Privacy Policy

This Policy explains how EZSolutions handles personal information through EZSocial. For account administration, access requests, security, and our direct business relationship, EZSolutions acts as the business or controller. For Customer Content submitted by a client organization, that organization may be the business or controller and EZSolutions may act as its service provider or processor. Contact your organization first for requests concerning content it controls.

• Access and identity: name, work email, company, optional website, request history, approval or denial status, internal moderator notes, policy acceptance version and time, account role, and enabled status.
• Authentication and security: password hashes or managed-auth identifiers, essential session cookies, session and login times, validated IP addresses, user-agent data, rate-limit fingerprints, and security or audit events.
• Company profile: logo, website, slogan, the company’s five-W context, preferences, and onboarding state.
• Customer Content: prompts, post copy, hashtags, themes, user-provided visual tags, descriptions, uploaded or imported images and video, generated or enhanced media, drafts, schedules, selected networks, publishing attempts and results, external post identifiers, and timestamped engagement or performance observations returned by a connected network.
• AI context and results: AI-detected tags and descriptions, generated copy/images/video, final generation prompts, conversation state, saved EZa memories, facts inferred from meaningful actions, reference-media choices, and the saved media tags and descriptions that EZa reviews when you ask it to suggest ideas and propose reference media.
• Intelligence and decision records: typed company, content, channel, media, audience, product, service, event, objective and outcome entities; relationships and timestamped observations; source authority, permitted use, freshness, provenance, approval state, sensitivity and confidence; conflict state; one-way retrieval query hashes and retrieved record identifiers; and the evidence, alternatives, rationale, risk, lifecycle events, resulting action, or outcome associated with an EZa recommendation or user-directed workflow. Raw retrieval queries are not retained in these audit records.
• Connections and operations: encrypted authorization tokens for direct connections; managed-provider account references and opaque tenant mappings when a managed connection is used; connection status, callback and webhook events, notifications, audit and content lifecycle history, impersonation/support events, background-job leases and attempts, job status, provider/model, input and output tokens, generated seconds or units, and estimated costs.
• Website research and imports: URLs you provide, publicly returned page text and metadata, discovered image URLs, selected images, and fetch/security results.

We receive information directly from applicants and users; from administrators or moderators acting within their role; from a company website or media URL you direct us to analyze; from connected social platforms; from generation and analysis providers; and automatically from service use, security checks, and system operations.

• Review access requests, provision and administer accounts, authenticate users, and provide authorized moderator support.
• Build company context, organize media, create and analyze content, learn non-redundant EZa memory, preserve drafts, schedule posts, publish when instructed, and send in-product notifications.
• Record which available evidence supported a recommendation or user-directed content decision so authorized moderators can inspect, troubleshoot, and evaluate EZa through the client-scoped Monitor Mode. Ordinary client and administrator sessions cannot access that operational graph.
• Store all generated results for later review, including results not selected for a final post.
• Measure token/unit usage and estimate workflow cost for restricted moderator operational reporting; troubleshoot jobs; maintain audit and accountability records. Ordinary client sessions cannot access cost analysis.
• Prevent abuse, enforce tenant boundaries, detect duplicate media, rate-limit signup attempts, investigate errors, and protect users and the platform.
• Comply with law, enforce agreements, and communicate material service or policy changes.

We do not sell personal information. We do not use Customer Content for third-party advertising or to train a general-purpose AI model ourselves. External AI providers process submitted data under their applicable business terms, settings, and retention controls. EZa memory is enabled by default for meaningful workflow choices and can be reviewed or managed in the client settings available to the account. Decision records are application records used for explainability and evaluation; they do not train a shared model or convert an external observation into an approved company fact.

We disclose information only as needed for the service or legal/security purposes. Current categories and configured providers include: Cloudflare R2 for media/object storage; PostgreSQL and Supabase infrastructure for application data and managed authentication as enabled; OpenAI for copy, prompt refinement, idea suggestions and reference-media selection (which use saved media tags and descriptions, not the media files themselves), image generation, image analysis, descriptions, tags, representative-frame analysis of uploaded or generated video (including choosing where your logo is placed on a finished video), website research, and memory extraction; Higgsfield/Seedance and Protoface/MiniMax for requested video generation or enhancement; Cloudflare Turnstile when enabled for signup abuse prevention; Post for Me (Day Moon Development) when a managed social connection is selected, for social authorization-token custody, account connection, publishing, feeds, metrics, and connection/post webhooks; and social networks that a user elects to connect.

Prompts, selected context, and reference media sent to an AI provider depend on the workflow you choose. For asynchronous video tagging and description, we extract representative early, middle, and late frames and send those still images to OpenAI rather than sending the full video. Video-generation providers can receive final prompts, tags, themes, format, duration, quality, and selected opening, closing, logo, or reference assets. Post for Me and the selected network can receive an opaque EZSocial tenant reference, network account identity, requested connection permissions, post copy/media/schedule, and feed or metric requests. In the managed flow, Post for Me—not the browser—holds the network OAuth tokens. Connected networks receive the post and media you direct us to publish. Providers process data under their own contracts, security measures, locations, and legally required retention.

We may also disclose information to professional advisers, authorities, or transaction counterparties when reasonably necessary for legal compliance, safety, fraud prevention, claims, or a merger, financing, reorganization, or sale, subject to appropriate protections.

We retain account and Customer Content while needed to provide the workspace, carry out instructions, resolve disputes, meet security or legal obligations, and enforce agreements. Drafts, prompts, AI results, generated media, memory, decision evidence, usage, notifications, and audit records persist until deleted through available controls, the associated account/company is erased, or they are no longer needed.

Pending, denied, and blocked access requests and privacy-preserving request fingerprints may be retained to review resubmissions, enforce blocks, and prevent abuse. The current product does not promise a fixed automatic deletion schedule for those records. Verified client-account deletion is designed to remove associated database records, including client-specific intelligence and decision evidence, posts, media, and company storage objects. Limited non-identifying erasure evidence, backups, shared company records, and provider-held copies may remain for a lawful or technically necessary period.

EZSocial uses essential authentication and security cookies needed to maintain a session and enforce role access. The current product does not use advertising cookies or sell cross-site behavioral data. Connected providers and networks may process technical data when their features are used under their own policies.

Controls include server-side authorization and validation, role and company scoping, non-public provider credentials, encrypted social tokens, hashed passwords and rate-limit identifiers, tenant-specific storage paths, database row-level controls where configured, audit records, and deletion workflows. No system is completely secure, and transmission or storage cannot be guaranteed against every risk.

EZSolutions and its providers may process information in the United States and other countries where they operate. Those locations may have different data-protection laws. Where required, the responsible organization should use an appropriate transfer mechanism or contractual protection.

Depending on where you live, you may have rights to know, access, correct, delete, restrict, object to, or obtain a copy of personal information, and to appeal or complain to a regulator. Available workspace controls let you export intelligence records, correct an observation by superseding it while preserving provenance, or delete an observation and its direct decision and retrieval links. You may also disconnect social accounts, edit company context and media details, manage EZa memory through available settings, or ask an authorized administrator/moderator about account changes. We may verify identity and authority before acting.

Send privacy requests to admin@ezsolutions.com. If your company controls the relevant Customer Content, we may refer the request to that company.

EZSocial is a business service and is not directed to children under 18. Do not request an account or submit a child’s personal information unless authorized and legally permitted under a written agreement.

AI features generate or organize content but do not make legally significant decisions about users. Access requests are reviewed by a moderator. Automated security and rate-limit controls may delay or reject a request; contact us if you believe a decision was incorrect.

We review this Policy when code changes alter collected data, purposes, sharing, retention, security, user choices, or providers. We will update the effective date and provide additional notice or request renewed acknowledgment when required.