above.
5. Third-Party Services and Data Sharing
We share data with third parties only as necessary to provide the Service. We do not sell your personal data. We do not share your data with advertisers or data brokers.
5.1 Third-Party Service Providers
| Third Party | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing | Name, email, billing address |
| Google (Gemini API — Paid Tier) | Content generation | Source material, author info |
| Facebook / Meta API | Publishing approved content | OAuth tokens, approved post content |
| Instagram API | Publishing approved content | OAuth tokens, approved post content |
| TikTok API | Publishing approved content | OAuth tokens, approved post content |
| RudderStack | Website analytics | Usage data, IP address |
| Matomo | Attribution analytics | Click and purchase data |
5.2 Social Platform Developer Obligations
By connecting your social accounts, you authorize Apricotter to act as a developer integration under each platform's developer policies. This means:
- Meta (Facebook/Instagram): Apricotter complies with Meta's Platform Terms including data security requirements. Stored Platform Data is encrypted at rest. Apricotter may be required to complete Meta's annual Data Protection Assessment.
- TikTok: Apricotter complies with TikTok's Developer Guidelines. TikTok access tokens expire every 24 hours and are automatically refreshed. Your data belongs to you — Apricotter uses TikTok access solely to publish your approved content.
You may disconnect any social account at any time through your account settings. Upon disconnection, the associated OAuth tokens are immediately revoked and deleted.
6. Marketing Communications
We may send you marketing emails including newsletters, feature announcements, and promotional offers. You may opt out at any time by:
- Clicking the unsubscribe link in any marketing email, or
- Emailing support@apricotter.com with "Unsubscribe" in the subject line
We will process your opt-out request within 10 business days. We will not require you to pay a fee, provide more than your email address, or take any steps beyond a single request to unsubscribe.
Transactional emails — billing receipts, content approval notifications, account security alerts, and Service updates — are not subject to marketing opt-out as they are necessary to provide the Service.
CAN-SPAM Compliance. Apricotter complies with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.). Every marketing email we send:
- Accurately identifies Apricotter as the sender in the "From" field
- Contains an honest subject line that matches the content
- Is clearly identified as a commercial message
- Includes our valid physical mailing address: P.O. Box 4821, Tampa, FL 33601
- Includes a clear, one-click unsubscribe mechanism
7. Cookies and Tracking
Apricotter uses RudderStack for website analytics. RudderStack may set cookies or use similar tracking technologies to understand how visitors use our website.
Types of tracking we use:
- Analytics cookies — understand traffic patterns, page performance, and user behavior on apricotter.com
- Session cookies — maintain your logged-in session
We do not use third-party advertising pixels or retargeting cookies on apricotter.com.
You may disable cookies in your browser settings. Doing so may affect your ability to use certain features of the Service.
8. Data Retention
| Data Type | Retention Period |
|---|---|
| Active client account data | Duration of subscription |
| Source material (manuscripts, author bios, images) | Deleted within 30 days of cancellation; or immediately upon verified deletion request |
| Social media OAuth tokens | Deleted within 30 days of cancellation |
| Other account and usage data | Deleted within 30 days of cancellation; or immediately upon verified deletion request |
| Lead and contact form data | Minimum 7 years |
| Billing records | 7 years (legal/tax requirement) |
| Anonymized/aggregate platform data | Indefinitely (cannot be attributed to any individual) |
| Marketing email opt-out records | Indefinitely (to honor opt-out) |
9. Your Rights
Apricotter honors the following rights for all users regardless of location:
- Access — request a copy of the personal data we hold about you
- Correction — request correction of inaccurate or incomplete data
- Deletion — request deletion of your personal data (subject to legal retention requirements such as 7-year billing records)
- Portability — request your data in a machine-readable format
- Opt-out of marketing — unsubscribe from marketing emails at any time (see Section 6)
- Opt-out of sale — Apricotter does not sell personal data. This right is satisfied by default.
To exercise any of these rights, contact us at support@apricotter.com. We will respond within 45 days (extendable by an additional 45 days with notice for complex requests).
9.1 US State Privacy Law Applicability
As of 2026, twenty US states have comprehensive consumer privacy laws. Most apply only when a business processes data of 100,000 or more state residents annually, or derives significant revenue from selling personal data. Apricotter does not sell personal data, which removes the revenue-based triggers in most state laws.
| State | Threshold | Apricotter Status |
|---|---|---|
| California (CCPA/CPRA) | $26.6M revenue OR 100k+ residents | Below threshold at launch |
| Virginia (VCDPA) | 100k OR 25k + 50% data sales | Below threshold at launch |
| Colorado (CPA) | 100k OR 25k + data sales | Below threshold at launch |
| Texas (TDPSA) | No numeric threshold — small business exemption | Monitor — no threshold |
| Montana (MCDPA) | 25k OR 15k + 25% data sales | Lowest threshold — monitor as scale grows |
| Most other states | 100k OR 25k + 50% data sales | Below threshold at launch |
As Apricotter scales, additional state obligations may apply. We commit to updating this Privacy Policy and our practices as we reach applicable thresholds. Texas residents may contact us at any time to exercise privacy rights regardless of threshold status.
9.2 No Private Right of Action
US state privacy laws are enforced primarily by state Attorneys General. No state currently provides a general private right of action for privacy violations. California (CPRA) provides a narrow private right of action limited to data breaches involving certain sensitive categories (Social Security numbers, financial account credentials, medical information) — not for general privacy claims. Individual lawsuits under general state privacy law are not available.
10. Security
We implement reasonable technical and organizational measures to protect your data, including encrypted transmission (HTTPS), access controls, and secure credential storage. No system is perfectly secure. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.
11. Children's Privacy
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we discover we have collected data from a user under 18, we will delete it immediately.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 14 days before taking effect. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.
13. Contact Us
For privacy questions, data requests, or to exercise your rights:
Email: privacy@apricotter.com Address: P.O. Box 4821, Tampa, FL 33601
14. Governing Law
This Privacy Policy is governed by the laws of the State of Florida, consistent with our Terms of Service.