Privacy policy

This policy explains which personal data Murmalo processes, why, on what legal basis, who receives it, how long we keep it, and how you can exercise your rights. It covers the website at murmalo.ai and the Murmalo application, including the data we receive from the social networks you connect. Sections 11 to 16 describe each network integration separately.

Murmalo is in open beta. Some features described here reach beta workspaces in stages; this policy already covers them so that nothing is processed before it is described here.

1. Who we are

Murmalo is operated by Ofir, an individual (sole proprietor), based in Netanya, Israel (“Murmalo”, “we”, “us”). We are the controller of the personal data described in this policy, except where section 9 says we act for a workspace.

• Privacy questions, rights requests and data-deletion requests: privacy@murmalo.ai
• Legal notices: legal@murmalo.ai
• Support: support@murmalo.ai

Questions you would address to a data protection officer go to privacy@murmalo.ai; the operator answers them personally.

2. The short version

• We use your data to run the service you asked for: your account, your workspaces, the channels you connect and the posts you schedule.
• We do not sell personal data, we do not use it for advertising, and we do not use your drafts or published posts to train AI models.
• AI features are off in every workspace until an admin turns them on. Only then is the text you choose sent to the AI provider named in the workspace settings.
• The website sets no cookies and runs no analytics. The application uses one strictly necessary session cookie.
• Data from a social network is used only to provide the features you use with that network, as described in sections 11 to 16, and you can disconnect a network at any time.
• You can delete your account, a workspace or a connected channel yourself. The Data deletion page explains every path.

3. Personal data we process

Account data. Your name, email address, password (stored only as a salted hash), interface language, time zone and the roles you hold. If you sign in through a third-party identity provider such as Google or GitHub, where offered, we also receive the provider’s account identifier and the verified email address and name it shares.

Workspace and content data. Organizations, workspaces and membership; drafts, scheduled and published posts and their per-market variants; media you upload; comments, approvals and approval history; series, campaigns, markets and calendar settings. Clients who approve posts through a client portal link are identified by the email address the workspace invited.

Connected channel data. For each social account or page you connect: the network’s account or page identifier, name, username, profile picture, the permissions you granted, and the access and refresh tokens the network issues. Tokens are encrypted before they are stored. Sections 11 to 16 list what each network provides.

Delivery and analytics data. For each post delivered to a channel: the network’s post identifier, link, status and the history of every attempt (the Delivery Ledger), and the public metrics the network reports for your own posts, such as views, likes, comments and shares, stored as daily snapshots.

Engagement data. When a workspace uses Engagement Rules, we process the comments and direct messages that reach its connected Instagram, Facebook Page or X accounts, including the sender’s platform user identifier, username and display name and the message text, plus the replies and messages the rule sends and whether the person opted out.

Billing data. Your plan, billing country, currency and the customer, subscription and invoice identifiers returned by our payment provider. We never receive or store full payment card numbers.

Technical and security data. IP address, browser user agent, request paths, timestamps, session records and security events such as sign-ins, API-key changes and role changes, kept in logs and in an audit log.

Communications. Messages you send to our addresses and our replies.

You are not legally required to give us personal data, but we cannot create an account or run the service without the account data above.

4. Why we process it and our legal bases

If you are in the European Union, the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR (and the UK GDPR).

Purpose	Data	Legal basis
Create and run your account, workspaces and connected channels	Account, workspace, content and channel data	Performance of a contract, Art. 6(1)(b)
Schedule, publish, confirm and report on your posts	Content, channel, delivery and analytics data	Performance of a contract, Art. 6(1)(b)
Run the Engagement Rules a workspace sets up	Engagement data	Legitimate interests of the workspace in answering its audience, Art. 6(1)(f); consent where the network or the law requires it
AI-assisted localization and ideas, when a workspace enables them	The text and instructions sent to the AI provider	Performance of a contract at the workspace’s request, Art. 6(1)(b)
Keep the service secure, prevent abuse and fix errors	Technical and security data	Legitimate interests, Art. 6(1)(f)
Take payment and meet tax and accounting duties	Billing data	Performance of a contract and legal obligation, Art. 6(1)(b) and (c)
Answer support, privacy and deletion requests	Communications and request details	Legal obligation and legitimate interests, Art. 6(1)(c) and (f)
Send service messages, such as sign-in links, approval requests and notices about changes	Account data	Performance of a contract, Art. 6(1)(b)

Where we rely on legitimate interests, we have balanced them against your rights, and you can object as described in section 10. Where we rely on consent, you can withdraw it at any time without affecting earlier processing. We do not send marketing email without your consent.

We do not use personal data for automated decisions that produce legal or similarly significant effects on you.

5. AI features

AI features are off in every workspace until a workspace admin enables them. The enable step names the AI provider that will receive data. At the time of writing that provider is Anthropic, PBC (the Claude API). Once enabled, only the post text, glossary and instructions needed for the task you start, such as adapting a post to a market or suggesting ideas for a date in the Cultural Calendar, are sent to the provider. We never send channel tokens, and we never send data we received from a social network’s API to the AI provider. An admin can turn AI features off at any time, which stops all further AI requests immediately. We do not use your content to train our own or third-party models.

6. Who receives personal data

We share personal data only with the following recipients, and only as far as each needs it.

Service providers (processors) that run Murmalo on our behalf, under written terms that limit them to our instructions:

Provider	Purpose	Location
Cloud server and database hosting (CapRover on a virtual private server, PostgreSQL)	Hosting the application and its database	[OWNER: hosting provider and country]
S3-compatible object storage	Media you upload and database backups	[OWNER: storage provider and country]
Cloudflare, Inc.	Website hosting (Cloudflare Pages), DNS, network security, and forwarding of our contact email addresses	Global network
Email delivery provider	Sending sign-in links, invitations and notifications	[OWNER: email delivery provider and country]
Google LLC (Gmail)	Receiving and storing the messages sent to our contact addresses, which Cloudflare forwards to our mailbox	United States
Dodo Payments	Checkout, payments, sales tax and invoices, as merchant of record, once paid plans start	As stated in Dodo Payments’ own privacy policy
Anthropic, PBC	AI-assisted features, only in workspaces that enabled them	United States

Dodo Payments acts as the merchant of record: it sells the subscription to you, collects payment and handles tax, and processes payment details under its own privacy policy. Nothing is charged during the beta.

The social networks you connect. When you schedule a post, connect a channel or run an Engagement Rule, we send the content, media and actions you instructed to that network through its official API. The network then processes them under its own terms and privacy policy.

People in your workspace. Members and invited clients of a workspace see the content, approvals and comments of that workspace according to their roles.

Authorities and advisers. We disclose data when the law requires it, to protect the rights and safety of people or of the service, or to our professional advisers under confidentiality.

A successor. If Murmalo is transferred to another operator, the data transfers with it under this policy, and we tell you before that happens.

We do not sell personal data and do not share it for cross-context behavioural advertising.

7. International transfers

We operate from Israel, which the European Commission recognises as providing an adequate level of data protection. Some providers listed in section 6 process data in other countries, including the United States. Where a recipient is in a country without an adequacy decision, we rely on the safeguards the provider offers, such as the European Commission’s standard contractual clauses or the provider’s certification under the EU-U.S. Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

8. How long we keep data

Data	How long
Account, workspace, content and media	Until you delete the item, the workspace or the account; then removed within 7 days, and from rolling backups within about 7 more days
Connected channel tokens and profile data	Until you disconnect the channel, the network revokes access, or you delete the workspace or account
Data received from a network’s API	As set in sections 11 to 16, never longer than that network’s policy allows
Delivery history and analytics snapshots	While the workspace and the channel exist and the network’s authorization is valid
Raw inbound engagement events	90 days
Rule runs and engagement actions	13 months, then the contact link and the message text are anonymised
Engagement contacts with no new activity	Deleted after 13 months
Opt-out records	Only a keyed hash of the platform user identifier, kept so the person is never messaged again
Billing and tax records	The period tax and accounting law requires
Technical and security logs	[OWNER: log retention period]
Messages to our contact addresses	As long as needed to answer you and handle any follow-up or legal claim

Retention jobs run daily. We may delete data sooner, but never keep it longer than shown here unless the law requires it.

9. When we act for a workspace

The content a workspace stores, and the engagement data its Engagement Rules collect from its audience, are processed on behalf of the workspace’s owner. For that data the workspace owner decides why it is processed and we act as its processor. If you are a member of the audience of a brand that uses Murmalo, you can contact the brand directly, or write to us and we will pass your request on and help the workspace answer it.

10. Your rights

Everyone. You can ask us for access to your personal data, a copy of it, its correction, or its deletion, and you can object to processing or withdraw consent. Send your request to privacy@murmalo.ai. We may ask you to confirm that you control the account email address. We answer within the period the applicable law sets, and in any case within 30 days. You can also export or delete most data yourself in the application.

Israel. Under the Protection of Privacy Law, 5741-1981, as amended (including Amendment No. 13), you may inspect the information held about you in our database, and ask us to correct or delete information that is not correct, complete, clear or up to date. If we refuse, we tell you why. You can also complain to the Privacy Protection Authority at the Ministry of Justice.

European Union, EEA and United Kingdom. Under the GDPR and the UK GDPR you also have the right to restrict processing, to data portability, and to object at any time to processing based on legitimate interests. You may lodge a complaint with the supervisory authority where you live or work, or where an alleged infringement took place.

Other countries. Brazil’s LGPD, privacy laws of several U.S. states and other laws give similar rights. We honour requests under them in the same way, and we never treat you differently for exercising a right.

11. Google and YouTube

Murmalo uses YouTube API Services. When you connect a YouTube channel, you sign in with Google and grant Murmalo access to:

• Upload videos (youtube.upload), so Murmalo can publish the videos you schedule, with the title, description, privacy status and other settings you choose.
• Read your YouTube account (youtube.readonly), so Murmalo can show the channel you connected, confirm that each upload was published, and show the status and public statistics of the videos Murmalo published for you.

We store the channel identifier, title and thumbnail, the identifiers and status of videos Murmalo uploaded, their statistics and the encrypted tokens. We use this data only to provide those features in Murmalo. We do not sell it, use it for advertising, transfer it to data brokers, or let people read it except with your consent, for security, to comply with the law, or in aggregated form. We do not send YouTube API data to the AI provider.

Murmalo’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

By connecting YouTube you also agree to be bound by the YouTube Terms of Service. Google processes your data under the Google Privacy Policy.

Storage and deletion. We keep the tokens while the channel is connected. Other YouTube API data is refreshed or deleted within 30 days, and we check at least every 30 days that our authorization is still valid before keeping statistics. If you disconnect the channel in Murmalo, we revoke the token at once and delete the channel’s YouTube API data within 7 days. You can also revoke Murmalo’s access at any time on the Google security settings page; we then delete the channel’s YouTube API data within 30 days. If you delete your Murmalo account, we delete your YouTube API data within 7 days. Deleting data in Murmalo does not delete videos already published on YouTube.

Cookies and ads. Murmalo does not store or read cookies on your device for Google or YouTube, shows no advertising and lets no third party serve ads. See the Cookies page.

12. Meta: Facebook Pages, Instagram and Threads

Facebook Pages (through Facebook Login). With your permission Murmalo lists the Pages you manage (pages_show_list) and stores the Page identifier, name, picture and Page access token for each Page you choose; publishes the posts you schedule (pages_manage_posts); reads the engagement on those posts to confirm them and report results (pages_read_engagement); and, if you use a first comment, posts it and reads the comments under your own posts (pages_manage_engagement, pages_read_user_content). If a workspace turns on Engagement Rules for a Page, Murmalo also asks for the messaging permissions that Rules need (pages_messaging, pages_manage_metadata, pages_user_locale).

Instagram (through the Instagram API with Instagram Login, for professional accounts). Murmalo stores the account identifier, username and profile picture (instagram_business_basic), publishes the photos, videos and carousels you schedule (instagram_business_content_publish), posts first comments and reads and answers comments on your own posts (instagram_business_manage_comments), and, when Engagement Rules are on, sends and receives direct messages (instagram_business_manage_messages).

Threads. Murmalo stores the profile identifier, username and picture (threads_basic), publishes the posts you schedule (threads_content_publish) and publishes thread chains and replies to your own posts (threads_manage_replies).

We use Meta Platform Data only for these features, as described in this policy. We do not sell or license it, use it for advertising or profiling, or use it to make eligibility decisions about anyone. Our hosting and storage providers process it only on our instructions. When you disconnect a Meta account, when you or Meta ask us, when we no longer need it, or when you close your account, we delete it as described on the Data deletion page, except where the law requires us to keep it.

You can remove Murmalo from your account at any time in the Facebook apps and websites settings or in the Instagram and Threads settings under website permissions, and request deletion of the data Murmalo received. The Data deletion page explains how that request reaches us.

13. TikTok

With your permission Murmalo reads your basic TikTok profile (open identifier, display name and avatar, user.info.basic), reads the posting options TikTok offers your account, such as the allowed privacy levels and maximum video length, and publishes the videos you schedule (video.publish) with the privacy level, interaction settings and disclosures you choose for each post. Murmalo never picks a privacy level for you and never posts without your explicit action. Videos are transferred to TikTok from our storage. We keep the encrypted tokens while the account is connected and delete TikTok data when you disconnect it or delete your account, as described on the Data deletion page. You can also remove Murmalo in the TikTok app under your security and permissions settings.

14. X

With your permission Murmalo reads your X profile (users.read) and your own posts (tweet.read), publishes the posts and media you schedule (tweet.write, media.write) and keeps you connected without signing in again (offline.access). If a workspace turns on Engagement Rules for X, Murmalo also reads and sends direct messages (dm.read, dm.write) as the rules you set up specify.

We share with X the posts, media and actions you instruct Murmalo to send. Murmalo publishes only what you or your workspace scheduled or approved, shows you what will be posted before it goes out, and sends automated replies or direct messages only under rules a workspace configured, stopping immediately for anyone who opts out. When a post or account is deleted, made private or protected, suspended or withheld on X, we delete or update our copy as soon as reasonably possible, and within 24 hours of a request from X or the account owner. You can revoke access at any time in the X connected apps settings. X processes data under the X Privacy Policy.

15. LinkedIn

With your permission Murmalo signs you in with LinkedIn to read your name, profile picture and member identifier (openid, profile) and publishes the posts you schedule on your profile (w_member_social). For LinkedIn Pages you administer, Murmalo lists those Pages, publishes and reads the Page’s posts and their statistics (w_organization_social, r_organization_social, rw_organization_admin).

We store only the data these features need and within the limits LinkedIn sets for each type of data. We do not store other members’ profile data, and we do not use LinkedIn data for any purpose other than the features you use. When you disconnect LinkedIn, ask us to delete your data or close your account, we delete your LinkedIn data without undue delay and within the deadlines in LinkedIn’s API terms. You can revoke access in your LinkedIn permitted services settings.

16. Bluesky

When you connect a Bluesky account through AT Protocol OAuth, Murmalo stores your account identifier (DID), handle, display name, avatar and encrypted tokens, and creates the posts and uploads the images you schedule. Posts on Bluesky are public and form part of an open network, so other services may copy them; we cannot remove copies held elsewhere. When you disconnect the account or delete your Murmalo account, we delete the Bluesky data we hold, and on request we delete posts Murmalo published for you where Bluesky allows it.

17. Security

We protect personal data with encryption in transit, encryption of channel tokens at rest, salted password hashing, session cookies that are HttpOnly, Secure and SameSite=Lax, scoped API keys, role-based access inside each workspace, an audit log of security-relevant actions and regular backups. No system is perfectly secure. If a breach affects your rights, we notify you and the competent authority as the law requires. To report a vulnerability, write to privacy@murmalo.ai with “Security” in the subject.

18. Children

Murmalo is a tool for businesses and professionals. It is not directed to children, and you must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to us and we will delete it.

19. Cookies

The website sets no cookies. The application uses one strictly necessary session cookie and keeps your interface language in your browser’s local storage. The Cookies page has the details.

20. Changes to this policy

We update this policy when the product or the law changes. The date at the top shows the current version. We announce material changes by email or in the application before they take effect, and we ask for your consent again before we use data in a new way that needs it.

21. Contact

Write to privacy@murmalo.ai for anything about this policy or your data, or send a letter to Ofir, Netanya, Israel.