Privacy Policy

At Semurai, the protection of personal data for our clients and potential clients is of utmost importance. This Privacy Policy outlines our principles regarding the processing of personal data, including the purpose of data collection, legal grounds, and the rights of individuals whose personal data is processed.

Data Controller

The data controller for your personal data is Prixamo Sp. z o. o., Al. Powstańców WLKP 80/5, 64-920 Piła, Poland ("Semurai" or "Administrator"), VAT ID: PL7642694901.

You can contact us via:

Contact form: semur.ai/contact-us
Traditional mail: Prixamo Sp. z o. o., Al. Powstańców WLKP 80/5, 64-920 Piła, Poland

Legal Basis and Purposes for Data Processing

Your personal data will be processed for the following purposes:

Contract Performance: To enter into and perform a service agreement with you based on your registration - legal basis: Art. 6(1)(a) of the General Data Protection Regulation (GDPR).
Payment Processing: To facilitate payment transactions and charge you for services provided by us.
Legal Compliance: To fulfill legal obligations, including those specified in the Act on the Consideration of Complaints by Financial Market Entities and the Financial Ombudsman (the "Complaint Act") - legal basis: Art. 6(1)(c) of GDPR.
Marketing Communication: To send commercial information to your provided email address, in accordance with your consent - legal basis: Art. 6(1)(a) of GDPR.

Sources of Personal Data

Semurai processes personal data obtained through:

Direct Provision by Users: Data provided by the user via the Semurai website.
Email and Postal Correspondence: Communication to or from the person to whom the data pertains.
Telephone Contact: Phone communications to or from the person to whom the data pertains (phone calls may be recorded, and an appropriate message precedes the connection to our helpline).
Third Parties: Data acquired from third parties to whom you have given consent to transfer your data to Semurai for marketing purposes.

Data from Facebook and Instagram (Meta)

When you connect a Facebook Page or an Instagram professional account to Semurai, you authorize Semurai to access certain data through the Meta APIs (Facebook Login for Business and Instagram API with Instagram Login). We access only the data covered by the permissions you grant, and only to provide the features you use.

What we access and store

Facebook: your Facebook user ID and name; the Pages you manage (Page ID, name, category and profile picture) and Page access tokens; the IDs, links and publication times of posts you publish through Semurai; the number of reactions, comments and shares and the insights (such as views and clicks) of those posts.
Instagram: your account ID, username, name, account type, profile picture and the number of followers and posts; the list of recent media, used to confirm that a post was published; the IDs and links of posts you publish through Semurai; the number of likes and comments and the insights (views, reach, saves, shares and interactions) of those posts.

We do not read your private messages or the content of comments, and we do not access your ad accounts.

Why we use it

We use this data to publish and schedule the posts you create or approve, to show which Pages and accounts are connected, to show post statistics in Semurai Analytics and, when you ask them to, to let Semurai AI agents use these statistics to plan and evaluate your content. The legal basis is the performance of our agreement with you (Art. 6(1)(b) GDPR).

Sharing and security

We do not sell data obtained from Meta and we do not use it for advertising or profiling. We share it only with service providers that process it on our behalf to run Semurai (hosting and AI model providers), under contracts that require them to protect it. Access tokens are stored encrypted, and all data is transmitted over encrypted connections.

Retention and deletion

We keep access tokens and account data for as long as the Page or account is connected to Semurai.
When you disconnect a Page or account (Settings, Integrations, Disconnect), we delete its access tokens and account data immediately and cancel its scheduled posts.
You can also remove Semurai on Facebook (Settings and privacy, Settings, Business integrations) or on Instagram (Settings, Apps and websites). Meta then notifies us, and if the account is still connected to Semurai, we delete its access tokens, account data and the post statistics we obtained from Meta. Statistics of accounts you disconnected earlier stay in your workspace until you delete the project or your Semurai account, or ask us to delete them through the contact form. After a data deletion request you receive a confirmation code and a link where you can check its status.
You can request deletion at any time through the contact form at semur.ai/contact-us. Deleting your Semurai account removes all data obtained from Meta.

Our use of data received from Meta complies with the Meta Platform Terms and Developer Policies.

Your Rights Regarding Personal Data Processing

Individuals whose data is processed have the right to: request correction, deletion, transfer, or restriction of processing of personal data; object to the processing of personal data, including profiling; lodge a complaint with the supervisory authority responsible for personal data protection, which in the U.S. context would typically be the Federal Trade Commission (FTC).

In cases where the processing of personal data by the Administrator is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the legality of the processing that took place on the basis of the consent before its withdrawal, nor does it affect the ability to process personal data to the extent necessary to comply with a legal obligation or to establish, pursue, or defend claims.

Data Retention Period

Personal data will be retained by the Administrator until the purpose of data processing is fulfilled or until you request the deletion of data, object to further data processing, or withdraw consent for data processing - unless further processing is required by applicable law (e.g., for compliance with legal obligations or for the defense of claims by the Administrator). However, the Administrator will strive to ensure that personal data is not processed for longer than 5 years.

Semurai may entrust the processing of personal data to other entities. Such entities may include service providers who perform services for Semurai (IT services, advisory and legal services, or marketing agency services).

Semurai may use a process known as "profiling" to optimize your experience as a user and to offer services that best meet your individual needs and interests. We utilize various computer algorithms to analyze different aspects of your behavior while using our website and application. This data may include your behavior while using the website, your use of our application, data collected through cookies, and the personal data you provide. The primary goal of profiling is to provide you with personalized offers, both within our website and through marketing initiatives conducted by Semurai. This may include displaying personalized offers and advertisements directly on our website, direct marketing via email, SMS/MMS, telephone marketing, and remarketing on other websites you visit.

Data Security

Semurai implements and uses multiple modern security measures to ensure the safety of using the website available at semur.ai. Data collected during registration and on contact forms is protected through encryption using the SSL protocol, thereby reducing the risk of data acquisition or modification by unauthorized persons.

All operations on personal data are carried out only by authorized persons. As a data controller, Semurai ensures that cooperating entities provide guarantees of using appropriate measures to secure personal data and that Semurai's employees and collaborators have the necessary knowledge and experience, including training in personal data protection.