Privacy policy

Cheerful AI, Inc. ("Cheerful," "we," "us," or "our") operates the Cheerful platform at cheerful.ai and app.cheerful.ai (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information in connection with your use of the Service.

By using the Service you agree to the collection and use of information in accordance with this policy. If you do not agree with our practices, please do not use the Service.

1. Who this policy covers

This policy applies to three groups of users:

• Brand & agency users. Marketing teams who sign in to Cheerful to discover creators, run outreach, manage campaigns, and analyze performance.
• Connected creators. Creators who explicitly connect their Instagram, TikTok, YouTube, or email accounts to a brand using Cheerful.
• Public creator profiles. Creators whose publicly available information appears in our discovery database, sourced from public APIs and aggregator partners.

2. Information we collect

2.1 Information you provide

• Account information: name, email address, company, role, and password (hashed).
• Billing information processed by our payment provider; Cheerful does not store full card numbers.
• Content you upload: campaign briefs, creator lists, messages, attachments, and other materials.
• Communications you send to us, including support requests and feedback.

2.2 Information collected automatically

• Usage data: pages viewed, features used, time spent, and similar telemetry.
• Device and connection data: IP address, browser type and version, operating system, and timestamps.
• Cookies and similar technologies, used for authentication, preferences, and analytics.

2.3 Information from third-party platforms

When you or a creator connects a third-party platform (such as Instagram, Facebook, Google, TikTok, or YouTube), we receive information from that platform under the scopes you authorize. This is described in more detail in the "Instagram and Facebook data" section below.

3. Instagram and Facebook data

Cheerful uses the Instagram Graph API and Facebook Login for Business to help brands obtain authoritative performance data with the explicit consent of the creators they work with. The following section is specific to data we receive from Meta's platforms.

3.1 Permissions we request and what they are used for

• instagram_business_basic — to read the connected Instagram Business account's profile (handle, account ID, follower count, profile picture) and the list of media it has published, so we can match content posted as part of a brand campaign and display authoritative account information inside Cheerful.
• instagram_business_manage_insights — to read aggregated performance metrics for the connected account's posts, reels, and stories (impressions, reach, plays, saves, profile visits, navigation events, follows, and audience demographics where Meta's privacy thresholds are met) and display them to the brand inside Cheerful's campaign analytics.
• instagram_business_manage_messages — to read incoming Instagram Direct messages sent to a brand's connected Instagram Business account and to send replies authored by the brand's team, so brands can manage creator inquiries within Meta's 24-hour standard reply window (and the 7-day Human Agent window where applicable) from a unified Cheerful inbox.

3.2 Data we receive and store

Cheerful supports two types of Instagram connection. The data we receive and store depends on which one a user authorizes:

Creator-authorized connections (a creator authorizes a brand using Cheerful to read their account information and insights). For these connections we receive and may store:

• Account identifiers: Instagram Business Account ID, username, profile picture URL, follower count.
• Media metadata: media IDs, captions, timestamps, permalinks, and media type (image, reel, story).
• Aggregated insights metrics returned by Meta: impressions, reach, plays, saves, profile visits, navigation events, follows, and (where the audience size meets Meta's privacy thresholds) audience country, city, age range, and gender breakdowns.
• OAuth tokens needed to maintain the connection, encrypted at rest.

For creator-authorized connections we do not request or store comment text, follower lists, follower contact information, or any non-aggregated data about the creator's audience.

Brand-owned connections (a brand connects its own Instagram Business account to Cheerful in order to manage its inbox). For these connections we additionally receive and may store:

• Instagram Direct message content (text, attachment URLs, sender Instagram ID and username, recipient Instagram ID, timestamps, and message IDs) for messages sent to or from the brand's connected account, delivered via Meta's webhook subscriptions on the messages field.
• Conversation identifiers and reply-window state used to manage Meta's 24-hour standard reply window and the 7-day Human Agent reply window.
• Reply drafts generated by Cheerful's AI on behalf of the brand, plus any edits or replies the brand's authorized team members send back to Instagram through Cheerful.
• An audit log of every message stored and every reply sent through Cheerful.

Brand-owned messaging data is processed solely to operate the brand's inbox in Cheerful. It is not shared with other Cheerful customers, not sold, not used for advertising, and not used to train AI models for any party other than the brand that owns the data.

3.3 How long we keep Instagram and Facebook data

• OAuth tokens are kept for the lifetime of the connection plus 60 days after revocation, then deleted.
• Cached metric values are kept for the duration of the campaign plus 24 months for historical reporting, then deleted unless you request earlier deletion.
• We re-fetch metrics on a daily schedule rather than persisting raw API responses; cached data is invalidated when the creator revokes access.
• Instagram Direct messages and reply drafts stored under a brand-owned connection are retained for the lifetime of the brand's Cheerful account, then deleted within 30 days of disconnection or account deletion. Brands can request earlier deletion of specific conversations by contacting us.

3.4 How to revoke access

Creators with a creator-authorized connection can disconnect Cheerful at any time by:

• Visiting Facebook's Business Integrations settings at facebook.com/settings?tab=business_tools and removing "Cheerful Creator Connect."
• Emailing chris@cheerful.ai from the email address tied to their account.
• Following the data deletion instructions at cheerful.ai/data-deletion.

Brands with a brand-owned connection can disconnect at any time by:

• Visiting Instagram's connected apps settings at instagram.com/accounts/manage_access and removing Cheerful.
• Clicking "Disconnect Instagram" in Cheerful's Settings → Instagram screen.
• Emailing chris@cheerful.ai from the email tied to their account.

When access is revoked, we receive a deauthorization signal from Meta and remove the relevant OAuth tokens within 24 hours. Cached metrics, stored messages, and reply drafts are removed within 30 days unless retention is required by law.

3.5 Sharing of Instagram and Facebook data

For creator-authorized connections, data received from Meta's platforms is shared only with the brand or agency the creator authorized in their consent screen. For brand-owned connections, messaging and account data is accessible only to authorized members of the brand's Cheerful workspace. In both cases, we do not sell this data, do not use it to build advertising audiences, and do not share it with any other third party except as required to operate the Service (for example, our cloud hosting provider).

4. How we use information

• To provide, operate, and maintain the Service.
• To authenticate users and protect against fraud and abuse.
• To send transactional and product communications.
• To improve features, debug issues, and prioritize roadmap.
• To comply with legal obligations and enforce our terms.

5. How we share information

We share information only in the following circumstances:

• With service providers who help us run the Service (cloud hosting, email delivery, analytics, error tracking) under written confidentiality and data protection agreements.
• Within your team or workspace, so colleagues can collaborate on the same campaigns and creators.
• With a brand a creator authorized, in the case of creator-side data described in Section 3.
• To comply with the law or respond to valid legal process, or to protect rights, property, or safety.
• In connection with a corporate transaction such as a merger, acquisition, or asset sale, with notice to affected users.

We do not sell personal information.

6. Security

We use industry-standard safeguards to protect your information, including encryption in transit (TLS 1.2+) and at rest, role-based access controls, audit logging, and routine security reviews. No system is perfectly secure; if we learn of a breach affecting you, we will notify you in accordance with applicable law.

7. Your rights and choices

Depending on where you live you may have rights to:

• Access, correct, or delete personal information we hold about you.
• Object to or restrict certain processing.
• Receive a portable copy of your data.
• Withdraw consent for processing that relies on consent.
• Lodge a complaint with a supervisory authority.

To exercise these rights, email chris@cheerful.ai. We will respond within the timelines required by applicable law.

8. Children's privacy

The Service is not directed to children under 13 (or under 16 in the European Economic Area), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

9. International transfers

Cheerful is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries. We use standard contractual clauses or other appropriate safeguards where required.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email or through the Service before the changes take effect. The "Last updated" date at the top of this page indicates the most recent revision.

11. Contact us

Questions about this policy or our privacy practices? Email chris@cheerful.ai or write to: