Privacy when you connect an AI app

What the app can see and do

The app acts as the person who connected it, with the role that person has in the workspace they picked when connecting, and only in that workspace. Only a workspace's admins can connect an app.

It can see the workspace's profiles (the handle, the name and the language), make posts, carousels, stories and images, read a post (each slide's text, the caption and the hashtags), and see how many images are left this month. Every image comes out of the workspace's quota.

It can't approve, schedule or publish anything: posts arrive as drafts, and the rest stays with a person, in SmartGenius. It never sees your password or your Instagram connection, and it only gets what a tool returns when it calls one.

Who receives your data

What a tool returns goes to the company behind the AI app you connected, such as Anthropic for Claude or OpenAI for ChatGPT and Codex. That company handles it under its own privacy policy, and SmartGenius doesn't control what it keeps.

To make posts and images, we read the pages behind any links the app sends, and we send the idea, the text and the profile's brand to the AI providers listed in our Privacy policy, the same way we do for posts made in SmartGenius.

What SmartGenius keeps, and for how long

When you connect through the browser, we keep the app's name, the address it sends you back to and who gave permission. The sign-in code works for 5 minutes, and the record is deleted within 2 days after that.

When an agent with no browser connects with a code instead, we keep its name ("AI agent"), who allowed or refused it and when it last asked for its key. We keep only hashes of its codes, never the codes themselves. The code works for 10 minutes, and the record is deleted within 2 days after that.

Connecting makes an API key named after the app, and the workspace's admins get an email. We store only a hash of the key and its first few characters, never the whole key, plus its name, who made it, when, and when it was last used. It works until someone revokes it or the person who made it leaves the workspace. After that, its record stays with the workspace.

Posts the app makes stay in SmartGenius as drafts, as if you had made them, until someone deletes them. We also record what each key spent, along with the rest of the workspace's usage.

Each standalone image's link works for 7 days, and the image is deleted within 2 days after that.

When the app sends a requestId, we keep the first answer for 24 hours, so a retry gets the same answer instead of spending images again. It's deleted within a day after that.

For each request, our API logs the route, the result, how long it took and which key made it, with no IP address and no content. Those logs are deleted within 31 days. Our web server keeps a separate access log with the IP address and the name of the program behind each request, never the key. We keep that log for 180 days, then delete it.

Why we use it

To do what the app asks, show who did what, apply usage limits, keep accounts safe and fix problems. We don't sell this data or use it for advertising.

How to cut an app off

Revoke the key named after the app under API and MCP, in the workspace menu. An agent that connected with a code has a key named "AI agent (device sign-in)". The app loses access at once. Only a workspace's admins can see and revoke keys.

Remove SmartGenius from the AI app too, so the app forgets the key.

If the person who connected the app leaves the workspace, the key stops working at once.

If you delete your account in your settings, we delete the account, and every workspace where you're the only owner, within 8 days of the request. Backups are gone within 31 days after that.

Your rights under the LGPD, and how to use them, are in our Privacy policy.

Contact

Questions about this page? Write to us at info@olhary.ai.