Privacy Policy

1. What Pcha does

Pcha helps businesses sell online. Studio turns photos of your products into product photos and short videos. Campaign mode plans posts, publishes them to the Instagram, Facebook and TikTok accounts you connect, shows their comments and reads their results.

2. What we collect

• Your account: your name, email address and profile picture from Google or Facebook when you sign in, and whether you use Pcha in Kenya or elsewhere.
• Your content: the photos and videos you upload (products, places, logos and people), item names, prices and sizes, the photos and videos Pcha makes, and your campaigns: their settings, plans and posts.
• People you add as models: their photo and the name you give them. An AI model reads each photo to check that it shows one adult, and whether to show them as a woman or a man.
• Payments: the pack, amount, status and reference of each payment, and the phone number you pay with by M-Pesa. Card details go straight to Pesapal.
• Connected accounts: what Instagram, Facebook and TikTok share when you connect them, described in sections 4 and 5.
• How you use Pcha: the pages you open and the actions you take, your device and browser type, and your approximate location from your IP address, collected with PostHog analytics. Our servers also keep logs and error reports.
• On your device: Pcha keeps some settings in your browser, such as your last tab. The M-Pesa number you last paid with is kept there too, and removed when you sign out.

3. How we use it

• to run your account and make your photos and videos;
• to plan, publish and measure your campaigns, and learn what works for your account;
• to take payments and keep payment records;
• to answer support requests and send service messages, such as a finished make or a receipt;
• to keep Pcha secure and prevent fraud and abuse;
• to understand how Pcha is used and improve it.

We don't sell your personal data.

4. Instagram and Facebook

Permissions

• Connecting Instagram uses Instagram Login with instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments and instagram_business_manage_insights.
• Connecting a Facebook Page asks for pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_posts, pages_manage_engagement, pages_manage_metadata, read_insights, pages_manage_ads, ads_read, ads_management, business_management and instagram_basic.

What we receive

• your account and Page IDs, names and usernames, and the Instagram account linked to your Page;
• the posts Pcha publishes for you;
• comments on those posts, and the replies you send from Pcha;
• results for those posts, such as reach, views, likes and clicks;
• the names and IDs of your ad accounts. Pcha doesn't create ads or spend money from them;
• notices from Meta when those posts get new comments.

How we use it

To publish the posts you approve, or the posts a launched campaign schedules under the plan you approved; to show you comments and results; and to learn the best times and formats for your account. We don't sell this data.

Keeping it safe and removing access

Access tokens are encrypted at rest with AES-256-GCM. Disconnecting an account in Connected accounts deletes its stored tokens and asks Meta to revoke Pcha's access. You can also remove Pcha in your Facebook or Instagram settings, under Apps and websites.

5. TikTok

Permissions and what we receive

• user.info.basic (Login Kit): your open ID, display name and avatar, so you can see which account will post.
• user.info.profile: your profile link, bio and verified badge.
• user.info.stats: your follower, following, like and video counts.
• video.list: your public videos and their view, like, comment and share counts.
• video.publish (Content Posting API): to post the videos you approve.

How we use it

• Your profile, stats and videos show your account's results in Pcha and help the assistant learn which posts work for your audience.
• Pcha posts a video only after you approve it on the review screen, with the caption, privacy setting, comment, duet and stitch settings and the Promoting your own products disclosure you choose. TikTok fetches each video from Pcha's servers.
• We don't sell TikTok data or use it for advertising.

Keeping it safe and removing access

TikTok tokens are encrypted with their own key. Disconnecting TikTok in Connected accounts revokes the token at TikTok and deletes it, along with the profile and stats Pcha stored. You can also remove Pcha in TikTok's app permissions settings. Tokens are kept until you disconnect. Post results stay with your campaign history until you delete your account.

6. AI providers

Pcha uses AI model providers, Google, Runway, Kling and OpenRouter, to make images, videos and captions. We send them only the photos, videos and instructions each make needs, and they return the result.

7. Payments

Pesapal handles card payments and Minisend handles M-Pesa. They process your payment under their own privacy policies. We receive the result, never your card number or M-Pesa PIN.

8. Who we share it with

• providers that run Pcha for us: hosting and storage, the AI providers and payment providers above, and PostHog for analytics. They may use your data only to provide their service;
• Instagram, Facebook and TikTok, when Pcha posts or replies for you;
• authorities, when the law requires it, or to protect people or Pcha from fraud or harm;
• a buyer or successor of the business, who must keep to this policy.

9. Where your data is processed

Our servers and providers are in several countries, including outside Kenya. Where the law requires, we protect transfers with safeguards such as contracts with our providers.

10. How long we keep it

• Your account and content: while your account is open, or until you delete them.
• Connected-account tokens: until you disconnect the account.
• Post results: with your campaign history, until your account is deleted.
• Payment records: as long as tax and accounting law requires.

When your account is deleted, we delete or anonymise your data, except records the law requires us to keep.

11. Your rights

You can ask to see, correct, copy or delete your data, object to how we use it, or withdraw consent you gave. Email pcha-ai@protonmail.com; we may need to confirm it's you first. In Kenya you can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

12. Deleting your data

• Your whole account: email pcha-ai@protonmail.com from the email address you sign in with, with the subject "Delete my account". We confirm by email when it's done.
• Through Facebook: if you signed in with Facebook or connected Instagram or Facebook, remove Pcha in your Facebook settings under Apps and websites and ask for your data to be deleted. Meta tells us and gives you a confirmation code with a link to our deletion status page, where you can check its progress.
• A connected account: disconnect it in Connected accounts, which deletes its stored tokens. For TikTok you can also remove Pcha in TikTok's app permissions settings.
• A saved model: delete it in Manage your models.

13. Security

Pcha uses HTTPS everywhere, encrypts social account tokens, and limits who can reach your data. No system is perfectly secure, so tell us at pcha-ai@protonmail.com if you think your account is at risk.

14. Cookies and browser storage

Pcha uses a cookie to keep you signed in, a cookie that remembers your region, and PostHog analytics, which stores an ID in your browser. You can block cookies in your browser settings, but you need the sign-in cookie to use Pcha.

15. Age

Pcha is for adults running a business. You must be 18 or older to use it, and we refuse photos of anyone who may be under 18. If you think a minor's data reached us, email pcha-ai@protonmail.com and we will delete it.

16. Changes to this policy

When we change this policy, we update the date at the top. If a change matters, we tell you in Pcha or by email before it applies.

17. Contact

Privacy and support: pcha-ai@protonmail.com. Our Terms of Service cover using Pcha.