Privacy Policy

Wahlu is operated by WAHLU LABS PTY LTD (ACN 696 304 140, ABN 99 696 304 140). For privacy questions, requests, or complaints, contact steve@wahlu.com.

Our business is based in New South Wales, Australia.

This policy explains how we collect, use, store, disclose, and delete personal information when you use wahlu.com, the Wahlu application, connected social integrations, support channels, billing flows, and related services.

It applies to personal information we collect from account holders, workspace members, website visitors, leads, and people who contact us.

Depending on how you use Wahlu, we may collect the following categories of data.

• Account and profile data: name, email address, profile image, login method, workspace and team details, and account preferences.
• Billing and payment data: plan, billing status, transaction records, invoice metadata, country, tax details where required, and limited payment metadata from our payment processor, currently Stripe. We do not store full card numbers.
• Connected platform data: OAuth tokens, refresh tokens where applicable, account IDs, page or profile metadata, permissions, token expiry dates, and integration status for services such as Meta, Instagram, TikTok, LinkedIn, YouTube, and Google services.
• Content data: drafts, captions, prompts, images, videos, brand assets, media library items, scheduled posts, publishing history, and workflow settings.
• Usage and device data: IP address, browser type, device information, pages viewed, events, timestamps, referrers, cookies, and diagnostic logs.
• Support and communications: emails, feedback, support messages, product requests, and other information you choose to send us.

We use personal information to:

• create and manage your account, workspaces, and subscriptions;
• provide scheduling, publishing, and AI-powered content features;
• connect and maintain third-party platform integrations;
• process billing, credit allocation, renewals, and support issues;
• send transactional notices, service updates, and account messages;
• monitor performance, fix bugs, prevent abuse, and improve the service;
• comply with legal obligations and resolve disputes; and
• protect Wahlu, our users, and third parties from fraud, misuse, and security threats.

For users in jurisdictions that require a legal basis for processing, we generally rely on one or more of the following:

• Contract: where we need the data to provide the service you asked for.
• Legitimate interests: where we need the data to run, secure, analyse, and improve Wahlu in a way that is reasonable and proportionate.
• Consent: where you choose to connect integrations, accept certain cookies, or otherwise authorise a specific use.
• Legal obligations: where we need the data for tax, accounting, fraud prevention, law enforcement requests, or other legal duties.

In Australia, we also handle personal information in line with applicable privacy laws and reasonable expectations for a SaaS business.

We may share personal information with:

• Service providers and subprocessors that help us run Wahlu, such as hosting, analytics, email delivery, authentication, customer support, storage, and payment processing providers.
• Connected platforms when you ask us to publish, sync, or retrieve data through an integration.
• Professional advisers such as lawyers, accountants, insurers, or auditors where reasonably necessary.
• Authorities or regulators where required by law, court order, or to protect rights, safety, or the service.
• A buyer, investor, or successor in a merger, acquisition, restructure, financing, or asset sale.

We do not sell personal data.

Wahlu lets you connect third-party services including Meta, Instagram, TikTok, LinkedIn, YouTube, and Google services where supported. When you connect an integration:

• we receive the tokens, account identifiers, scopes, and related metadata needed to operate that integration;
• we use that access only to provide the features you requested, such as scheduling, publishing, refreshing tokens, or reading limited business metadata where relevant; and
• your use of those platforms remains subject to their own terms, privacy policies, and platform rules.

Wahlu uses Google API Services for supported Google features. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We only use Google user data to provide or improve user-facing features you actively use inside Wahlu.
• We do not sell Google user data.
• We do not use Google user data for advertising, retargeting, or data-broker style profiling.
• We do not use Google user data to train general-purpose or cross-customer AI or machine learning models.
• We do not let humans read Google user data except where necessary for support you asked for, security work, legal compliance, or other limited situations permitted by Google's policies and applicable law.
• We do not transfer Google user data to third parties except where needed to provide the user-facing feature you requested, for security purposes, to comply with law, or as part of a permitted business transfer.

We keep data for as long as reasonably necessary for the purposes described above.

• Account and workspace data: while your account is active, and usually up to 24 months after closure if needed for legitimate business records, dispute handling, fraud prevention, or reactivation requests.
• Billing, payment, and tax records: usually 7 years where we need them for accounting, tax, and compliance.
• Connected platform tokens and credentials: while the integration is active and for a limited period afterwards to support disconnects, troubleshooting, security, and lawful record-keeping.
• Content, scheduled posts, and media: while your account remains active, and then for a limited cleanup period after cancellation or deletion unless legal retention is required.
• Security and diagnostic logs: usually 30 to 180 days, unless a longer period is reasonably required for abuse prevention or investigation.
• Backups: rolling backups may persist for a limited period after deletion before they are overwritten.

After cancellation, your subscription stops renewing, but your account and stored data are not automatically deleted. If you want deletion, you need to request it separately.

We use reasonable technical and organisational measures designed to protect personal information. These may include access controls, secret management, encrypted transport, logging, monitoring, and credential protection.

Where Wahlu stores OAuth credentials for connected platforms, we store those credentials in encrypted form before writing them to persistent storage. No internet service can be completely secure, so we cannot guarantee absolute security.

Wahlu and its service providers may process data in Australia and other countries where our infrastructure, vendors, or subprocessors operate. By using the service, you understand that your information may be transferred to and processed outside your home jurisdiction, subject to reasonable safeguards and contractual controls where appropriate.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or export certain personal information.

To make a request, email steve@wahlu.com.

• We may need to verify your identity before completing the request.
• We aim to respond within 30 days, although complex requests may take longer where the law allows.
• For account deletion requests, we generally aim to disable account access promptly and complete operational deletion within 30 days, subject to backups, fraud prevention, legal retention, and billing records that we need to keep.
• If you simply cancel your subscription, we may retain your account until you separately request deletion.

Wahlu uses cookies and similar technologies to keep you signed in, remember preferences, measure traffic, understand usage patterns, and improve the service. Some cookies are necessary for core functionality, while others support analytics or product performance.

You can control cookies through your browser settings, but disabling some cookies may affect how the site works.

Wahlu is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will investigate and take appropriate action.

We may update this Privacy Policy from time to time. If we make a material change, we may update the date above, post a notice in the product or on the site, or contact users where appropriate.

For privacy questions, complaints, or requests, contact steve@wahlu.com.

If you are in Australia and think we have not handled your privacy complaint properly, you can also contact the Office of the Australian Information Commissioner or another relevant regulator in your jurisdiction.