Easley Signal

Privacy Policy

Last updated: June 4, 2026

This policy describes how Easley Labs LLC (“Easley Labs,” “we”) collects, uses, stores, and shares information when you use Easley Signal, our client portal at portal.easleylabs.com. We try to be plain about what is happening and why.

What we collect

Account information

When you sign up, we collect your name and email address, and we record the organization you belong to and your role inside that organization. We do not store your password; authentication is handled by Supabase, our identity subprocessor.

Content you upload

Photos, videos, captions, brand information, and any other content you or your guests submit to Signal. Files are stored on Cloudinary; text is stored in our Supabase Postgres database.

Guest submissions

When a guest submits a photo through a QR-coded link, we collect the photo, an optional caption, an optional social handle, the language and version of the consent text shown to them, the timestamp, the IP address, and the user agent of their browser. The IP and user agent are recorded only to evidence consent and are not used for any other purpose.

Connected social accounts

If you connect a Facebook Page or Instagram Business account, we receive the Page ID, the linked Instagram Business Account ID, your name as shown on the Page, and a long-lived Page access token that we use to publish posts you schedule. We encrypt the access token before storing it (AES-256-GCM) and never display it back to you.

Payment information

If you subscribe to a paid plan, billing is processed by Stripe. We do not see or store your full card number. Stripe shares limited information back to us (the customer ID, subscription status, the last four digits of the card) for account management.

Usage information

We log basic activity inside Signal (which pages you visited, which actions you took) to operate and improve the service, to investigate errors, and to detect abuse.

How we use information

  • To operate the portal and deliver the features you request.
  • To draft captions and suggestions using AI subprocessors (see below).
  • To publish posts to your connected social accounts when you schedule them.
  • To send transactional emails about your account and content.
  • To enforce our Terms and detect abuse.
  • To comply with the law.

We do not sell your personal information. We do not use your content to train third-party AI models. The AI services we call do not retain your content for training under their business or enterprise terms.

How we share information

We share information only with the subprocessors we need to deliver the service:

  • Vercel — application hosting.
  • Supabase — authentication and primary database.
  • Cloudinary — image and video storage and delivery.
  • Anthropic — AI drafting of captions and content suggestions.
  • Stripe — subscription billing.
  • Resend — transactional email delivery.
  • Upstash — rate limiting.
  • Meta (Facebook / Instagram) — publishing posts you schedule.
  • Google (Business Profile) — publishing posts you schedule to your Google Business listings.
  • LinkedIn — publishing posts you schedule to your LinkedIn member feed.

We may disclose information when required by law, to protect our rights or the rights of others, or in connection with a business transfer such as a merger or acquisition. If a transfer happens we will notify account owners.

Meta data use

For Instagram and Facebook publishing, we use the access tokens you grant only to take the actions you instruct (publishing scheduled posts, reading the Page and Instagram account metadata required to target the right account, and later reading insights you ask us to show). We do not use Meta-provided data for any other purpose, do not transfer it outside our subprocessors, and delete it within 90 days of disconnecting an account or closing your Signal account.

Google data use

For Google Business Profile publishing, Signal’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use the access and refresh tokens you grant only to publish posts to the Business Profile locations you have connected, and to read the account and location metadata required to target the right location. We do not use Google-provided data for any other purpose, do not transfer it outside our subprocessors, do not use it for advertising or targeting, and do not allow humans to read it except as needed for security investigations or with your explicit consent. We delete it within 90 days of disconnecting an account or closing your Signal account.

How long we keep information

Account information is kept as long as your account is active and for up to 30 days after deletion to allow recovery and meet legal obligations. Content you upload is kept while your account is active; on cancellation we keep it for 30 days, then delete. Logs are kept for up to 12 months. Guest consent records are kept for as long as the related media is stored.

Security

Data is encrypted in transit (TLS). Social access tokens are encrypted at rest. Database access is locked down to service-role keys held only on our servers. We use parameterized queries to prevent injection and run regular dependency audits. No system is perfectly secure; we will notify affected users in the event of a breach as required by law.

Your rights

You can request a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email nate@easleylabs.com and we will respond within 30 days. Depending on where you live, you may have additional rights under state or national law, including the right to opt out of certain processing or to lodge a complaint with a regulator.

Children

Signal is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If a parent or guardian believes a child has provided us information, contact us and we will delete it.

International users

Our services are operated from the United States. If you access Signal from outside the US, you understand that your information is processed in the US, which may have different data protection rules than your country.

Changes to this policy

We will update this policy as the service changes. If a change is material, we will notify account owners by email or by a notice inside Signal at least 14 days before the change takes effect.

Contact

Easley Labs LLC, Denver, Colorado, USA. Email nate@easleylabs.com.