Privacy Policy

The data controller for personal data processed through SherpaPost is Clarity and Confidence Academy Ltd, EIK 205736702, VAT BG205736702, 25, Kniaz Dondukov Korsakov Street, 5000 Veliko Turnovo, Bulgaria. Contact for privacy matters: privacy@sherpapost.app.

Account data — email address, authentication identifiers, and (if you sign in with Google) your name and profile picture as provided by Google.
Profile data — display name, username, affiliate link name, avatar and your saved timezone.
Content — text, images and video you upload to create drafts and previews, and campaign material you generate in the app.
Voice data — if you use Sherpa Dictate, the audio you record is sent for transcription and the resulting text is saved to your voice notebook (most recent 30 notes). Audio is not kept after the transcript is produced.
Usage data — request logs, error logs, credit and campaign usage counters, and approximate device/browser information needed to operate and secure the service. Our support team can see per-account usage counts only (campaigns created, regenerations, credits used, last active date) under the contract legal basis — never your titles, drafts or the text of your content.
Referral data — if you arrive through an affiliate link, we store which link you came from so purchases can be attributed, and (if you take part in the affiliate programme) your payout details.
Product-update emails — sent only if you opt in on the What's new page, in Settings → Account & data, or via the one-click consent link in a SherpaPost email (consent basis, timestamped and revocable at any time).
Billing data — handled by Stripe; we receive payment and subscription status and limited metadata, not full card details.

We process your data under the following legal bases:
• Contract — to provide the service you signed up for (account, drafts, previews, billing).
• Legitimate interests — to keep SherpaPost secure, prevent abuse, debug issues, and improve the product.
• Consent — for optional analytics or marketing cookies, where applicable. You can withdraw consent at any time.
• Legal obligation — to comply with tax, accounting, and other laws.

When you use Magnetise, Campaign Studio, Clean & Translate or another AI feature, the text you submit is sent to the Lovable AI Gateway, which routes the request to a third-party AI provider (currently Google or OpenAI models). When you record in Sherpa Dictate, your audio is sent to a speech-to-text provider through the same gateway. We do not use your prompts, content or recordings to train models. Providers process the request only to generate the response. Don’t submit content you’re not comfortable sending to an AI provider.

We share personal data only with processors that help us run SherpaPost, under data processing agreements:
• Supabase (database, authentication, file storage) — EU region where possible.
• Cloudflare (hosting, CDN, edge runtime).
• Stripe (payments and billing).
• Lovable AI Gateway and underlying providers (Google, OpenAI) for AI features and voice transcription.
• Resend (transactional and account emails, sent from mail.sherpapost.app).
• ActiveCampaign (product-update emails — your address is added only if you opt in, and removed when you opt out or delete your account).
• GoHighLevel (funnel checkout and order handling for purchases made through our ad landing pages).
We do not sell your personal data.

Some processors are based outside the EU/EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and provider-specific Data Processing Addenda.

• Account and profile data: kept while your account is active.
• Drafts and uploaded media: kept until you delete them or close your account.
• Voice notes: the most recent 30 transcripts per account; older ones are removed automatically. Audio recordings are not stored after transcription.
• Referral and commission records: kept while needed to calculate and evidence payouts, then for the period required by tax law.
• Billing records: kept for the period required by tax law (typically up to 10 years in Bulgaria).
• Logs: kept for a short retention window for security and debugging (typically up to 90 days).
When you delete your account, we delete or anonymize your personal data within a reasonable period, except where law requires us to retain it.

Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw any consent you have given. You can update your profile and marketing preferences from your account settings at any time.

To request deletion of your account and associated personal data, or to exercise any other data-subject right, email privacy@sherpapost.app from the address on file. We will confirm your identity and complete the request within 30 days, except where law requires us to retain specific records (for example, invoices for tax purposes). You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or the supervisory authority in your EU country.

We use industry-standard measures including TLS encryption in transit, encryption at rest, role-based access controls, and database-level row-level security to protect your data. No system is perfectly secure; please use a strong, unique password.

SherpaPost is not directed at children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy from time to time. We will post the updated version here and adjust the “last updated” date. Material changes will be communicated in-app or by email where appropriate.