Privacy Policy

Effective Date: 20 October 2026

1. Overview of Our Privacy Practices

Rheos is an AI-powered content creation and social media management service provided by Rheos App Ltd ("Rheos", "we", "our" or "us"). This policy explains what personal data we collect, why we use it, who receives it, how long we keep it, and the choices and rights available to you.

Controller Details & Processor Status (UK GDPR)

Rheos App Ltd, company number 17105158. Registered office: 60 Farm Road, Beeston, Nottingham, England, NG9 5DA. Privacy contact: archie@rheos.app.

Controller: Rheos acts as controller for account, billing, product-usage, support, sales and security data.
Processor: Where a customer determines why and how workspace or social-media content is processed and asks Rheos to process it on the customer's behalf, Rheos may act as that customer's processor. The applicable role depends on the processing activity, not merely the type of data. Customers who require a data processing agreement can contact us.

The Service is intended for people aged 18 or over and is not directed to children. If you believe a child has provided personal data to Rheos, contact us so that we can investigate and take appropriate action.

2. Personal Data We Collect

We collect data you provide, data created through your use of Rheos, data obtained from services you choose to connect, and technical data generated when the Service operates.

A. Account, Organisation and Billing Data

Name, email address, profile picture and authentication identifiers used with Firebase Authentication.
Organisation, workspace, membership, role and administrator information.
Subscription, invoice, transaction and customer references handled with Stripe. Rheos does not store raw credit-card information.
Account-deletion requests and an audit snapshot of the deletion process.

B. Content, Sources and AI Data

Post drafts, captions, schedules, publishing instructions and generated content.
Images, videos, logos, brand guidelines, identity documents, source documents and other business assets you upload or import.
Website pages you ask Rheos to retrieve (via our provider Firecrawl), including versioned markdown created from those pages.
Prompts, source material, settings, and generated text or media submitted to or returned by Rheos's AI features.
AI usage telemetry, which can include up to the first 500 characters of serialised input and up to the first 500 characters of serialised output per AI request, retained in usage records for billing, metering and abuse prevention.

C. Connected-Platform and Connector Data

When you authorise a connection, Rheos may receive account identifiers, usernames, profile images, administered pages or organisations, connection status, OAuth access or refresh credentials, publishing permissions, posts, comments, engagement and platform metrics needed for the feature you request. Optional asset-import connections include Google Drive, Microsoft OneDrive and Canva; these are used only when you choose to connect the relevant service and request an import. Platform-specific details are in the subsections below.

D. Product, Support and Technical Data

IP address, browser and device information, pages and features used, timestamps, performance information, errors and diagnostic context.
Product analytics linked to account or organisation identifiers through Amplitude.
Session recordings through Amplitude and LogRocket, only if you switch them on (see section 6). Error reports through Sentry, which runs in the EU and records the error, the page, your browser and, in the Rheos app, your account ID and email address. Sentry does not record your screen.
Support and sales communications through Intercom, and customer-lifecycle or CRM records through Attio.
Email delivery and engagement information for messages sent through Resend.

3. Connected Social Platforms

When you connect a social account, we access data strictly in accordance with that platform's developer terms, and only to provide the publishing and engagement features you request.

A. LinkedIn (Community Management API)

Permissions: w_member_social, w_organization_social (Company Page posting), r_organization_social (Company Page feeds), r_organization_admin.
Data Accessed: User identity (name, ID), Organization Pages you administer, and "Member Data" (comments and likes on your posts from other LinkedIn members).
Purpose: To enable you to draft, schedule, and publish content to your Personal Profile and Company Pages, and to view and reply to comments on your posts.
Member Data: Names, photos and content of other LinkedIn members are fetched to display engagement on your posts and are not retained beyond the limits permitted by LinkedIn's API Terms.

B. Meta Platforms (Facebook, Instagram & Threads)

We use Meta's Graph API and Instagram APIs in compliance with Meta's Platform Terms and Developer Policies.

Permissions: pages_manage_posts, pages_show_list, business_management, instagram_business_basic, instagram_business_content_publish.
Data Accessed: Facebook name, Instagram username, profile pictures, and list of managed pages.
Purpose: To list your Facebook Pages and linked Instagram Business accounts, and to publish content (photos, videos, reels, stories) directly from the Rheos dashboard.

C. X (Twitter)

Permissions: tweet.read, tweet.write, users.read, offline.access.
Data Accessed: Your X username, display name, profile picture, and user ID.
Purpose: To publish posts (text, images, and videos) to your X profile on your behalf. OAuth 2.0 access and refresh tokens are stored securely; access tokens are refreshed automatically and previous tokens are overwritten.

D. TikTok

Permissions: user.info.basic, video.publish, video.upload.
Data Accessed: Your TikTok display name, avatar, and open ID.
Purpose: To publish video content to your TikTok profile on your behalf. OAuth 2.0 access and refresh tokens are stored securely.

E. Pinterest

Permissions: boards:read, pins:read, pins:write, user_accounts:read.
Data Accessed: Your Pinterest username, profile picture, and list of boards.
Purpose: To create Pins (images and videos) on your Pinterest boards on your behalf.

F. YouTube

When you connect your YouTube account, we access data via the YouTube Data API v3 in accordance with Google's API Services User Data Policy and YouTube's Terms of Service.

Permissions: youtube.upload, youtube.readonly.
Data Accessed: Your YouTube channel name, channel ID, and channel thumbnail.
Purpose: To identify your authorised channel and upload video content (including Shorts) to your YouTube channel on your behalf.

G. Bluesky

Data Accessed: Your Bluesky handle and DID (decentralised identifier).
Purpose: To publish posts (text and images) to your Bluesky profile on your behalf.
Authentication: The connection flow asks for a Bluesky app password (not your main password), exchanges it once for session tokens, and discards it. The app password itself is never stored. You can revoke access at any time from your Bluesky settings.

H. Mastodon

Permissions: read, write:statuses, write:media (via an OAuth application registered on your chosen instance).
Data Accessed: Your Mastodon username, display name, avatar, and instance URL.
Purpose: To publish posts (text, images, and videos) to your Mastodon profile on your behalf. Your data is processed via your chosen instance; we do not access other instances or federated content.

4. How and Why We Use Personal Data

We use personal data to:

create and authenticate accounts, manage organisations and provide customer support;
provide subscriptions, process payments and maintain financial records;
import, store, organise and retrieve brand content and sources;
generate text and media in response to customer instructions;
draft, schedule, publish and measure content on customer-authorised platforms;
operate optional connectors and MCP access authorised by the customer;
monitor usage and plan allowances, prevent abuse and protect the Service;
diagnose errors, analyse product use and improve performance and user experience;
send service communications and, where permitted, marketing communications;
manage customer and prospective-customer relationships; and
meet legal, regulatory, tax, accounting and data-protection obligations.

Lawful Bases (UK GDPR)

We rely on contract for account administration, requested generation, imports, publishing and subscriptions; legal obligation for required tax, accounting and rights records; legitimate interests for proportionate security, diagnostics, service improvement (including the usage statistics described in section 6, which you can turn off) and customer administration; and consent for session recordings, other non-essential cookies, pixels and marketing where consent is required. An OAuth permission you grant is an authorisation to access a platform and is not itself treated as UK GDPR consent.

We do not sell or purchase social-platform data, use it for surveillance, or use it to decide eligibility for employment, credit, housing or insurance. We do not use customer social content to train public AI models.

5. AI Processing

Rheos sends prompts, customer-provided source material, settings and generated media to one or more of these AI processors, depending on the feature used and the model you or your plan select:

Google (Gemini) for text, chat, image generation and searching your library;
Anthropic Claude, through Google Cloud and Amazon Web Services for writing brand documents and some chat;
Microsoft Azure for OpenAI text models, transcribing voice notes and image generation; and
Fal.ai for image generation and editing. Fal may pass a request to the company whose model it runs (for example Google or OpenAI).

The data sent depends on your request and may include prompt text, brand documents, website-source content, images or generation settings. Images and videos you import (for example from Google Drive) are also processed by our AI providers to generate tags and short descriptions that power search inside your own asset library. Each provider acts as our processor under its commercial API terms. Google, Anthropic and Microsoft don't use your content to train their models under the terms we use. Fal.ai's terms allow it to use de-identified data to improve its own services.

6. Cookies, Pixels and Similar Technologies

Apart from what keeps the site working, we use three groups of tools, and each has its own switch:

Usage statistics are on unless you turn them off. They count visits and which pages are used, so we can improve Rheos. They show how the site is used, not who you are.
Session recordings are off unless you switch them on. They record how you move around and click, to help us fix problems.
Advertising is off unless you choose Accept. It lets ad platforms measure which of our ads bring people to Rheos.

How to choose, and how to turn things off

On your first visit a one-line notice at the bottom of the page tells you we count visits. Its Turn off link switches usage statistics off straight away, for free, and nothing else changes on the site. Cookie settings (in the notice, in the footer of every page, at the bottom of pages without a footer, and here: ) has a switch for each group, plus Save settings, Accept all and Reject all. Reject all turns every optional group off. In the Rheos app, use Settings.

Turning usage statistics off stops Amplitude at once, removes the Amplitude cookies we can reach, and deletes the rheos_landing entry for this tab. Turning session recordings off, or choosing Reject after Accept, removes the cookies we can reach and reloads the page, because those tools can't be stopped once loaded. Your choices are shared with dashboard.rheos.app, so the Rheos app respects them too. Some pages load none of these tools, usage statistics included: shared reports (/report), sign-in and internal pages.

Essential (always on)

Your choices: the rheos_stats cookie (usage statistics on or off), the rheos_replay cookie (session recordings on or off) and the rheos_consent cookie (advertising Accept or Reject), 180 days each, shared with dashboard.rheos.app. The advertising choice is also kept as cookie_consent in your browser's local storage, and closing the notice is remembered as rheos_notice_dismissed there, until you clear your browser data. An older rheos_recordings cookie may also be present from before October 2026: if it says "off" we treat that as usage statistics off, and it is removed the next time you make a choice.
Sign-in: the __logged_in cookie, and the sign-in and security cookies used by the Rheos app.
Error diagnostics: Sentry reports errors on the site. It sets no cookies.
Page speed: Vercel Speed Insights measures how fast pages load. It sets no cookies and does not identify you.
Hosting logs: our host, Vercel, keeps request logs that include IP addresses for a short time, for security and to run the service. They are kept for up to 3 days. Nothing is stored on your device for this.

Support (only when you ask for it)

Cal.com runs our call booking. Its calendar loads inside the contact page only when you choose the call option there. Cal's own privacy policy applies to what you enter in it.

Usage statistics (on unless you turn them off)

We count visits under the exception for statistics: we tell you here and in the notice, and you can turn it off at any time. Statistics don't identify you: we don't link them to your name, email address or account, we ask Amplitude not to record your IP address, and we don't record your screen.

Amplitude: counts page views, clicks on page elements, and which campaign or site brought the visit (AMP_* cookies, which hold a random ID for this browser and are shared with dashboard.rheos.app, part of the same Rheos service, so we can count how many visits lead to a sign-up). Amplitude stores this data in the United States. It is certified under the EU-US Data Privacy Framework and its UK Extension, so the transfer is covered by the UK-US data bridge. Amplitude works for us as our processor and may not use the data for its own purposes. We keep this data for 12 months.
This visit's source: rheos_landing in this tab's session storage records how you arrived (the channel, campaign, content and landing page), so later pages in the same visit are credited to it. It holds no ID and is cleared when you close the tab. It is never written if you turned usage statistics off, and it is deleted when you press Turn off.
First visit date: rheos_first_visit in local storage, so a first visit is counted once. Until you clear your browser data.
Counts on our servers: some clicks, such as sign-up buttons and our short links, are also counted on our servers, without reading or storing anything on your device and without storing your IP address. When you turn usage statistics off we stop counting your clicks there too.

Session recordings (off unless you switch them on)

Only if you switch session recordings on (in Cookie settings, with Accept all, or with the tick in the Rheos app) do we record how you move around and click, to find and fix problems. While they are on, analytics can also be linked to your Rheos account if you sign in. We reduce what is captured: we ask Amplitude and LogRocket not to record your IP address, form fields are masked, text inside forms and on private areas is masked, and email addresses and sign-in tokens are removed from the web addresses and network requests we record. Recordings are used by Rheos staff for diagnosis and product work, not for advertising. Recordings are kept for 30 days in both Amplitude and LogRocket, then deleted.

Amplitude: session replay, using the same AMP_* cookies.
LogRocket: session replay and diagnostics (_lr_* cookies).

Before 25 October 2026 these recordings ran unless you turned them off. Recordings made then are not used for anything new. They are deleted when each tool's normal retention period ends: 30 days after recording in Amplitude, and in LogRocket at the end of our plan's retention period.

Visit measurement (only after Accept for advertising)

Google Analytics: visit measurement (_ga* cookies).
Microsoft Clarity: heatmaps and session replay (_clck, _clsk).
Searchable: visit measurement (_sa_id).
Factors.ai: which companies visit the site.
Rheos first visit: the rheos_attribution cookie (90 days) records the campaign or link you first arrived from, so we can see what brought you to sign up.

Advertising (only after Accept)

Ad pixels from Meta, LinkedIn, Reddit, X and OpenAI Ads: measure which of our ads bring people to the site and to sign up. We also send sign-up and purchase events to these ad platforms from our servers, and only for people who chose Accept. They set these cookies: Meta _fbp and _fbc (90 days), Google Analytics _ga and _ga_* (2 years) and _gcl_* (90 days), LinkedIn li_fat_id (30 days), Reddit _rdt_uuid (90 days), X _twclid, _twpid and _twsid, and OpenAI __obref. Each lasts for its provider's standard period.
Google's preferred source button: Google's script for the "add Rheos as a preferred source" button. Before you accept we show a plain link instead.

Referral and content links

If you arrive from a Rheos referral link, we add the referral code to the sign-up and log-in links while you browse the site, so the person who referred you gets credit when you sign up. This uses no cookie or storage. Only after you choose Accept for advertising do we also keep the code in the rheos_ref cookie (30 days) so it survives later visits.
Links to sign up or log in, including our short links, can also carry a content ID (cid, for example c261009-li-all-01), which names the post, ad or page of ours that you came from. It names our content, not you. It is not a cookie. The Rheos app keeps the content ID and any partner or referral code in your browser's local storage for up to 24 hours so they survive the sign-up steps, including a Google or Apple sign-in redirect, whatever you chose in Cookie settings. Once you sign up we save them on your account's sign-up record so we can see what brought you and credit a referrer, and we then clear them from your browser.

The Rheos app at dashboard.rheos.app reads the same choices: it counts usage unless you turned statistics off, records sessions only if you switched recordings on, and loads its ad tools only after you chose Accept. Withdrawing consent does not affect processing that happened before. Your browser settings can also block or delete cookies, but some features may then stop working.

7. Google API Services User Data & Limited Use

Rheos only requests Google access needed for a feature you choose to use.

Google Drive (read-only import)

Used to let you select and import your authorised Drive content into Rheos. On connection we store OAuth tokens; on import we store the file you selected (plus its name, type, size and thumbnail) in your workspace. Google Docs, Sheets and Slides are exported to standard document formats. Imported images and videos are processed as described in Section 5 to make them searchable in your library.

YouTube (publishing)

As described in Section 3F: youtube.upload and youtube.readonly, used to identify your authorised channel and upload your approved video content.

Google Search Console, Google Analytics & Site Verification (rolling out)

Rheos is introducing an optional connection that lets you link your own Google Search Console and Google Analytics 4 properties to your Rheos analytics dashboard. If you connect:

Search Console (webmasters): we read your site's search performance data (queries, pages, clicks, impressions, position) to display it in your dashboard and to generate content and website-improvement recommendations for you. Only when you explicitly request it, during guided setup or after publishing content, we also add your verified site as a Search Console property and submit or resubmit your sitemap.
Analytics (analytics.readonly): we read your GA4 reporting data to correlate search and AI-search visibility with on-site outcomes, for your dashboard only.
Site Verification (siteverification): used, at your request, to help verify your site so Search Console can be set up for you.

Apart from the customer-requested setup actions above (site verification, adding your property, sitemap submission), all access is read-only. Access is scoped to your own properties, is never used for advertising, is never sold or shared beyond the service providers needed to operate the feature, and is not used to train AI models. Google-derived data is stored in your workspace only where the feature requires it, and is deleted when you disconnect the integration or delete your account (subject to Section 9). You can disconnect at any time from your Rheos analytics settings, and you can also revoke Rheos's access at myaccount.google.com/permissions.

Google Limited Use disclosure: Rheos's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Who Receives Personal Data

We disclose data only where needed to operate the Service, complete a customer-authorised action, manage our relationship with you, or meet legal obligations. Our service providers and subprocessors are:

Hosting & core infrastructure: Vercel; Google Cloud and Firebase (our main database runs in London).
Video rendering: Amazon Web Services, in London, which renders the videos you create in Rheos.
AI generation: Google (Gemini); Anthropic Claude, through Google Cloud and Amazon Web Services; Microsoft Azure; Fal.ai.
Payments: Stripe (subscriptions and related tax/accounting records). We do not store raw credit-card information.
Email: Resend (transactional and marketing email delivery).
Website & content retrieval: Firecrawl (customer-requested website retrieval and scraping); Supadata (transcripts and details for video and social links you add to your library); AnyAPI (reads public social profiles and posts by handle, to seed your brand voice and to import posts).
Analytics, replay & error monitoring: Amplitude (United States); LogRocket; Sentry (EU region).
Support & customer lifecycle: Intercom (United States); Attio; Slack, where our own team workspace receives internal alerts that can include your email address, for example when you sign up, subscribe, come back after time away or stop part-way through onboarding.
Call booking: Cal.com (our booking pages run on Cal's EU instance, cal.eu).
Mobile notifications: Expo, which delivers push notifications to the Rheos mobile app.
Optional MCP identity: Auth0, where the OAuth MCP route is used (see the MCP Privacy Notice).
Consent-gated marketing & measurement: Google Analytics; Microsoft Clarity; Factors.ai; Searchable; Meta; LinkedIn; Reddit; X; OpenAI Ads.
Customer-authorised social APIs: Meta (Facebook, Instagram, Threads); LinkedIn; X; TikTok; Pinterest; Google (YouTube); Bluesky; and the operator of your chosen Mastodon instance.
Optional content connectors: Google Drive; Microsoft OneDrive; Canva.

A customer-selected MCP or AI-assistant provider may also receive data when you deliberately authorise that client to call Rheos tools; that provider acts under its own privacy terms (see the MCP Privacy Notice). We may also disclose information where required by law or in connection with a corporate transaction, subject to applicable data-protection requirements.

9. Retention, Disconnection & Deletion

We keep account and workspace data while the account is active and as needed to provide requested features. For categories without a fixed period (including analytics, replay, error logs, OAuth logs, website-source versions, AI usage snippets, CRM/support data, platform logging and backups) we use necessity, security, contractual and legal requirements as the retention criteria.

Account Deletion

When an eligible account-deletion request is confirmed:

access is disabled immediately;
the account is scheduled for hard deletion after a 30-day recovery period;
connected integrations are disconnected; and
Rheos records an audit snapshot of the deletion process.

After the 30-day period, Rheos deletes the account and associated active customer data. A de-identified Stripe customer archive (with personal contact details removed) is retained for 6 years from the end of the financial year it relates to, as HMRC requires. A sole owner of a multi-user organisation may need to transfer ownership before the account can be deleted.

Backups

We take daily backups of our main database and keep each one for 98 days, and the database can also be restored to any point in the last 7 days. Backups are encrypted. Data from a deleted account can therefore remain in these backups for up to 98 days, after which the backup that holds it expires and is overwritten.

Disconnecting Social & Content Accounts

You may disconnect any linked account at any time via your Rheos settings. Disconnecting stops future access through Rheos and removes Rheos-held connection credentials. As part of account deletion we also make provider-side revocation requests for Meta and LinkedIn; for other providers we recommend additionally revoking Rheos from the provider's own settings (for example your Bluesky app passwords page or Google account permissions).

Facebook & Instagram Removal

To remove Rheos from your Facebook or Instagram account: go to Facebook Settings & Privacy → Settings → Apps and Websites, find Rheos, and click Remove. To have the data Rheos holds for that connection deleted, disconnect the platform in Rheos or contact archie@rheos.app, or delete your Rheos account as described above.

10. International Transfers

Some of our providers process personal data outside the United Kingdom, including in the United States. Where we transfer personal data internationally we rely on appropriate safeguards for the provider and destination concerned. For transfers to the United States, where the provider is certified under the EU-US Data Privacy Framework and its UK Extension (the UK-US data bridge), we rely on that bridge. Where it is not certified, or the destination is elsewhere, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on UK adequacy regulations where they apply. You can contact us for a description of the safeguard applicable to a particular transfer.

11. Your UK GDPR Rights

Subject to the conditions and exemptions in data-protection law, you may:

access your personal data and receive information about how it is used;
rectify inaccurate or incomplete personal data;
erase personal data in qualifying circumstances;
restrict processing in qualifying circumstances;
receive or transfer eligible data in a portable, machine-readable format;
object to processing based on legitimate interests, and object at any time to direct marketing; and
withdraw consent at any time where processing relies on consent, without affecting earlier lawful processing.

To exercise a right, email archie@rheos.app. We may need to verify your identity and clarify the scope of a request.

Complaints

If you're unhappy with how we handle your personal data, please tell us first at archie@rheos.app. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to the Information Commission, the UK data protection regulator (called the Information Commissioner's Office until 30 September 2026), at ico.org.uk. You can go to them at any time, though they usually ask whether you have raised it with us first.

12. Security

We use technical and organisational measures intended to protect personal data, including encryption in transit, access controls and scoped authorisation. No online service can promise absolute security.

13. Changes to This Policy

We will update the effective date when this policy changes. For a material change, we will provide notice through the Service or by email before the change takes effect where required.

14. Contact Us

For privacy questions, rights requests or complaints, contact:

Rheos App Ltd

Company number: 17105158

Registered office: 60 Farm Road, Beeston, Nottingham, England, NG9 5DA

Email: archie@rheos.app