Privacy Policy

2026-10-30

Last updated: October 30, 2026

This policy explains what personal data Sizzy Labs, Inc. ("Sizzy Labs," "we," "us" or "our") collects through Sizzy, our website and our iPhone app, what we do with it, and the choices you have.

The short version:

1. Who we are

Sizzy Labs, Inc. is responsible for your personal data under this policy.

Sizzy Labs, Inc. [COMPANY ADDRESS] hello@sizzy.ai

EU representative: [EU REPRESENTATIVE NAME AND ADDRESS]

UK representative: [UK REPRESENTATIVE NAME AND ADDRESS]

2. Our two roles

For your account, our website and our own business, we decide how personal data is used. We are the "controller" under European law and a "business" under US state laws. This policy covers that data.

For personal data about other people in what you upload, such as customers or staff in your photos, your business decides how it is used. We handle it for you as your "processor" or "service provider," under Annex A of our Terms of Service. Your business is responsible for its own notices and permissions. If you are one of those people, see Section 14.

3. What we collect

Account details. Your name, email address and language, your password (stored only as a salted hash), and how you sign in.

Sign-in through Facebook or Apple. If you use Facebook, we get your Facebook user ID, name, email address and profile picture. If you use Apple, we get an Apple user ID and the name and email you choose to share, which can be Apple's private relay address.

Business details. Your business name, type, website, city and time zone, and your brand kit: logos, colors, fonts and how you like your brand to sound. We also keep your team members' names, email addresses and roles.

Photos and videos. What you add to your Gallery or send in chat. These can show people, places and products. When you add a photo, we resize it and save it again, which removes location and camera details from the file. We store videos as you upload them, so any details inside a video file stay in it.

Messages and instructions. Your chats with Sizzy, your notes, your change requests, your Routines, and the things Sizzy remembers in What Sizzy knows. These can include anything you write, including the names of people.

What Sizzy makes. Drafts and each version of them, captions, edited photos, new pictures, ideas, and the status of each post.

Connected Instagram and Facebook accounts. See Section 7.

Payment details. When paid plans open, Stripe will handle payments on our website and Apple will handle purchases in the iPhone app. They collect your card details. We never see or store full card numbers. We keep your plan, its status and dates, and the customer or transaction IDs they give us.

Records of what you agreed to. Which version of the Terms you accepted, and when.

Usage and device data. For each signed-in session, we store your IP address, your browser or device type and the session's dates. We keep records of actions in your account (for example, who approved a post and when), how much AI use each item took, and technical logs of requests and errors. Our server logs are set to hide passwords, tokens, email addresses and phone numbers.

Messages to us. If you write to us, we keep your email address and what you say.

Waitlist. If you join our waitlist, we collect your email address, how you found us (UTM tags and the website that sent you), your language, which version of this policy was shown, and when you joined. We use your IP address briefly to limit repeated attempts, and we don't save it with your entry.

Phone numbers. Sizzy doesn't ask for a phone number today. If we add phone verification or messaging, we will update this policy first.

You choose what to give us. You are not legally required to give us any of this. Without your account details and your content, though, we can't provide Sizzy. Connecting Instagram or Facebook is optional, but Sizzy can't publish for you without it.

4. Why we use it, and our legal bases

If European or UK law applies to you, we rely on the legal bases shown here.

Where we rely on consent, you can withdraw it at any time by writing to us. That won't affect anything we did before you withdrew it.

5. How AI works in Sizzy

Sizzy is an AI. No person is writing to you in chat or designing your posts. We use third-party AI models to do this work.

What goes to our AI providers. To do each job, we send the provider what that job needs:

We don't add your email address, password, payment details or Meta access tokens to these requests. Anything you type into a message or show in a photo does go to them, so please leave out anything sensitive.

Training. We don't use your content to train AI models. The current API terms of Anthropic and OpenAI say that they don't train their models on data sent through their APIs unless a customer chooses to allow it. We don't choose to allow it.

How long AI providers keep it. Their published terms say that they keep API data for up to about 30 days to run their services and watch for abuse. They may keep it longer if it is flagged for breaking their rules or if the law requires it.

No face recognition. We don't run face recognition on your photos, and we don't create face templates or use your photos to identify anyone. Our AI looks at an image to design around it, for example to keep words off a face.

Automated decisions. Sizzy's AI makes creative choices, such as which photo to use, what to write and when to suggest posting. It doesn't make decisions that have legal or similarly significant effects on you. If you set a Routine to Posts on its own, Sizzy publishes without asking you first, because you chose that. You can change that setting at any time.

Seeing and fixing what Sizzy remembers. You can see what Sizzy remembers in What Sizzy knows, add to it, or tell her to forget something. You can ask for changes to any draft.

6. Who we share it with

We don't sell personal data, and we don't share it for targeted advertising.

Service providers. These companies process data for us, under contracts that require them to protect it and use it only to provide their services to us, in line with this policy.

In use today:

Planned, not yet in use. We will update this list before any of these receives your data:

Meta and Apple, at your direction. When you sign in with them, connect an account, publish a post or buy through the App Store, data goes to them as you asked. Once it reaches them, their own privacy policies apply. Posts you publish are public.

Your team. People on your business's account can see its content, chats and drafts, and each other's names and email addresses.

Our team. A small number of people at Sizzy Labs can access customer data when they need to, for example to provide support, fix a problem, handle a request from you, or investigate abuse.

Legal and safety reasons. We may share data if we believe the law requires it, or to protect the rights, safety or property of you, us or others. We report child sexual abuse material to the authorities.

Business changes. If we are part of a merger, financing, acquisition, reorganization or sale of assets, data may transfer as part of that deal. We will tell you if your data becomes subject to a different policy.

Aggregated information. We may use and share information that has been combined or de-identified so that it can't reasonably identify you.

7. Instagram, Facebook and Meta data

If you connect Instagram or Facebook, or sign in with Facebook, we receive data from Meta through its platform ("Meta Platform Data").

What we receive: your Facebook user ID, name, email address and profile picture; your Instagram account ID and username; your Facebook Page ID and name; the permissions you granted; access tokens; and information about your account and posts, such as post IDs and links, follower counts, reach, likes, comment counts, saves, shares, views and when your followers are online. If you use a feature that learns from your past posts, we also read those posts. On plans with the accounts-you-watch feature, we read public stats of the accounts you pick.

How we use it: to sign you in, connect your accounts, publish what is approved, show you results, pick good times to post, shape your drafts, enforce the one-trial rule and keep your connection working. Your Instagram username and details of your posts can reach Anthropic as Section 5 describes.

What we don't do: we don't sell, license or buy Meta Platform Data. We don't use it for targeted advertising, to build profiles of people, or to make decisions about anyone's eligibility for anything. We don't use it to train AI models.

Tokens. We store access tokens encrypted, and we never send them to the apps or to AI providers.

Your choices. You can remove Sizzy's access at any time in your Facebook or Instagram settings. That stops us from getting new data, but it doesn't delete what we already have. To have that deleted, follow our data deletion page. We delete Meta Platform Data promptly when you ask, when you no longer have an account with us, or when we no longer need it for a legitimate business purpose.

8. Cookies and analytics

Cookies we use. We use only the cookies the website needs to work:

The iPhone app keeps your sign-in token in your phone's secure Keychain.

Analytics and ads. We don't use analytics tools, advertising pixels or cross-site trackers on our website or in the iPhone app today. We don't use your data for tracking across other companies' apps or websites. If we add analytics or advertising tools, we will update this policy first and ask for your consent where the law requires it.

Google Fonts. Our website loads fonts from Google's servers, so your browser sends your IP address to Google when a page loads. Google's privacy policy applies to that.

Do Not Track and Global Privacy Control. Because we don't sell or share personal data or track you across sites, we don't change what we do when we get these browser signals.

9. How long we keep it

We keep personal data only as long as we need it for the reasons in this policy.

We may keep data for longer if the law requires it or if we need it for a legal claim.

10. How we protect it

We use safeguards that fit a small company handling this kind of data:

No system is perfectly secure, and we can't promise that yours will never be affected. We don't hold a security certification such as SOC 2 or ISO 27001. If a breach affects your personal data, we will tell you and the authorities where the law requires it. Keep your password safe, and tell us right away if you think your account has been compromised.

11. Where your data goes

Our servers are in the United States. Our team works from Israel and can access data from there to run and support Sizzy. Our service providers may process data in the United States and other countries.

If you are in the EU, EEA, UK or Switzerland, your data will be handled in countries that may have different data protection laws. The European Commission and the UK have recognized Israel as providing adequate protection. For transfers to the United States and other countries without such a decision, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum to them, or on the provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where that applies. You can ask us for a copy of these safeguards at hello@sizzy.ai.

12. Children

Sizzy is for adults running businesses. You must be at least 18 to use it, and we don't knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to hello@sizzy.ai and we will delete it. If a business uploads a photo that shows a child, that business is responsible for having the required permission from a parent or guardian.

13. Your rights

Everyone. Wherever you live, you can ask us to show you the personal data we hold about you, correct it, delete it, or give you a copy. Email hello@sizzy.ai from the email address on your account. We may need to confirm that it's you. We aim to answer within 30 days. We won't treat you worse for asking. Some requests have limits, for example when the law requires us to keep something.

If you're in the EU, EEA, UK or Switzerland, you also have the right to restrict or object to how we use your data, including objecting to anything based on legitimate interests, and to data portability. You can object to direct marketing at any time. You can withdraw consent at any time. You have the right to complain to your local data protection authority. In the UK, that is the Information Commissioner's Office. You can also complain to us at hello@sizzy.ai. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

If you're in California or another US state with a privacy law, you may have the right to know what we collect and how we use it, to access, correct and delete it, to get a portable copy, and to opt out of the sale of personal data, targeted advertising and certain profiling. We don't do any of those three things. You can use an authorized agent, and we may ask the agent for proof. If we turn down your request, you can appeal by replying to our answer, and we will respond within 60 days. If your appeal is denied, you can contact your state attorney general.

For California, in the past 12 months we have collected these categories, from you, your devices and the services you connect:

We use and disclose these for the purposes in Sections 4 and 6. We have not sold or shared them, as California's law defines those words, and we don't use sensitive personal information to infer anything about you. We keep each category as Section 9 describes. We have no actual knowledge of selling or sharing the data of anyone under 16.

California residents can also ask once a year whether we shared personal data with third parties for their direct marketing. We don't.

If you're in Israel, you have the right under the Privacy Protection Law, 5741-1981, as amended by Amendment 13, to review personal data we hold about you and to ask us to correct or delete it if it's wrong, incomplete, unclear or out of date. You can complain to the Privacy Protection Authority. Section 3 explains that giving us your data is voluntary and what happens if you don't. Sections 4 and 6 explain why we use it and who gets it.

14. If you're in a photo or on someone else's account

Business owners upload photos and videos, and those can show other people. Sizzy processes them for that business. If you see yourself in a post, or want a photo of you removed, please ask the business first, because it controls its posts and its Gallery. If you can't reach them, write to hello@sizzy.ai, tell us which business and which content, and we will help. We can't remove posts from Instagram or Facebook. For that, you can also use Meta's reporting tools.

If you're on a team, the owner of the business's account controls its content. If you leave the team or ask us to delete your data, we will remove your login. Things you wrote or made for the business may stay with the business.

15. Waitlist and marketing email

If you join our waitlist, we use your email address to tell you when Sizzy opens and to send news about it. If you're a customer, we may email you about features and offers, where the law allows.

Every marketing email has an unsubscribe link and our postal address. If you unsubscribe, we will stop within 10 business days. We will still send messages about your account, such as receipts, security notices and changes to our terms.

16. Changes to this policy

We may change this policy. The date and version are at the top. If a change is material, we will tell you by email or in Sizzy before it takes effect. If we want to use your personal data in a way that is materially different from what this policy says, we will ask for your consent first where the law requires it.

17. Contact us

Questions, requests or complaints go to hello@sizzy.ai, or to Sizzy Labs, Inc., [COMPANY ADDRESS].