Skip to main content
Pappus

Privacy Policy

Last updated 2026-10-19.

This policy explains what personal data Pappus Labs LLC ("Pappus", "we") collects when you use the Pappus service at pappus.tech, what we receive from the platforms you connect, who processes it for us, how long we keep it, and how to delete it. To delete data now, see Delete your data.

Pappus drafts marketing content for a business. Nothing is published, posted or sent to a platform until a person at that business reviews and approves it in Pappus.

1. Data we collect from you

  • Account data: your name, email address, workspace name, password (stored only as a hash by our sign-in provider), role, and billing details held by Stripe.
  • Content you give us: your brand kit, website address, product facts and claims, uploaded images and videos, instructions, drafts, edits, approvals and the record of who approved what.
  • Usage data: pages visited, features used and error reports. Product analytics and error reporting run only if you turn them on in the cookie banner.
  • Data from platforms you connect: described platform by platform in section 4.

2. How we use it

We use personal data only to provide the features you see in Pappus: to draft content for your approval, to publish or send what you approve, to show you comments, mentions and performance for posts Pappus published for you, to bill you, to keep the service secure, and to meet legal obligations. We do not sell personal data, do not use it for advertising, do not build profiles of people who comment on your posts, and do not use your content or any platform data to train AI models.

3. How AI is used

Pappus drafts and reviews content with Anthropic's Claude models running on Amazon Bedrock, part of Amazon Web Services (AWS), and runs web research through Amazon Bedrock AgentCore. Amazon Bedrock does not use the inputs or outputs to train models and does not share them with the model provider. Requests may be processed in any AWS region through Bedrock's cross-region inference. Voyage AI turns short text excerpts into embeddings so Pappus can check that new drafts don't repeat old ones. When you generate images, video or voice-over, the prompt is sent to the media provider that renders it (listed in section 6). Every generated image and video carries C2PA Content Credentials identifying it as AI-generated.

4. Data we receive from platforms you connect

You connect a platform from Connections in Pappus. Before the platform's own permission screen opens, Pappus shows you what it will do and what it will read. Pappus holds the access tokens the platform issues itself: they are stored encrypted, and the encryption key is kept in AWS Secrets Manager, never in our database. We use the tokens only to act for your workspace, and delete them when you disconnect the platform or delete your workspace. You can disconnect any platform at any time (section 8); disconnecting deletes the data below that we received from that platform.

LinkedIn

  • What we receive: your LinkedIn member ID and name; if you publish as a Company Page, the Pages you administer and their names; the IDs and links of posts Pappus publishes for you; for Company Page posts, comments on those posts and their like, comment and share counts and Page share statistics.
  • Why: to publish what you approve and to report on your own posts. Comment text is sent to our AI provider only to score its sentiment; it is not used for training.
  • How long: comment text is deleted 48 hours after we receive it (we keep only the sentiment score and time); post statistics are deleted after one year; everything we received from LinkedIn is deleted when you disconnect LinkedIn or close your account.
  • Never: we do not use LinkedIn data for sales prospecting, advertising, recruiting or audience building, and do not combine it with other data.

Facebook and Instagram (Meta)

  • What we receive: your app-scoped Facebook user ID (used only to match a deletion request Meta sends us); the names and IDs of the Facebook Pages and Instagram professional accounts you select; IDs and links of posts Pappus publishes for you; comments on those posts (for Instagram, the commenter's username, used to skip your own replies; for Facebook, no commenter identity at all); and the insight metrics Meta reports for those posts.
  • Why: to publish what you approve, to show comments and an AI sentiment summary in Brand health, and to show performance.
  • How long: comment records are deleted after 180 days; post metrics after 400 days; everything we received from Meta is deleted when you disconnect, when you remove Pappus in your Facebook or Instagram settings, or when you ask us.

X

  • What we receive: your X account ID and username; the IDs of posts Pappus publishes for you and their public metrics; public posts that mention your account (their ID, text and author ID).
  • Why: to publish what you approve, to report performance, and to alert you to sharp changes in how people talk about your brand.
  • How long: the text of a mention is deleted within 24 hours (we keep its ID, sentiment and time); we stop reading a post's metrics 30 days after it is published; we delete X content that has been deleted on X; everything we received from X is deleted within 24 hours of a disconnect or a request.

TikTok

  • What we receive: your TikTok open ID, display name and avatar, and the status of videos Pappus sends for you.
  • Why: to send a video you approved to your TikTok inbox, where you finish and post it in TikTok, and to show you whether it arrived. We do not read your videos, followers or messages, and we add no logo or watermark to videos sent to TikTok.
  • How long: deleted when you disconnect, when you remove Pappus in TikTok's settings, or when you ask us.

Reddit

  • What we receive: your Reddit username, the posting requirements and rules of a subreddit you choose, and the ID and link of a post Pappus submits for you.
  • Why: to check a draft against that subreddit's rules before you review it, and to submit the one post you approve to the one subreddit you chose. We do not read comments, vote, message anyone or post anywhere else.
  • How long: the subreddit rules are kept with the draft so you can see what it was checked against; your username is deleted when you disconnect Reddit or ask us.

Gmail (Google user data)

  • What we access: with your permission, Pappus uses the Gmail API to send emails you approve from your Gmail account, and receives your Google account email address to identify the connected mailbox. If you also allow reading, Pappus opens only the messages in email threads Pappus started, and receives notices of new inbox messages (message and thread identifiers only) to detect replies; it opens no other message.
  • How we use it: only to provide the Gmail outreach features you see in Pappus: sending your approved emails, showing replies in the conversation, and, when you click "Draft reply", writing a reply suggestion with AI (the conversation text is sent to Amazon Bedrock for that request only).
  • How we store it: tokens are held by Pappus, encrypted with a key kept in AWS Secrets Manager (never in our database); messages in Pappus-started threads are stored encrypted in our database on AWS in the United States. Message text is deleted when you disconnect Gmail; messages are deleted entirely up to two years after the prospect becomes inactive, or when you delete your data.
  • How we share it: only with AWS (hosting and AI reply drafting), to provide these features. We do not sell Google user data, do not use it for advertising, do not use it to train or improve AI models, and do not let people read it unless you ask us to, it is needed for security or to comply with the law, or it is aggregated and anonymised for internal operations.
  • Your controls: disconnect Gmail in Connections, revoke access at myaccount.google.com/permissions, and delete your data at Delete your data.

Limited Use. Pappus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See the Google API Services User Data Policy. The use of information received from Google Workspace scopes will also adhere to the Google Workspace API User Data and Developer Policy.

Blogs and newsletters (HubSpot, Webflow, Ghost, Beehiiv, Substack)

We receive the IDs of the site, blog, collection or publication you choose and of the posts Pappus creates there. Posts are created as drafts in your tool for you to publish. Substack is an export you paste yourself; we do not connect to it. Deleted when you disconnect.

5. People who are not Pappus users

A business using Pappus may store data about other people: contacts who signed up on its forms or newsletter, prospects it chose to reach out to (business contact details from a licensed data provider when the business enables it), and people who commented on or mentioned its posts. For contacts and prospects, the business decides what is collected and why, and Pappus processes the data on its behalf. If you are one of these people and want your data deleted, unsubscribe from the email you received, contact the business, or email support@pappus.tech with your email address or platform handle; we will verify the request and delete it within 30 days.

6. Service providers that process data for us

List last updated: 2026-10-19. Each provider processes data only to run the part of Pappus named, under a data processing agreement.

  • Amazon Web Services — hosting, database, file storage, AI models (Amazon Bedrock) and web research (Bedrock AgentCore). All Pappus data. United States; AI requests may run in other AWS regions.
  • Cloudflare — delivers the pappus.tech website and DNS. Web traffic. Global.
  • Supabase — sign-in and sessions. Email, password hash, session tokens.
  • Temporal Technologies — runs scheduled and long-running jobs. Job state, which can include draft content.
  • Voyage AI — embeddings for originality checks. Short text excerpts. United States.
  • Stripe — payments and invoices. Name, billing address, payment method. United States and EU.
  • Resend — account and notification email, and email you send to your contacts. Email address, message. United States and EU.
  • Sentry and PostHog — error reports and product analytics, only if you opt in. Scrubbed of personal fields before sending.
  • Media providers, only when you generate that kind of media: Black Forest Labs, Ideogram, Recraft, Google (Gemini), OpenAI (images); Google (Veo) and Runway (video); ElevenLabs (voice and music); Deepgram (transcription of videos you upload). The prompt, and for edits the image or video you supplied.
  • Apollo, Hunter and NeverBounce, only if your workspace turns on prospect discovery: business contact details and email verification.

The platforms in section 4 receive the content you approve for them; they are not our processors, and their own privacy policies apply.

7. How long we keep data

  • Account and content data: while your account is open.
  • Data received from a platform: as stated in section 4, and deleted when you disconnect that platform.
  • Contacts: until the business deletes them or closes its account.
  • Outreach email conversations: up to two years after the prospect becomes inactive.
  • Security and audit records: 400 days.
  • Application logs: 30 days. Database backups: 7 days.
  • After an account is deleted, all of the above is erased within 30 days, including from our providers; backups expire within 7 days after that.

8. Deleting your data and your rights

The page Delete your data explains every route, whether or not you can sign in: disconnecting one platform, removing Pappus in the platform's own settings, deleting your whole workspace, and asking us by email. You can also ask us to give you a copy of your data, correct it or restrict its use. We complete verified requests within 30 days, free of charge.

9. Cookies

See the Cookie Policy. Non-essential cookies are off until you turn them on.

10. International transfers

Pappus runs on AWS in the United States. AI requests may be processed in other AWS regions. Where data leaves the EU or UK we rely on Standard Contractual Clauses, with encryption in transit and at rest.

11. Security

Data is encrypted in transit and at rest. Each business's data is isolated at the database level with row-level security. Approvals are cryptographically signed. Access tokens for connected platforms are held by Pappus and stored encrypted, with the encryption key kept in AWS Secrets Manager, never in our database. They are deleted when you disconnect the platform or delete your workspace.

12. Children

Pappus is not intended for anyone under 18, and we do not knowingly collect their data.

13. Changes

We will email account owners at least 14 days before a material change takes effect, and update the date above.

14. Contact

Privacy questions and requests: support@pappus.tech. Legal notices: contact@pappus.tech.