Privacy Policy

1 Scope and privacy roles

Pomeg provides software that helps creators and teams manage social conversations, automations, attribution, collaboration, and AI-assisted workflows. This Policy applies to the Pomeg services that link to it, including the website at pomeg.ai and the Pomeg application, APIs, and support channels, together the Services.

Pomeg acts in two different privacy roles. For account registration, billing records, website activity, product administration, security, and direct support, Pomeg generally decides why and how personal data is processed and acts as a controller or business. For messages, lead profiles, social media data, and other content that a customer imports into or processes through a workspace, the customer generally decides the purpose of processing and Pomeg acts as its processor or service provider.

If you are a lead or contact whose information appears in a Pomeg workspace, the creator, brand, agency, or other customer operating that workspace is usually responsible for your information. You should normally direct a privacy request to that customer. Pomeg will assist the customer or route the request when appropriate.

This Policy does not replace the privacy notices of Meta, Instagram, Whop, OpenAI, Anthropic, or any other third-party service. Their own terms and privacy notices apply when you use their services.

2 Personal data Pomeg collects

Account and identity data

Pomeg collects information used to create and protect an account, such as a name, email address, authentication records, workspace membership, role, account settings, and login and security events. Passwords are not stored in readable form. They are protected using one-way password hashing.

Workspace and subscription data

Pomeg collects workspace names, team invitations, permissions, plan information, subscription status, transaction identifiers, invoices or receipts made available by the payment provider, and records of plan changes, cancellations, credits, disputes, and support relating to billing. Whop and its financial partners process payment credentials. Pomeg generally does not receive or store full payment card numbers.

Social integration data

When a user connects Instagram or another supported platform, Pomeg receives the permissions and data needed to provide the requested integration. Depending on the feature and permissions approved by the platform, this may include social account identifiers, profile information, access tokens, messages, message metadata, comments, replies, media references, conversation participants, timestamps, delivery information, and related platform events.

Customer content and lead data

Customer Content includes messages, lead profiles, tags, notes, assignments, automation settings, AI instructions and outputs, attribution data, uploaded material, and other information placed in a workspace. Customer Content may contain personal data about leads, customers, workspace members, or other people. The customer controls what it connects, imports, stores, and sends through the Services.

Usage and device data

Pomeg may collect browser type, device type, operating system, IP address, approximate region derived from an IP address, referring page, pages or features used, event timestamps, error and performance records, and security signals. Pomeg uses this information to operate, protect, troubleshoot, and improve the Services.

Support and communication data

Pomeg collects the content of communications sent directly to Pomeg, including support requests, feedback, security reports, privacy requests, and related contact information. Support personnel access workspace content only when reasonably necessary to address the request, investigate abuse or security, comply with law, or maintain the Services.

Derived and aggregated data

Pomeg may derive product metrics, reliability metrics, fraud or abuse indicators, and aggregated statistics from the data described above. Pomeg may use and disclose information that has been aggregated or de-identified so that it cannot reasonably be linked to an identifiable person, subject to applicable law.

3 Sources of personal data

Pomeg receives personal data directly from account users, workspace owners and administrators, connected services such as Instagram, payment and authentication providers, people who communicate with Pomeg, and automatically from use of the Services. A customer may also provide information about team members, clients, leads, or other contacts. Customers are responsible for having a lawful basis and any required notices or permissions for information they provide to Pomeg.

4 How Pomeg uses personal data

Pomeg uses personal data for the following purposes:

Provide, personalize, maintain, and support the Services and connected social accounts.

Authenticate users, manage workspaces and permissions, and protect accounts and access tokens.

Receive and route social messages, run customer-configured automations, and produce requested AI-assisted outputs.

Process subscriptions, confirm payment status, administer trials or promotions, and maintain accounting records.

Monitor reliability, prevent fraud and abuse, investigate incidents, enforce agreements, and protect Pomeg, customers, leads, and the public.

Measure feature use and improve the Services using privacy-filtered product analytics.

Respond to support, legal, privacy, and security requests and communicate service or policy changes.

Comply with legal obligations and establish, exercise, or defend legal claims.

5 Legal bases for processing

Where a law requires Pomeg to identify a legal basis, Pomeg relies on one or more of the following: performance of a contract, steps requested before entering a contract, Pomeg's legitimate interests in operating and protecting the Services, the legitimate interests of a customer that has instructed Pomeg, consent where requested, and compliance with legal obligations. Pomeg balances legitimate interests against the rights and expectations of affected people.

When Pomeg processes Customer Content as a processor or service provider, the customer determines the applicable legal basis and instructs Pomeg through the agreement and the customer's use of the Services.

6 Instagram and connected services

A connection to Instagram or another service is optional and is initiated by an authorized workspace user. Pomeg requests only the permissions needed for enabled features. Pomeg uses platform data to provide those features, maintain security, comply with platform rules, and support the customer. Pomeg does not sell platform data or use it for unrelated advertising.

Pomeg stores access credentials only for as long as needed to maintain the connection. Credentials and access tokens are encrypted at rest and are not disclosed to analytics providers. Pomeg transmits them only to the platform that issued them and to infrastructure that must process or store them to operate the connection. Disconnecting an integration stops future collection through that connection, subject to processing already completed and limited retention described in this Policy.

Connected services control their own availability, permissions, API behavior, data retention, and platform rules. A platform may change or revoke access. Pomeg is not responsible for the independent privacy practices of a connected service.

7 AI features and model providers

Pomeg uses OpenAI and Anthropic as AI inference providers for features that a user invokes or a workspace enables. Pomeg sends only the instructions and conversation context reasonably needed to perform the requested task.

Before an AI request is sent, Pomeg applies automated redaction designed to remove direct identifiers such as names, social handles, email addresses, phone numbers, and account identifiers. Pomeg does not intentionally send those identifiers to an AI provider. The remaining context may still qualify as personal data under privacy law if a person could be identified from the context, so Pomeg treats it as protected data and limits it to the requested purpose.

Pomeg uses commercial API services and does not opt in to having API inputs or outputs used to train a provider's general-purpose models. Pomeg does not use private messages or lead content to train a general Pomeg model unless the relevant customer gives separate, express permission. AI providers may temporarily retain API data for security, abuse prevention, or legal compliance under their applicable commercial terms and configured data controls.

8 Privacy preserving analytics

Pomeg uses product analytics to understand feature adoption, reliability, and performance. Before analytics events are sent to an analytics provider, Pomeg removes direct identifiers and excludes message content, lead conversations, access tokens, and customer-provided text. Analytics providers receive only the limited event and technical data needed for product measurement. Pomeg does not permit an analytics provider to use this data to build advertising profiles about Pomeg customers or their leads.

9 How Pomeg discloses personal data

Pomeg may disclose personal data in the following circumstances:

Service providers. Hosting, infrastructure, authentication, communications, payment, AI, analytics, customer support, and security providers process limited data for Pomeg under contractual or equivalent restrictions.

Connected services. Pomeg exchanges data with Instagram, Meta, or another service when a user directs Pomeg to connect or communicate with that service.

Workspace participants. Workspace owners, administrators, members, and authorized client users may access data according to their roles and settings. A workspace owner controls membership and permissions.

Professional advisers. Lawyers, accountants, auditors, insurers, and advisers may receive information when reasonably necessary and subject to confidentiality duties.

Legal and safety reasons. Pomeg may disclose information if reasonably necessary to comply with law or valid legal process, investigate fraud or abuse, protect rights and safety, or establish or defend legal claims.

Business transactions. Information may be disclosed in connection with financing, due diligence, a merger, acquisition, restructuring, sale of assets, or similar transaction, subject to appropriate confidentiality and legal safeguards.

At your direction. Pomeg may disclose information when an authorized user requests it or when the affected person gives consent.

Pomeg does not sell personal data. Pomeg does not share personal data for cross-context behavioral advertising and does not use Customer Content for targeted advertising.

10 International processing and transfers

Pomeg is a Delaware corporation and hosts its production application and primary customer data on Railway infrastructure located in the United States. Pomeg and its providers may process data in the United States and other countries where they operate. Those countries may have different data protection laws from the country where the data originated.

Where required, Pomeg uses contractual safeguards and other lawful transfer mechanisms for international transfers. Customers that need specific data processing or transfer terms should contact Pomeg before submitting regulated personal data.

11 Data retention

Pomeg retains personal data only for as long as reasonably needed for the purposes described in this Policy. Retention depends on the type of data, the customer's settings and instructions, the length of the account relationship, security and dispute needs, platform requirements, and legal obligations.

Account and workspace records are generally kept while the account or workspace is active and for a limited period afterward when needed for account recovery, security, disputes, or legal compliance.

Customer Content is retained while the customer uses the Services and is deleted or de-identified after a valid deletion request or account termination, subject to legal holds and limited backup cycles.

Integration tokens are revoked or deleted after the integration is disconnected or the relevant account is deleted, except for temporary technical copies needed to complete the process.

Billing and transaction records may be retained for the period required by tax, accounting, fraud-prevention, payment, and legal obligations.

Security logs and support records are kept for a limited period appropriate to their purpose.

Aggregated or de-identified information may be retained when it can no longer reasonably identify a person.

Deletion from active systems does not always remove data immediately from encrypted or access-controlled backups. Backup copies are isolated from ordinary use and are overwritten or deleted through the applicable backup cycle unless preservation is legally required.

12 Security

Pomeg uses administrative, technical, and organizational measures designed to protect personal data. These include encrypted network transport, protected credentials and access tokens, one-way password hashing, workspace access controls, restricted production access, data minimization, and filtering that keeps message content and direct identifiers out of third-party analytics. No system is completely secure, and Pomeg cannot guarantee that unauthorized access, loss, or misuse will never occur.

More information is available in the Pomeg Security Overview. Security questions and responsible vulnerability reports may be sent to privacy@pomeg.ai.

13 Privacy choices and rights

Depending on where you live and Pomeg's role, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or an appeal of a request decision. You may also have the right to complain to a privacy regulator. These rights may be limited by identity verification, another person's rights, legal privilege, fraud-prevention needs, or another legal exception.

Account users can update certain information in the Services and can disconnect an Instagram integration from the integration settings. Marketing emails, if any, include an unsubscribe method. Service, security, billing, and legal notices are not marketing and may still be sent while an account remains active.

To exercise a privacy right, email privacy@pomeg.ai. Include the account email, relevant workspace, the right you want to exercise, and enough information for Pomeg to locate and verify the request. Pomeg may ask for additional verification. An authorized agent may submit a request where law permits, but Pomeg may require proof of authority and direct verification from the affected person.

14 Instagram and account data deletion instructions

Any person who can access Pomeg may request deletion. To stop future Instagram collection, an authorized workspace user should first disconnect the Instagram account in Pomeg's integration settings. To request deletion of a Pomeg account, workspace, connected Instagram data, or other personal data, send an email to privacy@pomeg.ai with the subject Data Deletion Request.

The request should identify the Pomeg account email, workspace name, connected Instagram username or account identifier if relevant, and the data to be deleted. Pomeg will verify the request and the requester's authority before deleting another person's or a workspace's data. Pomeg will respond within the period required by applicable law and will delete, de-identify, or restrict the data unless retention is required or permitted for legal, security, fraud-prevention, billing, or dispute purposes.

If you are a lead whose messages are controlled by a Pomeg customer, contact that creator or business first when possible. You may also contact Pomeg. Pomeg will identify the responsible customer where appropriate and assist with the request.

15 Cookies and similar technologies

Pomeg uses cookies and similar storage technologies that are necessary for authentication, session continuity, security, preferences, and core service operation. Pomeg may also use limited analytics technologies configured as described in this Policy. Pomeg does not use Customer Content for advertising cookies or permit third-party analytics tools to receive message content or direct lead identifiers.

Browser controls may block or delete cookies, but blocking necessary cookies can prevent login or other Service functions. Where law requires consent for a non-essential technology, Pomeg will request it before use. Pomeg honors legally required opt-out preference signals when they apply to a processing activity.

16 United States state privacy disclosures

The following table summarizes categories of personal information Pomeg may collect, the business purposes for collection, and the types of recipients to which the information may be disclosed. Whether a particular state law applies depends on legal thresholds and exemptions.

Pomeg does not sell these categories and does not share them for cross-context behavioral advertising. Pomeg does not use sensitive personal information to infer characteristics about people. Residents of states that provide privacy rights may submit requests using the method in Section 13. Pomeg will not discriminate against a person for exercising a privacy right. Where a state provides a right to appeal, an appeal may be submitted to privacy@pomeg.ai with the subject Privacy Appeal.

17 European Economic Area United Kingdom and Switzerland

People in the European Economic Area, United Kingdom, and Switzerland may have rights to access, correct, erase, restrict, or port personal data; object to processing based on legitimate interests or direct marketing; and withdraw consent. Withdrawal does not affect earlier lawful processing. A person may lodge a complaint with the data protection authority where the person lives or works or where an alleged violation occurred.

Pomeg's legal bases are described in Section 5 and international transfers are described in Section 10. When Pomeg acts only on a customer's instructions, Pomeg may direct the request to that customer and will support the customer's response as required by the parties' agreement and applicable law.

18 Children

The Services are not directed to anyone under 18, and a person under 18 may not create an account. Pomeg does not knowingly collect personal data directly from children through account registration. Customers must not use the Services to intentionally collect or process children's personal data without first obtaining all permissions and safeguards required by law. Contact Pomeg if you believe a child has provided personal data improperly.

19 Changes to this Policy

Pomeg may update this Policy to reflect changes in the Services, providers, or law. Pomeg will post the updated version with a new effective date and will provide additional notice when a change is material and applicable law requires it. Continued use after the effective date is subject to the updated Policy, but Pomeg will seek consent when law requires consent for a new use of personal data.

20 Contact Pomeg

Questions, privacy requests, deletion requests, and security reports may be sent to the following contact:

Pomeg, Inc.
1111B South Governors Avenue
Suite 48579
Dover, Delaware 19904
United States

Email privacy@pomeg.ai