Privacy Policy

• Account data — your email (Firebase Authentication, including via Google or Apple sign-in), and, if you connect a social channel, the access tokens that channel issues to us (OAuth tokens for Facebook, Instagram, Threads, X, and LinkedIn; a session token for Bluesky, where the app password you enter is exchanged for that session and not stored).
• Push notification token— if you use the Rebbel mobile app and allow notifications, a device push token (via Expo’s push notification service) so we can notify you when something needs your approval. You can disable this in your device’s notification settings at any time.
• Brand data you provide — business name, website URL, descriptions of what you sell and who you sell to, and any images you upload.
• Data we generate on your behalf — brand guides, marketing strategies, campaign copy, and AI-generated images/video, stored against your account.
• Usage/cost data— a record of each AI generation call (provider, model, and estimated cost) used to enforce your plan’s monthly generation budget.
• Connected-channel data— if you connect a Facebook Page, an Instagram professional account, a Threads profile, an X account, your LinkedIn profile, or a Bluesky account, we store the connection and use it to publish posts you’ve explicitly approved and scheduled, and to read metrics for those posts (and, where the channel provides them, basic account metrics such as follower counts) so we can show you results.

We do not collect payment card data directly — billing (when live) is handled by Stripe, which has its own privacy policy.

• To generate your brand guide, strategy, and campaign assets.
• To publish approved, scheduled posts to your connected channels.
• To enforce per-account generation budgets (cost control) and, on paid plans, billing.
• To operate, secure, and improve the product.

We do not sell your data.

Generating content and publishing posts necessarily sends some of your data to the providers that do that work:

• AI generation providers(subject to change) — OpenAI (text, image analysis, voiceover, and transcription), Ideogram and Recraft (images), and fal.ai (which provides the video and music models we use, currently Kling, Google Veo, and Stable Audio). Brand context and generation prompts are sent to these providers to produce copy, images, video, and music.
• AI assistants you connect— if you connect Rebbel to an AI assistant through the Rebbel MCP server (for example Claude from Anthropic, ChatGPT from OpenAI, Gemini CLI or Gemini Spark from Google, Microsoft Copilot, Perplexity, Cursor, or another assistant you choose), that assistant’s provider receives the Rebbel data you ask it to read or act on, under that provider’s own terms. We don’t send your data to an assistant you haven’t connected.
• Social platforms you connect— Meta (Facebook, Instagram, Threads), X, LinkedIn, and Bluesky. If you connect a channel, we use that platform’s API to publish posts you’ve approved and to read post and account metrics on your behalf.
• Email— Resend, for transactional email.
• Email/CRM— Klaviyo, which stores your account email and product-usage milestones (e.g. whether you’ve created a brand, approved a guide) for internal analytics and segmentation. We only send you product update emails through Klaviyo if you’ve explicitly opted in — see “Your choices” below.
• Infrastructure— Firebase/Google Cloud Platform (database, file storage, authentication, hosting), Vercel (application hosting), Expo (push notification delivery for the mobile app).
• Analytics— Google Analytics (GA4), to understand how rebbel.io and app.rebbel.io are used (page views, general usage patterns) — not your brand or campaign content.
• Fonts— Google Fonts. When we show you what we found on your website during brand setup, your browser requests the fonts your site uses from Google’s font service (fonts.googleapis.com), which sees your IP address and the font names, but not your brand or campaign content. We ask that no referrer be sent with the request.
• Website rendering— ScreenshotOne. When a web page we read for you (your website, when we set up and research your brand or look through it for your photos, or a link you give us to build a campaign from) doesn’t show its content until it runs in a browser, we ask ScreenshotOne to load it and send back the rendered page. ScreenshotOne receives the address of that public page, not your account details or your brand or campaign content.
• Local business search— the Google Places API. For a business that serves a local area, we search Google Places for similar businesses nearby to suggest as competitors. Google receives a search phrase made from your business category and the area you serve (for example, “bakery near Austin, TX”), not your account details or your brand or campaign content.
• Billing(when live) — Stripe.

We do not share your data with third parties for their own marketing purposes.

Your brand, campaign, and account data is retained for as long as your account is active. If you request deletion, we’ll delete your data within 30 days.

• You control every publish — nothing goes to a connected channel without your explicit approval and scheduling action.
• You can disconnect a social channel at any time from the Rebbel dashboard.
• Product update emails are opt-in only — you’ll only receive them if you explicitly checked that box (at sign-up or when connecting an AI assistant), and every email includes an unsubscribe link.
• To request account or data deletion, email support@rebbel.io — we’ll confirm and complete it within 30 days.

Rebbel is a business tool intended for users 18 and older. We do not knowingly collect data from children under 13, and if we learn we have, we’ll delete it.

We’ll post material changes to this page with a revised “Last updated” date above.

support@rebbel.io