Privacy Policy

1. Introduction

Welcome to 3Rings (“we,” “our,” or “us”). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered social media agency platform.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name and profile information
• Password (encrypted)
• Account preferences and settings

2.2 Social Media Account Data

When you connect your social media accounts (YouTube, TikTok, Instagram), we collect:

• OAuth access tokens: To authenticate and read data from your connected accounts
• Profile information: Username, profile picture, follower count, and public profile data
• Content performance data: Views, likes, comments, shares, and engagement metrics on your existing posts
• Analytics data: Audience demographics, engagement rates, reach, and trending patterns

2.3 Outreach and Communication Data

When you use our outreach features, we collect:

• Email campaign content and templates you create
• Creator and brand contact lists you build
• Email delivery, open, click, and bounce tracking data via Mailgun webhooks

2.4 Usage Data

We automatically collect information about how you interact with our platform:

• Device information (browser type, operating system)
• IP address and approximate location
• Pages visited and features used
• Time and date of access
• Referring URLs

3. Why We Need Social Media Account Access

3Rings requires read access to your social media accounts to deliver our core agency services:

Important: We only request the minimum permissions necessary to provide these services. We request read-only access to your social media data. You can revoke access at any time through your social media platform's settings or through our Settings page.

4. How We Use Your Information

We use the collected information for the following purposes:

• Provide, operate, and maintain our analytics and strategy services
• Analyse social media performance and generate cross-platform insights
• Generate AI-driven content strategies using Google Gemini
• Surface business and collaboration opportunities
• Discover viral creators and facilitate outreach campaigns
• Send outreach emails on your behalf via Mailgun
• Cache insights and strategy data (via Upstash Redis) for faster access
• Improve and personalise your experience
• Process payments and manage subscriptions via Stripe
• Detect and prevent fraud or unauthorised access
• Comply with legal obligations

5. Data Storage and Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure OAuth 2.0 authentication for all social media connections
• Access tokens stored securely in our database (Supabase / PostgreSQL)
• Session management via secure, HTTP-only cookies
• Regular security audits and vulnerability assessments
• Access controls and role-based authentication mechanisms

Social media access tokens are stored securely and refreshed automatically when they expire. We never store your social media passwords.

6. Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

• Service Providers: Third-party vendors who assist in operating our platform (Supabase for database and auth, Upstash for caching, Vercel for hosting, Stripe for payments)
• AI Processing: Google Gemini processes anonymised content performance data to generate strategies and outreach emails — no personal credentials are shared
• Email Delivery: Mailgun processes outreach emails you send through our platform, including recipient addresses and email content
• Social Media Platforms: When accessing analytics through official YouTube, Instagram, and TikTok APIs
• Legal Requirements: When required by law, court order, or governmental authority
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorise us to share your information

7. Third-Party Services

Our platform integrates with the following third-party services, each governed by their own privacy policies:

• YouTube (Google): Channel analytics, video performance data, and creator discovery via YouTube Data API v3
• Instagram (Meta): Reels analytics, engagement metrics, and account insights via Instagram Graph API
• TikTok: Video analytics, account insights, and performance data via TikTok OpenAPI
• Google Gemini: AI-powered strategy generation and outreach email drafting
• Mailgun: Email delivery with open, click, and bounce tracking for outreach campaigns
• Stripe: Secure payment processing for subscriptions
• Vercel Analytics: Anonymous usage analytics for platform improvement

We recommend reviewing each platform's privacy policy to understand how they handle your data.

8. Data Caching

To provide a fast and responsive experience, we cache certain data using Upstash Redis:

• Insights data: Cached for up to 6 hours before being refreshed from platform APIs
• Strategy data: Cached for up to 24 hours before regeneration

You can force a refresh of cached data at any time from the dashboard. Cached data is automatically purged when it expires.

9. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and associated data
• Revoke Access: Disconnect social media accounts at any time from our Settings page or directly from the platform's authorised apps settings
• Data Portability: Export your data in a machine-readable format
• Opt-out: Unsubscribe from marketing communications

To exercise these rights, please contact us at privacy@3rings.com or through your account settings.

10. Data Retention

We retain your information for as long as your account is active or as needed to provide services. When you delete your account:

• Personal data is deleted within 30 days
• Social media access tokens are immediately revoked and deleted
• Outreach campaign data and email tracking records are deleted within 30 days
• Cached data (insights, strategies) is purged immediately
• Backup copies are removed within 90 days
• Aggregated, anonymised data may be retained for analytics

11. Children's Privacy

Our service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws, including GDPR where applicable.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Updating the “Last updated” date
• Sending an email notification for significant changes

Your continued use of the service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: