Privacy Policy

1. Introduction

Welcome to Eshu Relay, a product of Auterah Systems — a business name registered with the Corporate Affairs Commission (CAC) of Nigeria. We are committed to protecting your personal information and your right to privacy.

This Privacy Policy explains what information we collect, why we collect it, how we use it, and what rights you have over it. It applies to all users of our website (eshurelay.cloud), our WhatsApp publishing service, and any associated features we offer.

By using Eshu Relay, you agree to the practices described in this policy. If you disagree with any part, please discontinue use of the service.

2. Information We Collect

We collect only what is necessary to provide the service. Here is a breakdown of what we collect and why:

a. Account Information

When you create an account, we collect your:

• Full name
• Email address
• Password (hashed and managed securely by Clerk — we never see your raw password)
• WhatsApp phone number (when you link it to your account)

b. Social Media Credentials

When you connect a social media account (Facebook Page, Instagram Business, TikTok, YouTube), we receive and store OAuth access tokens on your behalf. These tokens are encrypted at rest and are used exclusively to publish content you authorise. We do not use them to read your followers, direct messages, or personal profile information beyond what is strictly required for publishing.

c. Content Data

We process text messages, images, videos, and voice notes you send to our WhatsApp Business number for the purpose of publishing to your connected platforms. Voice notes are transcribed using AI (OpenAI Whisper). This content is stored as part of your post history.

d. Usage Data

We collect standard usage information including:

• Post history and publishing timestamps
• Connected platform status and activity logs
• IP address and device type (for security purposes)
• Browser or client type

e. Payment Information

All payments are processed by Stripe, Inc. Eshu Relay does not store or have access to your credit or debit card numbers. We only store your Stripe Customer ID and your current subscription status (Free or Pro) to manage your access to the service.

f. AI Processing Data

When you use the AI Caption Generator, the text or topic you provide is sent to Groq, Inc. and/or OpenAI, LLC for processing. Voice notes are sent to OpenAI Whisper for transcription. We share only the content you submit — not your name, email, or other personal identifiers.

3. How We Use Your Information

We use your information to:

• Create and manage your account
• Publish content to your connected social platforms on your behalf
• Generate AI-optimised captions from your prompts or voice notes
• Process subscription payments and manage your plan
• Send transactional emails (account confirmation, payment receipts, service alerts)
• Monitor for abuse, security threats, and policy violations
• Improve the service using anonymised, aggregated analytics only

We do not sell your personal data to third parties. We do not use your content for advertising targeting. We do not share your data with anyone except as described in Section 4.

4. Third-Party Services

To provide the service, we work with the following trusted third-party providers. Each processes your data only to the extent necessary to fulfil their role:

• Meta Platforms, Inc. — WhatsApp Business API, Facebook Graph API, Instagram Graph API. Used to receive your messages and publish content to Facebook and Instagram.
• Stripe, Inc. — Payment processing. Handles all billing securely and PCI-compliant.
• Groq, Inc. / OpenAI, LLC — AI caption generation and voice transcription. Only content you submit for processing is shared.
• MongoDB, Inc. — Database hosting via MongoDB Atlas. Your account and post data is stored in encrypted Atlas clusters.
• Clerk, Inc. — Authentication and identity management. Manages your login credentials and session security.
• Vercel, Inc. — Website and serverless function hosting.
• Hostinger — Backend server infrastructure.

5. Data Storage & Security

Your data is stored on servers managed by Vercel, Hostinger, and MongoDB Atlas. We apply industry-standard security measures including:

• Encryption of OAuth tokens at rest
• TLS/HTTPS encryption for all data in transit
• Access controls limiting who can access production data
• Environment variable-based secret management (no secrets in source code)

While we take security seriously, no system is 100% secure. Please use a strong, unique password and contact us immediately at hello@eshurelay.cloud if you suspect unauthorised access.

6. Cookie Policy

Eshu Relay uses cookies sparingly and only for essential functions. We do not use advertising cookies, analytics tracking cookies, or any third-party marketing cookies.

Essential Cookies

These are required for the service to function:

• Authentication session cookies — set by Clerk to keep you signed in. These expire when you sign out or after a period of inactivity.
• Theme preference — stored in localStorage (not a cookie) to remember your dark/light mode choice. This stays on your device and is never sent to our servers.

Because we use only essential cookies, no cookie consent banner is displayed. If we introduce non-essential cookies in the future, we will update this policy and seek your consent where required by law.

7. Your Rights

You have the following rights regarding your personal data. To exercise any of them, email us at hello@eshurelay.cloud. We will respond within 14 business days.

• Right to Access. You may request a copy of all personal data we hold about you.
• Right to Delete. You may request deletion of your account and all associated data. Email us with the subject line "Delete My Account" and we will complete deletion within 30 days, except where legal obligations require retention.
• Right to Disconnect Social Accounts. You can disconnect any connected platform at any time from your dashboard Settings page. Upon disconnection, the associated OAuth token is deleted immediately.
• Right to Export. You may request an export of your post history (content, platform, status, timestamps) in CSV or JSON format.
• Right to Correction. If any information we hold is inaccurate, you can update it in your account settings or contact us.
• Right to Object. You may object to processing of your personal data for any purpose beyond delivering the core service.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the service:

• Account data — retained until you delete your account.
• Post history — retained while your account is active; deleted upon account deletion.
• OAuth tokens — deleted immediately upon platform disconnection or account deletion.
• Payment records — Stripe retains transaction records as required by financial regulations. We retain your Stripe Customer ID for billing continuity.
• System logs — IP addresses and access timestamps are retained for up to 90 days for security monitoring, then deleted.

9. Children's Privacy

Eshu Relay is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us at hello@eshurelay.cloud and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top and notify active users via email or dashboard notification. Your continued use of the service after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

For questions, concerns, or data requests related to this Privacy Policy: