Data we store
We store the data required to deliver the product: your account, the brand and audience context you teach the system, the generations you produce, and the messages in your threads. We do not train general foundation models on your content.
| Category | What | Retention |
|---|---|---|
| Account | Email, hashed password or OAuth identifier, name. | Until account deletion. |
| Brand + audience | Uploaded documents, extracted context, voice rules. | Until you delete the record. |
| Generations | Image/video/speech outputs and associated prompts. | Soft-deleted for 30 days, then purged. |
| Chat + threads | Marketing Assistant transcripts + memory. | Persistent; memory GC rolls off inactive items after 365 days. |
| Billing | Stripe customer record + credit ledger. | As required by tax/accounting law (7 years). |
Auth and isolation
Authentication is handled by Better Auth with either email/password or OAuth (Google, GitHub). Sessions are cookie-based with cross-subdomain scope for marketing + app. Row-level security is enforced at the database layer so users can never see another tenant's data — even if an app-level bug tried to query across tenants.
- Email/password plus OAuth SSO (Google, GitHub) via Better Auth.
- Postgres row-level security FORCE on user, session, account, verification, brand, and generation tables.
- Session cookies are HTTP-only and secure-flagged in production.
- API routes are gated at the middleware layer; unauthenticated requests to app paths 307 to login.
Encryption + transport
Traffic between your browser and the app is TLS. Data at rest in Postgres is encrypted by our hosting provider. Generated assets (images, videos, audio) live in a private object-store bucket and are served only via short-lived signed URLs through an authenticated streaming route — never a raw public link.
- TLS in transit (HTTP Strict Transport Security enabled).
- Provider-level encryption at rest for database and object storage.
- Signed URLs for asset access, 60-second expiry on re-sign, ownership check per request.
AI providers
MITPO orchestrates multiple underlying AI providers. Your prompts and the assets you generate are sent to the provider you select in the model picker (or the default for your plan). We do not share data between providers beyond what is required to fulfill the specific generation you requested.
Incident response
If a security incident occurs, we notify affected users within the timeline required by applicable law (generally 72 hours for material incidents). Ongoing status is published to the legal page and, for widespread incidents, to the landing banner.