Privacy Policy

This Privacy Policy is issued by Wryko LLC, a California limited liability company ("Wryko," "we," "us," or "our"), with a registered business address at 648 Azure Hills Drive, Simi Valley, CA 93065, United States. It explains how we handle personal information in connection with the Wryko social media management platform, our websites, and related services (the "Service"). For privacy questions or to exercise your rights, contact privacy@wryko.com.

Our two roles. For the personal information of account holders — the people and businesses that sign up for Wryko — we are the controller (the party that decides how and why the data is processed). For the personal information of the people who comment on, mention, or message the social accounts a customer connects, we act as a service provider and processor: we process that data on the customer's behalf and at their direction to draft and post responses and to report engagement. If you are one of those commenters or followers and want to exercise a right, you may contact us or the account holder who manages the account you interacted with, and we will assist.

From account holders:

• Account and contact details: name, work email address, and password credentials managed through our authentication provider.
• Connected social-account metadata for each account you link (Instagram, Facebook, X, and LinkedIn): the handle or page identifier, profile name, and OAuth access and refresh tokens, plus account-level posting and engagement statistics. Tokens are scoped to publishing posts and reading and responding to comments and direct messages.
• Brand context you provide during onboarding: brand voice and tone, content pillars and topics, posting goals and cadence, the platforms you want managed, and any reference captions or sample posts you supply.
• Signup-questionnaire answers, such as business type, target audience, brand voice, posting-cadence goal, the platforms to manage, and any free-text notes.
• Content you upload for publishing: images, video, captions, hashtags, alt text, campaign groupings, and scheduling preferences for your connected accounts.
• Billing details and subscription status, processed by our payment provider, used to manage your plan and to pause publishing if payment lapses.

About the people who interact with your connected accounts:

• Public profile identifiers of people who comment on or send a direct message to your connected accounts: username or handle, display name, profile URL, avatar, and any public bio the platform exposes.
• The content of comments and inbound direct messages on your connected accounts, which we process to classify intent and to draft or post responses at your direction.
• Engagement and audience metrics returned by the platform APIs, such as likes, comments, shares, saves, reach, impressions, and follower counts, used to report your performance back to you.
• This information comes only from the official platform APIs for accounts you connect and manage. Wryko does not import, purchase, or scrape this data, and does not collect email addresses or phone numbers of the people who engage with your content.

• To publish and schedule the content you upload to your connected accounts at an optimized cadence.
• To read comments and inbound direct messages on your connected accounts and to draft or post responses to them at your direction.
• To generate AI-assisted drafts of captions, posts, and replies, and to classify the intent of comments and direct messages so they can be routed and answered.
• To analyze post and audience performance and report engagement and reach metrics back to you in your dashboard.
• To operate, secure, and support the Service, including authenticating your account, maintaining your connected-account sessions, and diagnosing errors.
• To process billing and manage your subscription, including pausing publishing if payment lapses.
• To send you transactional account and authentication email, such as sign-in links, password resets, and the confirmation that a social account has been connected.

AI drafting. Wryko uses AI to draft content for you — for example, captions or suggested replies to comments and direct messages. These drafts are an assist that you review; you remain responsible for what is published on your connected accounts. AI drafting is routed server-side through our proxy to Anthropic (Claude). The brand context and prior message text needed to produce a draft are sent to that provider only to generate your draft. Wryko does not use your private content, your audience's messages, or your engagement data to train AI models, and our AI provider operates under an enterprise agreement that prohibits training on the data we send it.

Where the EU or UK GDPR applies, we rely on the following legal bases to process personal information:

• Performance of a contract — to provide the Service you signed up for, including publishing your content and drafting and posting responses on your connected accounts.
• Legitimate interests — to operate, secure, support, and improve the Service, prevent abuse, and report performance back to you, balanced against your rights and freedoms.
• Consent — for non-essential cookies and any optional processing that asks for it; you may withdraw consent at any time.
• Legal obligation — to meet our accounting, tax, and other legal requirements.

For the personal information of commenters and followers, the account holder determines the purpose and is the controller under GDPR; we process it as their processor under our agreement with them.

We share information with the following categories of subprocessors as needed to deliver the Service:

• Supabase — database, authentication, and media storage, including connected-account records and tokens, your posts, comment and direct-message threads, engagement metrics, and the storage bucket for uploaded and AI-generated media; also hosts the edge function that publishes content and responds to comments and DMs
• Vercel — hosting for the web dashboard and basic performance and uptime telemetry about the app itself
• Stripe — payment processing, billing, and subscription management
• Resend — transactional account and authentication email (sign-in links, password resets, connection confirmations); not used for marketing email and not used for open- or click-tracking
• Anthropic (Claude) — AI drafting of captions and suggested replies, routed server-side through our proxy; operates under an enterprise no-training agreement
• FAL.ai — generative media (AI images, short video, and background audio) produced from a text prompt and stored back in Supabase
• Unsplash — stock imagery for posts, queried by a search term derived from your post content
• Sentry — application error and performance monitoring (technical telemetry such as stack traces and request context; no message content)
• Meta (Facebook and Instagram) — connected through Meta's official OAuth and Graph API; receives the content and first comments you publish, and is the source of insights, comments, mentions, and inbound Instagram and Facebook direct messages
• X (Twitter) — connected through X's official OAuth and API; receives the posts and media you publish, and is the source of mentions, replies, and post metrics
• LinkedIn — connected through LinkedIn's official OAuth and API; receives the posts you publish (LinkedIn is posting-only) and is the source of mentions and engagement in your inbox
• Unipile and Ayrshare — legacy LinkedIn / Instagram and Facebook / Instagram aggregators we are retiring in favor of direct platform OAuth; reachable only for accounts still connected under the older method, until those accounts reconnect through each platform's official OAuth

We may also disclose information to professional advisers, or in connection with a merger, acquisition, or sale of assets, subject to this policy. We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not share the data of people who engage with your content with advertisers. We may disclose information when required by law or to protect rights, safety, or property.

Wryko is a dashboard application, not an email sender. We do not place open- or click-tracking pixels in any communication, and we do not run third-party advertising trackers. The engagement metrics shown in your dashboard come from the social platforms' own APIs, not from any tracking pixel we place.

Our marketing site and product dashboard use essential cookies for authentication and session management, which are required for the app to work and to keep you signed in to your connected accounts. We also use a small number of first-party analytics cookies to understand how the product is used so we can improve it. You can accept or decline non-essential cookies through the consent banner shown on your first visit, and you can change your choice at any time from the "Cookie preferences" link in the site footer.

We retain account data for the duration of your subscription and for up to 90 days after account closure to support reactivation, billing reconciliation, and legal obligations. Content you upload for publishing (images, video, captions) is retained while it is scheduled or published and can be deleted by you at any time from your dashboard; once deleted from Wryko it is removed from our systems within 30 days, though copies already published to your connected accounts are governed by those platforms.

Engagement and audience metrics — likes, comments, shares, reach, follower counts, and the text of comments and direct messages we processed to draft or post responses — are retained while the relevant account is connected and for a limited period afterward for reporting and reconciliation. You can disconnect any account at any time, which stops further collection from it. To meet platform requirements, content that is deleted or edited on the originating platform is deleted or updated in Wryko within 24 hours of the platform's request, and we honor platform-initiated and account-holder data-deletion requests.

Depending on where you live, you have rights over your personal data, and we honor the same rights for the commenters and followers whose public-profile and message data we process on your behalf. Under the EU and UK GDPR these include the rights to access, rectify, erase, restrict, and port your data, to object to certain processing, and to lodge a complaint with your local supervisory authority. Under the California CCPA and CPRA these include the rights to know, access, delete, and correct your personal information, to limit the use of sensitive personal information, and to be free from discrimination for exercising any of them.

To make a request — or to ask us to act on behalf of a commenter or follower — email privacy@wryko.com. We will verify your request and respond within the time the applicable law requires. You may use an authorized agent to submit a request on your behalf, subject to verification. If we decline a request, you may appeal by replying to our response.

This section supplements the policy for California residents under the CCPA/CPRA. In the past 12 months we have collected these categories of personal information: identifiers (name, email, handle); commercial information (subscription and billing status); internet and network activity (app usage and error telemetry); and, for the people who engage with a customer's connected accounts, public profile identifiers and the content of their comments and messages. We collect this information from you, from your connected accounts' platform APIs, and from our subprocessors.

We disclose these categories to the subprocessors listed above solely to provide the Service. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is no "Do Not Sell or Share My Personal Information" action for us to honor. We do not use or disclose sensitive personal information for purposes beyond providing the Service. We retain each category for the periods described in "Data retention" above.

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest, row-level security on the database, encrypted storage of connected-account tokens, scoped service tokens, and regular access reviews. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you in line with applicable law.

Information may be processed in the United States and other countries where our subprocessors operate. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for cross-border transfers.

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16; if we learn we have, we will delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice and we will update the "Effective" date above. For privacy questions or to exercise a right, contact Wryko LLC at privacy@wryko.com or at 648 Azure Hills Drive, Simi Valley, CA 93065, United States. For other support, contact support@wryko.com.