Privacy Policy

PropFarm AI ("Company," "we," "us," or "our") operates the PropFarm AI platform — an autonomous social media management and content propagation service. This Privacy Policy explains how we collect, use, store, disclose, and protect information when you access or use our website at propfarmai.com, our web application, APIs, and any related services (collectively, the "Services").

By accessing or using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree, do not use the Services.

Account Information: When you register, we collect your name, email address, company name, and password. Business and operator accounts may also provide billing information processed by Stripe, Inc.

Social Media Credentials & Tokens: To operate cloud phones and social media profiles on your behalf, we store encrypted OAuth tokens, access tokens, and authentication credentials for connected platforms (Instagram, TikTok, Twitter/X, LinkedIn, Facebook, YouTube). These are encrypted at rest using AES-256 (Fernet). We never store platform passwords in plain text.

Content & Campaign Data: We store the content you create or upload, including text, images, videos, scripts, campaign strategies, and AI-generated drafts, to deliver the Services.

Usage & Behavioral Data: We automatically collect data about your interactions with the Services, including pages viewed, features used, API calls made, session duration, IP address, browser type, and device identifiers. We use this to improve the platform and for security monitoring.

Engagement Metrics: For connected social media profiles, we collect publicly visible engagement data (follower counts, likes, comments, reach) via UIAutomator scraping and social platform APIs to populate your analytics dashboard.

Communications: If you contact us by email or via in-app messaging, we retain the content of those communications to respond to your inquiries and improve the Services.

We use collected information to:

• Provide and operate the Services — schedule and publish social media content, manage cloud phone devices, run AI agent workflows, and execute campaign operations on your behalf.

• Process payments — billing is handled by Stripe; we store plan tier and subscription status but do not store raw card data.

• Improve and develop the Services — analyze usage patterns, troubleshoot issues, and build new features.

• Communicate with you — send account notifications, security alerts, operational updates, and (with your consent) marketing communications.

• Enforce our Terms of Service — detect and prevent fraud, abuse, unauthorized access, and violations of our policies or applicable law.

• Comply with legal obligations — respond to lawful requests from law enforcement, regulators, or courts.

We do not sell your personal information to third parties. We do not use your content or campaign data to train our own AI models without your explicit consent.

By connecting a social media account to PropFarm AI, you authorize us to access and act on that account according to the permissions you grant during the OAuth flow. We will:

• Publish content to the connected platform on the schedule you configure.

• Read basic profile information (username, follower count, profile picture).

• Read post performance metrics (likes, comments, reach, impressions).

• Manage comments and direct messages only if you explicitly enable those features.

We comply with the data use policies of each connected platform (Meta Platform Terms, TikTok Developer Terms, X API Terms, LinkedIn API Terms of Use, YouTube API Terms of Service). Connected platform tokens are stored encrypted and are revocable at any time from your account settings or directly through the platform's security settings.

Your use of connected platform features must comply with each platform's terms of service. PropFarm AI is not responsible for content violations, account suspensions, or penalties imposed by social media platforms.

Storage: Data is stored on servers operated by DigitalOcean, LLC in the United States (SFO3 region). We use PostgreSQL for durable data storage, Redis for real-time session coordination, and Qdrant for vector memory.

Encryption: All data is encrypted in transit using TLS 1.2+. Social media credentials and OAuth tokens are encrypted at rest using AES-256 Fernet encryption. Database access is restricted to authenticated application servers on an isolated private network.

Security practices: We implement fail2ban, UFW firewall rules, SSH key authentication, rate limiting on all API endpoints, and JWT-based authentication with short-lived tokens.

Retention: We retain your account data for as long as your account is active. Deleted accounts are purged within 30 days, except where retention is required by law. Redis session data is ephemeral and expires automatically. Log data is rotated after 30 days.

No guarantees: No method of transmission over the Internet or electronic storage is 100% secure. We take commercially reasonable precautions but cannot guarantee absolute security.

We use the following third-party services that may process your data:

• Stripe, Inc. — payment processing (governed by Stripe's Privacy Policy)

• GeeLark (宇杰科技) — cloud Android phone infrastructure; your social media account activity runs on GeeLark virtual devices

• Anthropic, PBC — AI language model provider (Claude API); content and prompts may be processed by Anthropic subject to their Usage Policy

• OpenAI, Inc. — fallback AI provider; subject to OpenAI's Privacy Policy

• HeyGen, Inc. — AI avatar video rendering; your uploaded face photos/videos are processed by HeyGen

• D-ID Ltd. — AI video generation for DM videos

• Webshare, Inc. — residential proxy services for identity isolation

• DigitalOcean, LLC — cloud infrastructure hosting

We maintain data processing agreements with all subprocessors and require them to protect your data in accordance with applicable law.

We use strictly necessary cookies for session management (JWT authentication). We do not use advertising cookies, third-party tracking pixels, or behavioral targeting technologies. We do not use Google Analytics or similar analytics platforms that share data with third parties.

Our dashboard may use local storage to cache session state and user preferences. This data remains in your browser and is not transmitted to third parties.

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.

• Correction: Request correction of inaccurate or incomplete data.

• Deletion: Request deletion of your account and associated personal data (subject to legal retention requirements).

• Portability: Request a machine-readable export of your data.

• Objection: Object to processing of your data for certain purposes.

• Withdrawal of consent: Disconnect any connected social media platform at any time from Account Settings.

To exercise these rights, email legal@propfarmai.com with the subject line "Data Request." We will respond within 30 days. We may need to verify your identity before fulfilling a request.

California residents may exercise rights under the CCPA by the same process. We do not sell personal information as defined by the CCPA.

EU/EEA residents: Our legal basis for processing is performance of a contract (account services), legitimate interests (security and fraud prevention), and consent (marketing communications). You may lodge a complaint with your local data protection authority.

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected information from a person under 18, we will delete it promptly. If you believe we have inadvertently collected such information, contact us at legal@propfarmai.com.

Your data is processed and stored in the United States. If you access the Services from outside the United States, your data will be transferred to and processed in the US. By using the Services, you consent to this transfer. We apply appropriate safeguards to cross-border data transfers, including Standard Contractual Clauses where required.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated "Last Updated" date and, for significant changes, by email to your registered address. Your continued use of the Services after any change constitutes acceptance of the updated policy. We encourage you to review this page periodically.

For privacy questions, data requests, or to report a security concern:

PropFarm AI — Privacy Team

Email: legal@propfarmai.com

Address: 1111B S Governors Ave STE 20696, Dover, DE 19904, United States