Privacy Policy

What data we collect

When you use Madala Machine, we collect and process the following categories of data on your behalf:

• Account information you provide: your name, email address, project details, brand voice settings, and any other profile information you choose to enter.
• OAuth credentials for connected platforms: when you connect external accounts (YouTube, TikTok, Instagram, Facebook, LinkedIn, X, and any other platforms you choose), we receive and store encrypted access tokens that allow us to publish content and retrieve analytics on your behalf. These tokens are encrypted at the application layer before they touch our database, and they are never stored or transmitted in plaintext.
• Content you create or upload: posts, captions, images, videos, scheduled content, and any metadata you attach to that content (tags, descriptions, show links, ticket calls-to-action).
• Engagement analytics from connected platforms: we fetch and store performance data from your connected social accounts across YouTube, TikTok, Instagram, Facebook, LinkedIn and X, including post reach, impressions, likes, comments, shares, saves, follower counts, audience demographics, and video view metrics. This data is used to surface insights and reporting within Madala Machine.
• Data we receive from Meta: when you connect a Meta account, we receive the Facebook Pages and Instagram business accounts you choose to grant us, together with their profile details, the posts published to them, and the insights Meta provides for those Pages, accounts and posts, including reach, impressions, engagement and audience demographics. Where you grant access to an ad account, we also receive its campaign structure, spend and delivery metrics so that advertising spend can be reconciled against ticket sales and post performance. We request only the permissions needed for these features, we act only within the scopes you grant, and we never use Meta data for advertising targeting, for resale, or for any purpose other than showing you your own results inside Madala Machine.
• Ticket sales reports you forward in: when you (or your ticketing partners) forward box-office reports to a dedicated Madala Machine ingest email address, we parse the attached report and store the resulting sales figures against the correct show in your project. Only recognised senders you have allow-listed are accepted.
• Advertising receipts and campaign data: for projects that run paid social, we store campaign metadata and spend, both as retrieved from a connected ad account and as taken from receipts or PDFs you upload, so that spend can be reconciled against sales and impressions.
• Usage data: which features you access, actions you take within the platform (for example, scheduling a post, generating a caption, or reviewing analytics), and when you log in. This is used to improve the product and diagnose issues.

How we store and protect your data

All data is stored in a managed backend environment powered by Lovable Cloud. Our database is encrypted at rest and protected by Row Level Security (RLS), which ensures that your data is only accessible within the project and user boundaries you define. Even within our own infrastructure, no engineer can arbitrarily browse user data outside of their authorised project scope.

• Encryption: OAuth tokens for connected platforms are encrypted with a symmetric application key before being written to the database. The encryption key is managed within the same secure infrastructure and is never exposed to application logs or client-side code.
• Row Level Security: every table in our database has RLS policies enforced. This means your content, tokens, and analytics are logically isolated from other projects and users at the database level. Cross-project queries return no results.
• Infrastructure: Lovable Cloud provides the underlying database, authentication, and storage services. The infrastructure is hosted across multiple regions with automated backups, point-in-time recovery, and strict access controls.
• No third-party sale or sharing: we do not sell, rent, or trade your data to advertisers, data brokers, or any third party. We do not use your content to train external AI models without your explicit consent.

How we use your data

• To operate the platform: scheduling posts, publishing on your behalf to the platforms you have connected, displaying analytics dashboards, and sending weekly or periodic digests.
• To parse forwarded ticket sales reports and attribute them to the correct show in your project.
• To improve the platform based on aggregate usage patterns and feature adoption. This analysis is always performed on anonymised or aggregated datasets where possible.
• To send you transactional emails about your account, scheduled posts, or actionable alerts (for example, a failed publish or a token that needs refreshing).
• To comply with legal obligations or respond to lawful requests from government authorities where required by South African law.

We do not use your data for behavioural advertising and we do not build profiles about you for sale to third parties.

Data we share

We only share data in the following limited circumstances:

• Platforms you explicitly connect: when you connect YouTube, TikTok, Instagram, Facebook, LinkedIn or X, we share content and publishing instructions with those platforms so that posts can appear on your accounts. We only act within the OAuth scopes you grant during connection.
• We do not share with advertisers, brokers, or analytics aggregators. Your data is not monetised through resale or sublicensing.

Service providers

We use a small number of service providers to run Madala Machine. Each one processes data only on our instruction and only for the purpose listed.

• Lovable Labs Incorporated (Lovable Cloud): application hosting and managed backend infrastructure.
• Supabase Inc.: PostgreSQL database and file storage.
• Postmark, a product of ActiveCampaign, LLC: transactional and notification email delivery.

Where a client connects a Meta account, data we receive from Meta is stored and processed by the same providers listed above and is never sold or shared for advertising purposes.

Requests from public authorities

Where we receive a request from a government body, regulator or law enforcement agency for personal information, we review the legal basis for that request before responding. We disclose only the minimum information necessary to satisfy a lawful request. We keep a written record of each request we receive, our response, and the reasoning behind it. Where we believe a request is unlawful or overbroad, we will challenge it. Where the law permits us to do so, we will notify the affected user.

Messaging and WhatsApp

• Madala Machine helps you write messages to the people you work with, such as call sheets for your musicians and replies to booking enquiries.
• Today those messages are opened in your own email client or your own WhatsApp and sent by you, from your own address and your own number. We do not send them for you, and the content of those messages is not transmitted to us or to any messaging provider by the app.
• If you choose to connect a WhatsApp Business account in future, we will store the access token encrypted, and we will send only the messages you instruct us to send, on your behalf and from your own number. We will never message your clients or your team without your instruction, and we will never use your contacts or message content for marketing, for training, or for any purpose other than delivering the message you asked for.
• Phone numbers you store for your team and your clients are business contact details you are responsible for holding lawfully, and they are used only to reach those people about your work.

Cookies and tracking

• We use cookies strictly for authentication and session management. These are essential for the platform to function, they keep you logged in and protect against cross-site request forgery.
• We do not run advertising or analytics pixels on this domain. We do not use third-party advertising cookies or analytics scripts that follow you across the web.
• We do not participate in cross-site tracking or behavioural profiling, and we do not sell or share your data with data brokers or analytics aggregators.

Your rights

Under South African data protection principles and the terms of our service, you have the following rights:

• Access: request a copy of all data we hold about you and your projects at any time.
• Correction: update inaccurate or incomplete information through the platform settings.
• Deletion: delete your account and all associated data. Upon deletion, your content, tokens, and analytics are permanently removed from our systems within 30 days, except where retention is required by law. Full step by step instructions are on our Request Data Deletion page.
• Portability: export your data in a structured, machine-readable format (JSON) for transfer to another service.
• Revocation: disconnect any linked platform at any time from the Settings page. Disconnecting immediately deletes the stored token and stops all publishing and data syncing for that platform, and we ask the platform to revoke the token where it supports revocation. You can also revoke our access directly from the platform's own settings at any time.

To exercise any of these rights, email us at info@madalamachine.com. We acknowledge requests within 48 hours and complete them within 30 days.

Data retention

• We retain your data for as long as your account is active and you have connected platforms or scheduled content.
• When you delete your account, we initiate a purge of all personal data, content, and tokens within 30 days. Some aggregated, anonymised metrics may be retained for platform integrity and billing reconciliation, but these cannot be linked back to you.
• Where legal obligations require longer retention (for example, tax or audit records), we retain only the minimum necessary data and secure it under the same encryption and access controls.

Children

Madala Machine is not intended for users under the age of 16. We do not knowingly collect data from children. If you believe a child under 16 has provided us with personal information, please contact us at info@madalamachine.com and we will delete the information promptly.

International transfers

Madala Machine is operated from South Africa and our primary data storage is hosted in regions covered by Lovable Cloud. Where platform integrations require data to be processed outside South Africa (for example, when publishing to Meta, TikTok, YouTube, LinkedIn or X servers in the United States or Europe), this transfer is necessary to perform the service you requested and is governed by the terms of those platforms.

Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated to you by email or through a prominent notice in the platform at least 14 days before they take effect.

Governing law

This Privacy Policy is governed by the laws of the Republic of South Africa. Any dispute arising from it will be resolved in the courts of the Western Cape.

Contact