Privacy policy

Who is responsible

Approved is run by XO LABS LTD, a company registered in England and Wales (company number 13849479), registered office: 20-22 Wenlock Road, London, N1 7GU, United Kingdom. XO LABS LTD is the data controller for the personal data described here.

What we collect, and why

Your account: your email address and the name you give us. We use them to sign you in (we email you a code instead of storing a password) and to run your account.

Your business: the public content of the website you give us, the photos you upload, and the instructions you give in chat. We use these to learn about your business and to make your posts. We do not use them to profile you.

Your use of Approved: which steps of signup you reached, which features you use, and basic technical details (IP address, browser). We use these to keep the product working, spot abuse, and understand what to improve.

Payments: handled entirely by Stripe. We keep your subscription status and a record of your invoices. Your card number never reaches our servers.

Your Inbox: the comments, messages and reviews left on the social accounts you connect, with the names and profile pictures of the people who wrote them. We copy them from the platform so you can read and answer them in one place, and we show them to the AI model that suggests replies. We keep 90 days of each conversation.

Cookies and advertising

We set cookies that keep you signed in and remember how you arrived at our site.

Before you sign in, and on the welcome page after you subscribe, our pages load the Meta Pixel. It sets Meta cookies in your browser and tells Meta which pages you visit.

We also send Meta these events from our servers: page visits, starting signup, confirming your email, opening checkout and subscribing. Each event can include your IP address, browser details, Meta cookie values and a random visitor ID, and, once you have given them to us, your email address, name and country. We hash the visitor ID, email address, name and country before sending, so Meta receives a code in place of each value.

Meta uses this to measure our ads, show them to people likely to want Approved, and stop showing them to people who already subscribe. The Meta Pixel does not run on your pages in the app once you sign in. You can control how Meta uses this information in your Meta ad preferences.

Who processes data for us

We use a small set of service providers to run Approved, each bound by contract to process data only for us: Stripe (payments), Postmark (email delivery), Cloudflare (hosting and networking), AI model providers (currently Anthropic and OpenAI) that process your website content and instructions to generate your posts, Zernio (publishing to your connected social accounts), and Meta (advertising measurement).

Some of these providers process data outside the UK, including in the United States, under standard contractual safeguards.

We never sell personal data, and we never use your business content to train AI models.

How long we keep things

Your account and its content stay while your account exists, including while a plan is paused or has lapsed, so if you come back, everything is still there. Signup runs that never became accounts are cleaned up on a rolling schedule. Invoices and payment records are kept as long as tax law requires.

Your rights

UK GDPR gives you the right to see the data we hold about you, correct it, take a copy, restrict or object to its use, and have it deleted. The data deletion page explains how to ask. In short: email us from the email address on your account, and we delete your data within 30 days.

If you think we have handled your data badly, tell us first and we will fix it. You can also complain to the UK Information Commissioner's Office (ico.org.uk).