1. Information We Collect
Information you provide directly. When you create an account or use SherpasAI, you may provide your name, email address, business/brand information, payment details, and any content you submit (text, images, brand assets).
Information we collect automatically. When you use our service, we collect usage data such as pages visited, features used, device type, browser type, IP address, and timestamps.
Information from connected social media accounts. When you connect a Facebook Page or Instagram Business account to SherpasAI, we receive the following from Meta on your behalf:
- Your Facebook user profile information needed to authenticate (name, email)
- Facebook Page ID, name, category, and Page access token for each Page you choose to connect
- Instagram Business Account ID, username, profile picture, and access token for each Instagram account you choose to connect
- Post content (text, media, captions), publishing status, and post-level engagement metrics (impressions, reach, likes, comments, saves, shares, video views) for content you publish through SherpasAI or that you ask SherpasAI to analyze
- Aggregated account-level insights (follower count, profile views) when you have granted the corresponding permissions
We only request the Meta permissions necessary for the features you use, and we only access data for Pages and Instagram accounts you have explicitly connected.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the SherpasAI service
- Generate AI-assisted social media content based on your brand inputs
- Publish content to your connected Facebook Pages and Instagram Business accounts on your behalf, at your direction
- Retrieve and display post-level analytics and insights from Meta so you can review the performance of your content
- Process transactions and send transactional notices (account, billing, security)
- Respond to support requests and improve the service
- Send optional marketing communications, which you may opt out of at any time
We do notuse data obtained from Meta’s Graph API to build user profiles for advertising, nor do we sell or share Meta-derived data with data brokers.
3. Data Sharing and Third-Party Service Providers
We do not sell your personal information. We share data only with service providers that help us operate SherpasAI, and only to the extent necessary for them to perform their services. These providers are bound by confidentiality and data protection obligations.
Categories of service providers we use:
- Hosting and infrastructure— Railway (application hosting and PostgreSQL database)
- File and image storage— Supabase (encrypted file storage)
- AI content generation— OpenAI and Anthropic (text and image generation; prompts and brand context are sent to generate your content but are not used by these providers to train their models in our default configuration)
- Authentication— Vantage Method SSO (identity and session management)
- Social platforms— Meta (Facebook and Instagram), only for the purpose of publishing or retrieving the content and insights you have authorized
- Payment processing— Stripe (if you subscribe to a paid plan)
We may also disclose information when required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (in which case you will be notified).
4. Data Security
We protect your information using industry-standard safeguards, including:
- 256-bit encryption for data in transit (TLS) and at rest
- AES-256-GCM encryption of all access tokens received from Meta and other connected services, stored in our database with a separately managed encryption key
- Role-based access controls and audit logging
- Regular security reviews
No method of transmission or storage is 100% secure, but we work to protect your information using current best practices.
5. Data Retention
We retain your information for as long as your account is active or as needed to provide the service:
- Account data (profile, brand inputs): retained for the lifetime of your account, deleted within 30 days of account deletion
- Connected social account credentials (access tokens, page/account IDs): retained until you disconnect the account in SherpasAI or delete your account, after which they are removed within 7 days
- Generated content and drafts: retained for the lifetime of your account
- Post insights and analytics: retained for up to 24 months after the post date so you can review historical performance
- Audit logs and security records: retained for up to 12 months
- Backups: residual copies in encrypted backups are purged on a rolling 30-day cycle
When you delete your account or disconnect a social platform, we revoke the corresponding tokens with the platform and remove the associated data from our active systems within the windows above.
6. Your Rights and Choices
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information
- Delete your personal information and your account
- Disconnectany connected Facebook Page or Instagram Business account at any time from SherpasAI’s account settings, which revokes the corresponding access tokens and removes the data we hold for that connection
- Export a copy of your data in a portable format
- Opt out of marketing communications
To exercise any of these rights, email us at support@vantagemethod.com from the email address associated with your account, or use the in-app account settings. We will respond within 30 days.
How to delete data obtained from Meta
SherpasAI stores data from your connected Facebook Page(s) and Instagram Business account(s). To delete this data:
- In-app: Go to Settings → Connected Accounts and click Disconnect on any Facebook Page or Instagram account. This revokes the access token with Meta and removes the stored credentials, post records, and cached insights for that connection within 7 days.
- By email: Send a request to support@vantagemethod.com with the subject line “Data Deletion Request” and include the email address on your SherpasAI account and the Facebook/Instagram account name(s) you want removed. We will confirm deletion within 30 days.
- From Facebook:You can also revoke SherpasAI’s access from your Facebook account at Settings → Business Integrations, or from your Instagram account at Settings → Apps and Websites. Once revoked, we are notified by Meta and remove the associated data within 7 days.
See our Data Deletion Instructions page for the standalone version of these instructions.
7. Children’s Privacy
SherpasAI is not intended for use by children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact support@vantagemethod.com and we will delete it.
8. International Data Transfers
SherpasAI is operated in the United States. If you access the service from outside the U.S., your information will be transferred to, stored, and processed in the U.S. We rely on appropriate safeguards (such as Standard Contractual Clauses where applicable) for transfers from the EEA, UK, and Switzerland.
9. Cookies
We use cookies and similar technologies to enhance your experience, analyze usage patterns, and deliver personalized content. You can manage your cookie preferences through your browser settings.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised “last updated” date.
11. Contact Us
For privacy questions, data requests, or to exercise any of the rights described above:
We aim to respond to all privacy inquiries within 30 days.