Privacy Policy

Last updated: August 1, 2026

1. Who We Are

LocalPop LLC, operating as LocalPop Studio (“LocalPop,” “we,” “our,” or “us”), provides done-for-you social media content for small businesses. We are the party responsible for the personal information described in this policy.

This policy covers our website, our client portal, and the content services we provide. It applies to our customers, to people who inquire about the service, and to visitors to our website.

Our service is intended for businesses located in the United States. We do not target our service to individuals in the European Economic Area, the United Kingdom, or Switzerland, and we do not offer GDPR data-subject procedures. If you are located outside the United States, please do not use the service.

Questions about this policy: privacy@localpopstudio.com.

2. Information We Collect

Account and billing information

  • Name, email address, and phone number
  • Password (stored only as a salted hash, never in readable form)
  • Billing address and payment card details, which are collected and stored by Stripe. We never receive or store your full card number.

Business information you provide

  • Business name, description, industry, and location
  • Target audience, brand voice, and style preferences
  • Uploaded images, including logos and product photographs
  • Your website address, which we may read to understand your business
  • Messages you send us, including support requests and chats with our in-app assistant

Social media account information

If you connect a Facebook Page or Instagram Business account, we collect and store an access token for that account, along with the account’s name and identifiers. See Section 5.

Photographs and facial geometry (optional)

Only if you choose to use the AI Likeness feature. See Section 8, which governs this category specifically.

Information collected automatically

  • IP address, browser type, device type, and operating system
  • Pages viewed, referring URLs, and how you arrived at our site, including advertising campaign parameters
  • Content we generate for you, and your feedback and revision requests on it

3. How We Use Your Information

  • To create, revise, and schedule social media content for your business
  • To publish content to social accounts you have connected, when you have asked us to
  • To process payments, manage your subscription, and calculate applicable tax
  • To send service emails, such as content-ready notifications, receipts, and account notices
  • To respond to your support requests and diagnose problems with your account
  • To send marketing emails about our service, which you can unsubscribe from at any time
  • To measure which marketing channels bring customers to us (see Section 6)
  • To detect and prevent fraud, abuse, and security incidents
  • To comply with our legal and tax obligations

We do not use your business information, your uploaded images, or your generated content to train AI models — not our own, and our AI vendors are contractually barred from doing so with data we send through their APIs.

4. Service Providers We Share Information With

We share personal information with the following categories of service providers, each of which is permitted to use it only to provide services to us:

  • Stripe— payment processing, subscription billing, and tax calculation. Receives your name, email, billing address, and payment details.
  • Supabase— database, authentication, and file storage. Holds substantially all of the information described in Section 2.
  • Vercel— website and application hosting. Processes IP addresses and request data.
  • OpenAI— AI image and text generation. Receives your business information, prompts, and any images used as references. See Section 7.
  • Anthropic— AI assistance for our in-app assistant, content strategy, and internal support tools. Receives your business information and your messages to the assistant. See Section 7.
  • Meta Platforms— publishing to Facebook and Instagram accounts you connect (Section 5), and advertising measurement (Section 6).
  • Google— website analytics, spam prevention via reCAPTCHA, and business-listing lookups used to help fill in your business details.
  • Resend and Postmark— sending our emails and receiving your replies to them.
  • Upstash and Inngest— rate limiting and background job processing supporting the above.

Other disclosures

  • Legal requirements. We may disclose information if required by law, subpoena, or valid request from public authorities, or to protect our rights, safety, or property.
  • Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

We do not sell your personal information for money

We have never sold, rented, or traded personal information for money, and we do not do so now. However, our use of advertising and analytics tools may qualify as “sharing” personal information for targeted advertising under some state privacy laws. Section 6 explains exactly what that involves and how to opt out.

5. Connected Social Media Accounts

LocalPop is a done-for-you service, which means we publish content on your behalf. To do that, you may connect a Facebook Page or an Instagram Business account.

When you connect an account, we:

  • Receive and store a long-lived access token for that account, along with the account name, profile picture, and platform identifiers
  • Use that token to publish posts you have approved, and to read back the resulting post links and basic performance metrics
  • Store copies of published posts and their metrics so you can see them in your portal

We request only the permissions needed to publish and measure posts. We do not read your private messages, your friends list, or your personal profile activity. We do not use information obtained from Facebook or Instagram for advertising targeting, and we do not transfer it to any third party other than the service providers in Section 4.

Disconnecting. You can disconnect a social account at any time from your portal settings. Disconnecting deletes the stored access token immediately — for the Facebook Page or Instagram account you disconnected, and for any Instagram account linked through that Page. We stop publishing to it at the same moment.

For an Instagram account you connected directly, we also revoke our permissions at Meta. For a Facebook Page we do not, because revoking would also disconnect any other Pages you have connected to us. You can revoke our access at Meta yourself at any time in your Facebook settings under Business Integrations.

We keep the connection record itself — the account name and identifiers, without the credential — so the history of posts we published for you stays intact. Reconnecting later simply issues a fresh token. Deleting your LocalPop account deletes the records and all platform data as described in Section 9.

6. Analytics, Advertising, and Your Opt-Out Right

What we use

  • Google Analytics— to understand how people use our website. Sets cookies such as _ga.
  • Meta Pixel— to measure the effectiveness of our advertising. Sets cookies such as _fbp.
  • Meta Conversions API— a server-side version of the same measurement. When it runs, we send Meta a cryptographically hashed copy of your email address, a hashed account identifier, your IP address, and your browser user agent, along with the event (for example, a page view or a subscription purchase).

These tools are not loaded inside the authenticated client portal. They run on our marketing website and signup flow.

Why this matters

Sending identifiers to Meta so that Meta can match them to its own users and improve our ad targeting is treated as “sharing” personal information for cross-context behavioral advertisingunder the California Consumer Privacy Act, and as “targeted advertising” under comparable laws in other states. We are telling you this plainly rather than relying on a blanket “we don’t sell data” statement.

How to opt out

Visit Your Privacy Choices. Opting out stops the Meta Pixel and Google Analytics from loading and stops all server-side event sharing with Meta, including the hashed email address and IP address described above.

We honor Global Privacy Control. If your browser or extension sends a GPC signal, we treat it as a valid opt-out automatically and you do not need to do anything else.

We will not deny you service, charge you a different price, or provide you a lower quality of service because you exercised a privacy right.

7. How We Use AI Vendors

Generating your content requires sending your business information, your prompts, and sometimes your uploaded images to AI providers. We use OpenAI for image and text generation and Anthropic for our in-app assistant, content strategy, and internal support tooling.

Under our API agreements with these providers:

  • They do not use our data to train their models.
  • They may retain inputs and outputs for a limited period for abuse monitoring— up to 30 days is typical — after which the data is deleted from their systems. This is a standard trust-and-safety retention window, and it means your data is not deleted from their systems the instant a request finishes.

See OpenAI’s data controls documentation and Anthropic’s privacy documentation for their current terms.

Your messages to our in-app assistant are processed by Anthropic and are stored by us so our team can follow up on your request.

8. Biometric Data and Facial Imagery

This section applies only if you choose to use the optional AI Likeness feature, which requires uploading photographs of yourself. The feature is never required to use LocalPop.

What we collect and why

When you enable this feature, we collect (a) your original photographs and (b) scans of face geometry derived from those photographs — each a biometric identifier under the Illinois Biometric Information Privacy Act (740 ILCS 14/10) and the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), and sensitive personal informationunder the California Consumer Privacy Act (Cal. Civ. Code § 1798.140).

The sole purposeof this collection is to generate AI images resembling you for your own business social media posts. We do not use your biometric data for identity verification, advertising targeting, analytics, or model training, and we do not sell, lease, trade, or profit from it (740 ILCS 14/15(c); Tex. Bus. & Com. Code § 503.001(c)).

How your data is processed and who sees it

  • Your photos are stored in a private storage bucket accessible only to your account and our image generation pipeline. No other customer can access them.
  • When generating a post, your photos are transmitted to OpenAI, Inc. via their images API. OpenAI retains API inputs, including images, for up to 30 days for abuse monitoring, after which they are deleted from OpenAI’s systems. OpenAI does not use API inputs to train its models.
  • Because our application and storage are hosted on Supabase and Vercel, those providers necessarily process this data as our infrastructure vendors. Neither has any right to use it for their own purposes.
  • No other third party receives your photographs or derived face geometry. In particular, they are never sent to Meta, Google, or any advertising or analytics provider.

Retention schedule and destruction policy (740 ILCS 14/15(a))

This is our publicly posted biometric data retention and destruction schedule:

  • Your photos and derived face geometry are retained only while your account is active and you have not deleted them.
  • You may delete individual photos, or delete all photos and revoke consent, at any time via the “Delete all & revoke consent” control in Business Details settings. Deletion from our active storage is immediate and permanent.
  • Upon account closure, all photos and derived biometric data are permanently deleted within 30 days.
  • Encrypted infrastructure backups may retain copies for up to 30 days after deletion before rotating out. These backups are not accessible to our staff in the ordinary course and are never used to generate content or restore deleted photos.
  • In no event will we retain your biometric data for longer than 1 yearafter the purpose for collection has been satisfied (Tex. Bus. & Com. Code § 503.001(c)(3)) or 3 years from your last interaction with LocalPop (740 ILCS 14/15(a)), whichever is sooner.

Consent and withdrawal

We collect biometric data only after you provide an explicit written release through an in-app consent screen presented before any photo upload, in compliance with 740 ILCS 14/15(b) and Tex. Bus. & Com. Code § 503.001(b). We record a server-side timestamp of your consent at the time it is given.

You may withdraw consent at any time using the “Delete all & revoke consent” control in your settings. Withdrawal stops all future use of your likeness and triggers immediate deletion of your photos. It does not retroactively affect posts already generated and published.

AI-generated content — disclosure responsibility

Images generated using your likeness are AI-generated synthetic content. When you publish AI-generated images depicting real persons on social media, you may be responsible for disclosing that the content is AI-generated, both under platform rules and under emerging law. We recommend labeling such posts, for example with “#AIGenerated” or “Made with AI.”

Illinois residents — BIPA compliance statement

In compliance with the Illinois Biometric Information Privacy Act (740 ILCS 14): (1) we inform you in writing of the specific purpose and the length of term for which your biometric identifier is collected, stored, and used, before collection (§ 15(b)(1)–(2)); (2) we obtain a written release executed via electronic signature before collection (§ 15(b)(3), as amended by P.A. 103-769); (3) we do not sell, lease, trade, or profit from your biometric identifier or biometric information (§ 15(c)); (4) we do not disclose or disseminate biometric data without consent except as described above or as required by law (§ 15(d)); and (5) we protect biometric data using the same or greater standard of care as our other confidential information (§ 15(e)).

Deletion requests

To request deletion of your biometric data, use the in-app deletion control, visit our contact page, or email privacy@localpopstudio.com. We will confirm deletion in writing within 10 business days.

9. Data Retention and Deletion

We retain your information for as long as your account is active, or as needed to provide the service. When your account is deleted:

  • Your account, business information, uploaded images, and connected social account tokens are permanently deleted within 30 days
  • Photographs and derived biometric data are deleted on the schedule in Section 8
  • Generated content is deleted. Content already published to your social accounts remains there and is under your control
  • Encrypted infrastructure backups rotate out within 30 days of deletion
  • Payment and tax records are retained for 7 years as required by law, and records needed to resolve disputes or enforce agreements are retained as long as necessary for that purpose

Account deletion is handled by our team. Email privacy@localpopstudio.com or use the contact page, and we will verify your identity and confirm completion in writing.

10. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights. We extend the core rights below to all of our U.S. customers regardless of state.

  • Know and access. Request confirmation of whether we process your personal information, the categories involved, and a copy of it.
  • Correct. Ask us to fix inaccurate personal information. Most of this you can edit yourself in your portal.
  • Delete. Request deletion of your personal information, subject to the legal retention exceptions in Section 9.
  • Portability. Receive your information, and download your generated content, in a usable format.
  • Opt out of targeted advertising. See Your Privacy Choices.
  • Limit use of sensitive information. Withdraw biometric consent as described in Section 8.
  • Non-discrimination. We will not retaliate against you for exercising any of these rights.

How to make a request

Email privacy@localpopstudio.com or use our contact page. We will acknowledge your request within 10 business days and respond substantively within 45 days, and we will tell you if we need a permitted extension. To protect your account we will verify your identity, usually by confirming control of the email address on the account.

Authorized agents. You may designate someone to make a request on your behalf. We will ask for proof of their authorization and may still ask you to verify your own identity.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing legal@localpopstudio.com with “Privacy Appeal” in the subject line. We will respond within 45 days. Depending on your state, you may also complain to your state Attorney General.

11. Email Preferences

You can unsubscribe from marketing emails using the link in any such email, or by emailing us. Transactional and service emails — receipts, content-ready notices, security and account notices — are part of the service and cannot be unsubscribed from while your account is active.

Replies to many of our emails are routed back into a conversation thread with our team, so your reply content is stored with your account record.

12. Data Security

We maintain administrative, technical, and physical safeguards designed to protect your information, including:

  • Encryption of data in transit using TLS, and encryption at rest by our hosting providers
  • Salted password hashing; we never store passwords in readable form
  • Row-level access controls so one customer cannot reach another’s data
  • Restricted internal access, granted only to staff who need it
  • Rate limiting and automated abuse detection

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any required regulators without unreasonable delay and within the timeframes required by applicable state law.

13. Children’s Privacy

Our service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact privacy@localpopstudio.com and we will delete it.

14. Changes to This Policy

We may update this policy from time to time. We will change the “last updated” date above, and for material changes we will notify you by email or through the service before the change takes effect. Your continued use after a change takes effect constitutes acceptance of the updated policy.

15. Contact Us

Privacy questions and rights requests: privacy@localpopstudio.com

General support: support@localpopstudio.com or our contact page

Legal notices and privacy appeals: legal@localpopstudio.com