Privacy Policy

Amity Net AS, org. no. 936 792 383, is the controller for personal data described in this Privacy Policy, unless we expressly state that we act as processor for a business customer.

• Account data: name, username, email address, mobile phone number, and plan details. For business profiles we also collect the business name, organisation number, and website. Sirqit does not use passwords. You sign in with one-time codes sent by SMS or email.
• Profile data: display name, bio, profile picture, website, language, and whether your profile is public or private.
• Content you create: posts, captions, photos, videos (including their sound), comments, likes, follows, hashtags, mentions, drafts, scheduled posts, link-in-bio pages, and discount codes.
• Direct messages and the files you attach to them.
• Connected accounts: the name and identifier of each social-media account you connect (Meta/Facebook/Instagram, Google/YouTube). The OAuth tokens are held by our publishing processor and are used only to publish content on your behalf and to show the connection status.
• Text you send to the AI writing assistant: the keywords or draft you choose to send, so that suggestions can be generated. We log only usage counts, not the text.
• Device and technical data: the push notification token for your device, an installation identifier used to deliver app updates, IP address, and server logs. To protect SMS sign-in against abuse we store hashed values of phone numbers and IP addresses.
• Reports and moderation data: reports you submit or that concern you, including a copy of the reported content.
• Payment data: purchases are made on sirqit.app through Stripe. We receive the subscription status and a customer reference, never your card number. The Sirqit apps have no in-app purchases.
• Support data: emails, support requests, and feedback you send us.

Photos and videos can contain metadata added by your device, such as the time and place they were taken. Remove location data from a file before you upload it if you do not want to share it.

We do not use analytics, advertising, or crash-reporting tools from third parties in the Sirqit apps, and we do not track you across apps or websites owned by other companies.

• Your name, username, profile picture, bio, and public posts are visible to other users. If you make your profile private, people who do not follow you see less of it.
• Videos are streamed through links that are not access controlled. Anyone who has the link can play the video. Do not post sensitive material in videos.
• Direct messages are visible only to the people in the conversation. They are encrypted in transit but not end-to-end encrypted. We may review a message when it is reported to us.
• Your link-in-bio page and the discount codes you publish are public.

• To provide, secure, maintain, and improve the service.
• To sign you in and manage your account, subscriptions, and billing.
• To publish content, run the feed, messages, and link-in-bio pages, and to send notifications.
• To moderate content, handle reports, and prevent abuse, fraud, and unlawful activity.
• To communicate with you about service changes, account issues, legal notices, and product updates.
• To comply with legal obligations and enforce our Terms and policies.

Where GDPR or similar law applies, we process personal data where necessary to perform a contract with you, to comply with legal obligations, for our legitimate interests in operating, moderating, and securing the service, or on the basis of consent where required. Where we rely on legitimate interests, we consider the impact on your rights and expectations.

We share personal data only with the sub-processors necessary to deliver the service:

• Supabase (Ireland, EU region): database, authentication, file storage, and server functions.
• Vercel: web hosting and delivery.
• Mux (USA): video processing and streaming.
• PettersonApps: data processor that runs the publishing pipeline between Sirqit and connected social-media platforms. It receives only the content, media links, and account identifiers needed to publish the post you start.
• GatewayAPI (EU): sends SMS sign-in codes.
• Resend (USA): sends sign-in codes and service emails.
• Anthropic (USA): generates suggestions in the AI writing assistant. It receives only the text you send to the assistant, without your name or user ID, and does not use it to train models.
• Expo, Apple, and Google (USA): deliver push notifications and app updates.
• Stripe: processes payments made on sirqit.app.
• The connected social-media platforms themselves (Meta, Google), only when you have connected the account and only with the content you choose to publish.

When you look up a business by organisation number, the number is sent to the public register of the Brønnøysund Register Centre.

We may also share data with professional advisers, with authorities where required by law, and in connection with a merger, financing, restructuring, or sale of all or part of our business.

We never sell your personal data.

Some sub-processors are based in the USA. For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified, or on the EU standard contractual clauses.

We keep personal data for as long as your account exists and as needed to provide the service. When you delete your account, your profile is hidden and you are signed out at once. Your personal data and content are deleted within 30 days.

Some data is kept longer: closed reports are deleted after 12 months, and the copy of reported content is removed when the account that owned it is deleted. Payment records are kept for five years as required by the Norwegian Bookkeeping Act. OAuth tokens are kept only while the connection is active and are deleted within 30 days after you disconnect an account or revoke access at the provider.

You can delete your account in the app under Profile, Settings, Delete account, on the web at sirqit.app under Profile, or by emailing us from the address on your account. Seesirqit.no/delete-account.

Sirqit is not intended for children under 16, and you must be at least 16 to create an account. We do not knowingly collect personal data from children under 16. If we learn that a child under 16 has an account, we delete it. Parents or guardians can contact us at the address below. Read ourchild safety standards.

Depending on where you live, you may have the right to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent where processing is based on consent. You can download a copy of your data in the app under Settings. You may also have the right to complain to a supervisory authority (in Norway: Datatilsynet).

The website and apps store your sign-in session and settings on your device. We do not use advertising or analytics cookies.

When you connect your Google/YouTube account, Sirqit accesses Google user data through the YouTube Data API in order to upload videos to your channel and read your channel and video statistics. Sirqit requests only the scopes strictly necessary for these actions: youtube.upload, youtube.readonly, and youtube.

We protect this data with the following mechanisms:

• Encryption in transit over TLS/HTTPS and encryption at rest in our database.
• Access controls: Google user data is accessible only to the authenticated account owner and is isolated per user via row-level security.
• Secure token storage: OAuth access and refresh tokens are stored encrypted and are never exposed to the client or any third party.
• No selling or advertising use: we do not sell Google user data and do not use it for advertising or to train AI or machine-learning models.
• Deletion: you can disconnect your YouTube account at any time, which revokes our access; on account deletion, all associated Google user data and tokens are removed within 30 days.

You can revoke Sirqit’s access to your Google account at any time from myaccount.google.com/permissions or from your Sirqit settings.

Sirqit’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Privacy questions and rights requests can be sent to: post@sirqit.no.