Privacy Policy

Last Updated: July 17, 2026

1) Who we are

• Controller: The Social Media Posse LLC
• Mailing address: 3556 S 5600 W #1-478, Salt Lake City, UT 84120, United States
• Privacy contact: privacy@influencerbutler.com
• General contact: hello@influencerbutler.com

We are a small US-based independent software vendor. The Software is a desktop application that runs on your computer; the supporting cloud endpoints we operate are minimal in scope (licensing, transactional email, feedback) and are described below.

2) What we collect, and where it goes

We organize our data practices by destination, because most of what the Software touches never leaves your device. The three categories below are exhaustive - if it isn't listed here, the Software does not collect it.

2.1 Local-only: never leaves your device

The following data is processed entirely on the device on which you run the Software and is never transmitted to us or to any third party unless you explicitly export, share, or sync it:

• Workspace settings, templates, brand lists, message drafts, and campaign keywords.
• Screenshots, generated images, and any media you author inside the Software.
• Browser session cookies for the third-party platforms you automate (Amazon, Instagram, YouTube, TikTok, Reddit, Telegram, Levanta, Archer, Logie). These are isolated per-site Chromium profiles stored under your operating-system user-data directory.
• Your AI provider API keys (OpenAI, Ideogram, FAL AI, etc.), stored in an AES-256-GCM-encrypted credential store under the same user-data directory.
• Diagnostic logs, telemetry traces, and engine state files.

If you choose to export a .ibworkspace bundle, copy log files manually, or sync your user-data directory through OneDrive / iCloud / Dropbox / Google Drive, that data leaves the local-only scope. From that point forward, the terms of the service you use to move or store the data apply, and Company has no visibility into or control over it.

2.2 Sent to our servers (Cloudflare Workers, R2)

We operate three Cloudflare Workers that handle a small, well-defined set of data flows:

• Email address → licensing Worker: magic-link sign-in, license lookup, transactional email (lawful basis under GDPR Art. 6: contract performance).
• License key → licensing Worker: tier enforcement, seat counts, and license activation status - whether your license is active and when it last checked in (contract performance).
• Device fingerprint (a one-way SHA-256 hash of OS and hardware identifiers; the raw identifiers never leave your device) → licensing Worker: per-device activation, anti-piracy, suspicious-login alerts (legitimate interest in license enforcement and account-security alerting).
• License usage counters (message-send counts, tier-gated feature usage) → licensing Worker: tier-cap enforcement, billing reconciliation (contract performance).
• Feedback, feature requests, community Q&A submissions → feedback Worker: product improvement, public Q&A on the website (consent - you actively submit).
• Outbound deep-link rewrites and post-tap analytics → links Worker: affiliate link resolution (legitimate interest).
• Update-feed requests for update manifests (latest.yml / latest-mac.yml) and installer blobs (.exe on Windows; .dmg / .zip on Mac) → our release hosts (dl.influencerbutler.com, Cloudflare R2, for Windows; influencerbutler.influencerbutler.com for Mac): auto-update delivery (contract performance).

We do not receive: the contents of your messages to third-party platforms, your platform credentials, your AI provider API keys, the contents of your workspace bundles, your screenshots, or any cookies beyond the magic-link auth cookie issued by our own Worker.

2.3 Sent to third-party processors acting on our behalf

We contract with the following sub-processors. Each acts under written agreement and processes only the data needed to deliver its part of the Software.

• LemonSqueezy, Inc.: payment processing, subscription management, customer-portal hosting. Receives your billing details and transaction history. We do not receive or store full payment-card numbers. Their privacy practices: lemonsqueezy.com/privacy.
• Resend (Bounce, Inc.): transactional email delivery. Receives your email address and the message body of magic-link emails, new-device login alerts, onboarding messages, and per-Butler issue notifications. Their privacy practices: resend.com/legal/privacy-policy.
• Cloudflare, Inc.: infrastructure for the licensing / feedback / links Workers and for dl.influencerbutler.com (CDN + R2 object storage). Processes request metadata (IP address, user-agent, request headers) for transport-layer security and abuse mitigation. Their privacy practices: cloudflare.com/privacypolicy.
• AI providers you enable (OpenAI, Ideogram, FAL AI, and any others you add) - when you enable an AI feature and supply your own API key, the Software calls that provider directly from your device under your account. Company has no visibility into or contractual relationship with the provider on your behalf; the provider's privacy policy applies to whatever you send.
• DeepLink / smart-link providers you connect (GeniusLink, URLGenius, Linktw.in) - if you turn on "single redirect" (smart-link) marketplace links and connect one of these services with your own account, the Software sends the destination product URL (a tagged Amazon link) to the provider you chose so it can mint a country-routing short link. Company has no contractual relationship with the provider on your behalf; the provider's own privacy policy governs what it does with that data. If you leave this feature off, or use "off" or "country links" mode, no such request is made.
• Influencer Butler branded links (our own service) - if you choose Influencer Butler as your link provider (a paid feature), the Software sends the destination product URL (a tagged Amazon link) to our links service at links.influencerbutler.com to create a short, branded link. When someone clicks that link, we record the click (time, approximate country from the network, referring site, and device type) against an anonymized owner identifier derived from a one-way hash of your license key, so we can show you a Link Performance dashboard. We do not store your raw license key alongside links or clicks, and we do not sell this data. If you use a different provider, or "off" or "country links" mode, no such request is made.
• Google LLC (Google Analytics 4 / gtag.js): only on the influencerbutler.com website, and only with your prior consent via the cookie banner. Receives standard GA4 event data (page views, referrer, anonymized IP). The desktop application does not contain Google Analytics or any comparable third-party analytics library.

We do not sell or "share" (as defined by CCPA/CPRA) your personal data to any third party for cross-context behavioral advertising, and we do not use your data to train AI models.

2.4 Affiliate links and how the Software helps you earn

Influencer Butler is an affiliate-marketing tool. When you build a product link (for example the "copy my link" action or a scheduled post), the Software creates an Amazon affiliate link tagged with your own Amazon Associates account or storefront handle, the one you enter in settings, so that qualifying purchases earn a commission that Amazon pays to you. The Software does not use its own or the Company's affiliate tag, does not substitute a different tag, and does not take a share of your commissions. If you have not set a tag, the link is left untagged.

If you connect an optional smart-link or affiliate-network provider (see §2.3), your tagged link may be sent to that provider to create or shorten it. You are responsible for the affiliate disclosures your own audience and the law (for example the U.S. FTC) require. Where the Software publishes content on your behalf, it appends your configured disclosure (such as "(AD)") to help.

3) Cookies and analytics on the website

The influencerbutler.com marketing website uses Google Analytics 4 (gtag.js, measurement ID G-S1TC1QLYNN) to understand aggregate visitor traffic. GA4 sets cookies including _ga and _ga_<id> with a 14-month default retention.

We use Google Consent Mode v2 with all consent signals defaulted to denied. Before you make a choice on the cookie banner, gtag.js sends pinged "consent denied" beacons that do not store identifying cookies. After you choose:

• Accept all: analytics_storage is set to granted; standard GA4 cookies are set; aggregate analytics flow.
• Reject non-essential: the default-denied state persists; no analytics cookies are written.

You can change your choice at any time from the cookie policy page or by clearing localStorage.ibConsent in your browser. The desktop application does not load gtag.js or any other website-style analytics script.

3.1 Trial-click notifications

When you click a "Start Free Trial" or download button on the website, our server records standard request metadata: your IP address, the approximate location (city, region, and country) our hosting provider derives from it, your browser user-agent, the page you clicked from, your browser language, and the time. We email this information to our team so we are aware of trial interest and can follow up. The lawful basis is our legitimate interest in understanding and responding to demand for the Software (GDPR Art. 6(1)(f)). We send this internal notification through Resend (see §2.3); we do not sell or "share" this data, and we do not use it for advertising or AI-model training. To avoid duplicate notifications, the website sets a single first-party cookie, ib_trial_ping, which expires after one hour and stores nothing beyond a flag that a notification was already sent for your visit.

3.2 Recent-activity widget

On the homepage we may display a small "recent activity" popup showing genuine recent events: for a trial click, the approximate city/region it came from and how long ago; for a purchase, the buyer's first name, approximate city/region, and how long ago. It never shows your IP address, full name, email, or any contact detail, and only summarizes events from a short recent window. The lawful basis is our legitimate interest in conveying genuine demand for the Software (GDPR Art. 6(1)(f)). An administrator can hide any individual entry, and you can dismiss the popup for your session.

4) How we use information

We use the data described in §2 to:

• Provide, operate, maintain, and update the Software.
• Authenticate you and enforce per-device seat counts.
• Process your subscription and issue / renew your license.
• Send you transactional email (sign-in links, new-device alerts, onboarding, issue notifications).
• Respond to support requests and incorporate your feedback into product decisions.
• Comply with legal obligations and enforce our agreements (including chargeback defense and anti-piracy).

We do not use your data for advertising, profile-building, or model training.

5) GDPR / EEA / UK rights

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights with respect to your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion, subject to our retention obligations under §7.
• Restriction: pause our processing while we investigate a dispute.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: for processing that relies on consent (analytics, feedback submissions), at any time.
• Lodge a complaint with your local supervisory authority.

To exercise any of these rights, email privacy@influencerbutler.com from the address associated with your license. We will respond within 30 days (extendable by 60 days for complex requests, with notice). Lawful bases for processing under GDPR Article 6 are listed inline in §2.2.

6) CCPA / CPRA rights (California residents)

If you are a California resident, you have the following rights:

• Right to know what categories of personal information we collect, the sources, the business purposes, and the third parties with whom we share it (the answer is in §2).
• Right to delete your personal information, subject to the retention exceptions in §7.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of, but we will honor Global Privacy Control (GPC) signals on the website as a "Do Not Sell or Share" request.
• Right to non-discrimination: we will not deny service, charge different prices, or provide a different level of service because you exercised a CCPA right.

To exercise these rights, email privacy@influencerbutler.com. We will verify your identity by confirming control of the email address associated with your license.

7) Data retention

• License records (email, license key, tier, activation status/timestamps): life of the account + 24 months.
• Device-activation logs (fingerprint + timestamp): 90 days, then aggregated into anonymized counts.
• Transactional email metadata (Resend logs): 30 days.
• Feedback / feature-request / Q&A submissions: indefinite (these inform product roadmap); displayed Q&A becomes part of the public knowledge base unless you request removal.
• Website analytics (Google Analytics 4): 14 months (GA4 default).
• Secure-store contents (API keys, cookies, etc.): never transmitted; persist on your device until you uninstall the Software or delete the user-data directory.
• Crash and diagnostic logs (local): 30 days rolling, locally only.

After the retention period, records are either deleted or irreversibly anonymized.

8) Security

We protect personal data with reasonable administrative, technical, and physical safeguards, including AES-256-GCM encryption for credentials stored on your device, TLS 1.2+ for all traffic between the desktop application and our Cloudflare Workers, code-signed installers and signature-verified auto-updates, tight file permissions on the secure-store directory, and least-privilege Worker bindings.

No system is perfectly secure. If we become aware of a security incident materially affecting your personal data, we will notify you without undue delay and at the latest within 72 hours, consistent with GDPR Article 33 and applicable state breach-notification laws.

9) International transfers

Personal data we collect is processed in the United States (LemonSqueezy, Resend, our Cloudflare account home region) and in Cloudflare's global edge network, which may process request metadata in any region where Cloudflare operates.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, transfers of your personal data outside those regions are protected by the Standard Contractual Clauses (SCCs) adopted by the European Commission, which are included in our data-processing agreements with LemonSqueezy, Resend, and Cloudflare.

10) Children

The Software is a business productivity tool intended for adults operating as content creators or small-business owners. It is not directed to children under 16 (or under 13 in the United States), and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, email privacy@influencerbutler.com and we will delete it.

11) Changes to this Policy

We may update this Privacy Policy as the Software evolves. When we make a material change, we will revise the "Last Updated" date and bump the PRIVACY_VERSION constant in the desktop application, which causes the next launch to display a re-acceptance prompt asking you to agree to the updated policy. For non-material changes (typos, formatting, address updates), we may post the change without a re-acceptance prompt.

12) Contact

For privacy questions, requests, or complaints:

The Social Media Posse LLC
Attn: Privacy
3556 S 5600 W #1-478
Salt Lake City, UT 84120
United States
privacy@influencerbutler.com