Privacy Policy

The data controller for the Service is an individual entrepreneur in France (sole freelancer), operating under the name Forward Innovations, France. We use the trade name Forward Innovations for the Service. For privacy questions or to exercise your rights, contact aixsuite@forwardinnovations.net.

We collect only what is needed to operate the Service:

• Account information: your email address and basic profile details from Google when you sign in.
• X (Twitter) connection: OAuth access and refresh tokens for your connected X account, and public post and engagement metrics returned by the X API.
• OpenAI API key: the key you provide so the Service can generate content on your behalf.
• Content & settings: your subject, style, and schedule configuration, generated drafts, approvals, and published posts.
• Usage data: estimated OpenAI spend, token counts, and operational logs used to run and secure the Service.
• Billing data: your email, Paddle customer and subscription identifiers, subscription status, and payment-related metadata needed to grant or revoke access. We do not store full payment card numbers — Paddle processes payments as merchant of record.

Where the GDPR applies, we process personal data on the following bases (Article 6):

• Contract: to provide the Service you subscribe to (account, posting workflow, analytics, billing access).
• Legitimate interests: to secure the Service, prevent abuse, monitor infrastructure health, and improve reliability — balanced against your rights.
• Legal obligation: where we must retain or disclose information to comply with law (for example tax or accounting records handled via Paddle).
• Consent: where required for optional actions you initiate (for example connecting third-party accounts). You may withdraw consent by disconnecting those integrations in Settings.

• Generate AI post options and images using your OpenAI key.
• Publish posts and replies to your X account after your explicit approval.
• Sync and display your engagement analytics.
• Send approval and reminder emails.
• Operate, secure, and improve the Service.

We do not sell your personal information, and we do not use your content to train our own models. Content sent to OpenAI is processed under your direct relationship with OpenAI and your API key settings.

The Service uses AI to suggest draft posts and replies. You remain in control: nothing is published to X without your review and explicit approval on the approval page or in the dashboard. Automated scheduling only runs for content you have already approved.

Prompts may include your configured subject, style instructions, and relevant public context from X or sources you enable. Do not include special categories of personal data (health, biometric, etc.) in style instructions unless you have a lawful basis to do so.

Each user can access only their own records, enforced by row-level security. API keys and OAuth tokens are encrypted at rest and are never returned in full to the frontend. Access to production data is restricted and transmitted over encrypted connections.

We use service providers listed on our Subprocessors page. Each provider processes data under their own privacy terms. Paddle acts as merchant of record for payments; its privacy policy applies to payment data they collect: paddle.com/legal/privacy.

Some providers process data outside the European Economic Area. For example, our primary database is hosted in France (Paris), email delivery may use the United States, and application hosting uses regions including France, Ireland, and Germany as described on our Subprocessors page. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and provider commitments in their documentation. Contact us for more detail about transfers relevant to your account.

We keep personal data only as long as needed for the purposes above:

• Account and workflow data: until you delete your account or ask us to erase it, subject to backup cycles (typically up to 30 days).
• Engagement and analytics snapshots: while your account is active, to power dashboards; removed on account deletion.
• Operational logs: limited retention for security and debugging (typically up to 90 days unless a longer period is required for an incident).
• Billing records: retained by Paddle as merchant of record according to their legal obligations.

If the GDPR applies, you may have the right to access, rectify, erase, restrict, or object to processing, and to data portability. You can:

• Download a copy of your data from Settings (Export my data).
• Delete your account from Settings (Delete entire account).
• Email us at aixsuite@forwardinnovations.net for other requests — we respond within one month.

You may lodge a complaint with your supervisory authority. In France, this is the CNIL (cnil.fr).

We use strictly necessary cookies and similar storage for authentication, session security, and basic preferences (for example dismissing this site's cookie notice). We also use Vercel Web Analytics to measure page views and visitors in aggregate (privacy-oriented; no advertising profiles). We do not use advertising cookies or social/ad network trackers.

The Service is not directed at children under 16. We do not knowingly collect personal data from children.

We maintain technical and organizational measures to protect personal data. If we become aware of a personal data breach likely to affect your rights, we will notify you and the relevant supervisory authority as required by applicable law.

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes may also be communicated by email or in-app notice where appropriate.

For privacy questions or data requests, email aixsuite@forwardinnovations.net.