Data Protection Overview
This overview explains how Pomeg, Inc. protects account information, connected social account data, customer content, and personal data relating to a customer's clients and leads. It also explains the controls available to remove a connected account, delete a workspace, and request deletion of covered data.
1 Purpose and scope
Pomeg provides software for creators, brands, agencies, and teams to manage social conversations, lead information, automations, attribution, collaboration, and AI-assisted workflows. This overview applies to personal data processed through the Pomeg website, application, integrations, APIs, and support channels, together the Services.
This document supplements the Pomeg Privacy Policy, Terms of Use, and Security Overview. It describes Pomeg's current data-protection practices but does not create a separate service level, warranty, or data processing agreement. If a signed agreement contains different commitments, the signed agreement controls.
2 Privacy roles and customer control
For account registration, billing administration, product security, service communications, website activity, and direct support, Pomeg generally determines why and how personal data is processed and acts as a controller or business. For messages, lead profiles, social platform data, notes, tags, automations, and other content processed in a customer workspace, the customer generally determines the purpose of processing and Pomeg acts as a processor or service provider.
Customers control which accounts they connect, which team members receive access, which automations they enable, and what information they place in Pomeg. Customers are responsible for their own lawful basis, notices, permissions, and instructions concerning clients, leads, and other people whose data they process through the Services.
Pomeg does not sell personal data, use Customer Content for targeted advertising, or share Customer Content for cross-context behavioral advertising. Pomeg processes Customer Content to provide, secure, maintain, and support the Services and as otherwise described in the Privacy Policy.
3 Data covered by this overview
Data category | Examples | Primary purpose |
Account and team data | Name, email address, authentication records, workspace role, invitations, and security events. | Create and protect accounts, manage access, and communicate about the Services. |
Connected account data | Social account identifiers, profile information, permissions, encrypted access tokens, and platform events. | Maintain the customer-authorized connection and provide enabled integration features. |
Client and lead data | Messages, comments, conversation metadata, lead profiles, tags, notes, assignments, and attribution records. | Operate the customer's inbox, automations, collaboration, and lead-management workflows. |
Customer configuration | Automation rules, AI instructions and outputs, workspace settings, templates, and product preferences. | Carry out the customer's instructions and preserve workspace configuration. |
Operational data | Usage events, error records, device information, support communications, and security logs. | Secure, troubleshoot, support, and improve the Services using minimized data. |
Billing records | Plan, subscription status, transaction identifiers, invoices, disputes, and tax or accounting records. | Administer subscriptions and meet payment, accounting, fraud-prevention, and legal obligations. |
4 Data protection principles
Data minimization. Pomeg limits collection and provider disclosure to information reasonably needed for the selected feature, security, support, billing, or legal compliance.
Purpose limitation. Pomeg uses Customer Content to provide and protect the Services and does not repurpose private messages or lead data for advertising.
Access control. Workspace access is limited by membership and role, and production access is restricted to authorized personnel with an operational, support, security, or legal need.
Protected credentials. Passwords are protected using one-way hashing. Integration tokens and comparable secrets are encrypted at rest and used only for authorized service operations.
Retention limitation. Pomeg keeps personal data only while reasonably needed for the Services, customer instructions, security, disputes, payment records, or legal obligations.
Deletion control. Authorized users can remove a connected account or delete a workspace, and affected people may submit verified privacy requests where applicable.
5 Service providers and data disclosure
Pomeg uses service providers only where they are needed to operate a feature or business function. Pomeg limits each provider's access to the data and purpose required for that function and applies contractual or equivalent confidentiality, privacy, and security restrictions where appropriate.
Provider or category | Purpose | Data protection approach |
Railway | U.S. application hosting, databases, networking, storage, and runtime configuration. | Hosts Pomeg's production application and primary customer data in U.S. deployment regions under access-controlled infrastructure. |
Meta and Instagram | Social account authorization, messages, comments, media references, and platform events. | Receives the credentials and communications needed to operate the customer-authorized connection. |
Whop and payment partners | Checkout, subscriptions, payment processing, fraud, disputes, and applicable tax functions. | Processes payment information; Pomeg ordinarily receives limited subscription and transaction records rather than full card details. |
OpenAI and Anthropic | AI inference for features a user invokes or a workspace enables. | Receives only the instructions and context needed for the task after automated removal of direct identifiers. Pomeg does not opt in to general model training on API inputs or outputs. |
Analytics providers | Product adoption, performance, error, and reliability measurement. | Receives privacy-filtered events that exclude direct identifiers, message bodies, lead conversations, access tokens, and customer-provided text. |
A connected service controls data held independently in its own systems. Removing that service from Pomeg deletes the covered Pomeg copies as described below, but it does not delete information that Meta, Instagram, Whop, or another provider independently holds under its own terms. A user must use that provider's controls for data held solely by the provider.
6 Security measures
Pomeg uses HTTPS and TLS to protect network traffic between users and the Services.
Passwords are not stored in readable form. Access tokens, refresh tokens, API credentials, and comparable secrets are encrypted at rest.
Workspace membership and role checks limit access to workspace information, and customers control invitations and removals.
Production access is limited to authorized personnel and systems that need access for operation, support, security, or legal compliance.
Analytics filtering excludes direct identifiers, private message content, lead conversations, customer-provided text, passwords, and access tokens.
AI requests are minimized and direct identifiers are removed before context is sent to OpenAI or Anthropic. Remaining context is still treated as protected data.
Pomeg monitors reliability, errors, abuse, and indicators of unauthorized access and evaluates notification duties when an incident occurs.
No technical or organizational measure can eliminate all risk. Pomeg maintains measures designed to protect data but cannot guarantee that unauthorized access, loss, or misuse will never occur.
7 Workspace and connected account deletion
Pomeg provides in-product controls that allow an authorized workspace owner or administrator to remove a connected account and allow an authorized workspace owner to delete the workspace. These actions initiate deletion of the covered data from Pomeg's active systems. A user should export any information they need before deletion because deleted Customer Content may not be recoverable.
Customer action | Data Pomeg deletes | Data that may remain |
Remove a connected account | Pomeg revokes or deletes the connection credentials and deletes Customer Content and personal data collected solely through that connection, including associated lead profiles, messages, comments, metadata, media references, derived tags, attribution records, and AI outputs tied solely to that data. | The workspace, member accounts, billing records, content independently added by a customer, and data associated with another active connection remain unless separately deleted. Limited backup or legally required copies may remain temporarily. |
Delete a workspace | Pomeg deletes the workspace's connected-account credentials, conversations, lead and client records, tags, notes, assignments, automations, AI instructions and outputs, attribution data, files, settings, and other Customer Content from active systems. | Pomeg may retain limited account, billing, security, dispute, fraud-prevention, and legal records where needed or required. Isolated backup copies remain only until overwritten or deleted through the applicable backup cycle. |
Submit a privacy request | After verifying identity and authority, Pomeg deletes personal data within the valid scope of the request or assists the responsible customer with deletion when Pomeg acts as its processor. | Pomeg may deny or limit deletion where an applicable legal exception permits retention and will explain the decision or available appeal where required. |
8 How deletion is completed
Deletion removes covered information from the active Pomeg systems used to provide the Services. Pomeg also revokes or deletes credentials under its control so that the removed connection cannot continue collecting new data. Pomeg may de-identify information instead of deleting it where applicable law permits and the information can no longer reasonably identify a person.
Deletion from active systems does not always remove information immediately from encrypted or access-controlled backups. Backup copies are isolated from ordinary product use and are overwritten or deleted through the applicable backup cycle. If a backup must be restored for disaster recovery, Pomeg will reapply recorded deletion actions where reasonably practicable.
Pomeg may retain a limited copy when necessary to comply with tax, accounting, payment, fraud-prevention, security, litigation, regulatory, or other legal obligations. Retained information is limited to the relevant purpose, kept subject to access restrictions, and deleted or de-identified when the retention need ends.
Removing a team member does not delete workspace Customer Content that belongs to the customer. Disconnecting a social account outside Pomeg, uninstalling an application, or canceling a subscription may stop some future activity but does not replace the Pomeg workspace or connected-account deletion controls. Data deletion and subscription cancellation are separate processes unless the product expressly states otherwise.
9 Requests from clients and leads
When a client's or lead's information is stored in a customer workspace, the customer is usually the controller or business responsible for responding to that person. The person should first contact the creator, brand, agency, or other customer operating the workspace. Pomeg will assist the customer with access, correction, deletion, restriction, portability, or objection requests where required by law and covered by the customer's instructions.
A person may also contact Pomeg at privacy@pomeg.ai. Pomeg may route the request to the responsible customer, ask for information needed to identify the relevant workspace, or request identity and authority verification before taking action. Pomeg will not disclose workspace information to an unverified requester.
10 Privacy requests and appeals
Depending on location and Pomeg's role, a person may have rights to request access, correction, deletion, restriction, portability, withdrawal of consent, objection, or an appeal of a request decision. Rights are subject to applicable verification requirements and legal exceptions.
To submit a request, email privacy@pomeg.ai with the subject Data Protection Request. Include the account email, relevant workspace, connected social account identifier if applicable, the requested action, and enough information for Pomeg to locate and verify the request. Pomeg will respond within the period required by applicable law. An authorized agent may act where law permits, subject to proof of authority and any permitted direct verification.
11 International processing
Pomeg is a Delaware corporation and hosts its production application and primary customer data on Railway infrastructure in the United States. Pomeg and necessary providers may process limited data in the United States and other countries where they operate. Where required, Pomeg uses contractual safeguards or another lawful transfer mechanism for international transfers.
12 Changes and contact
Pomeg may update this overview to reflect product, provider, legal, or security changes. The updated version will identify a new effective date. Material changes will receive additional notice where required by law or agreement.
Questions about data protection, deletion, privacy rights, provider use, or security may be sent to:
Pomeg, Inc.
1111B South Governors Avenue
Suite 48579
Dover, Delaware 19904
United States
Email privacy@pomeg.ai