Privacy Policy

Silma · Last updated: July 25, 2026

Silma ("we", "us", "our") is operated by Joonas Soininen, based in the United States. This policy describes how we collect, use, and protect your personal data when you use silma.app and related services. It applies to all users regardless of location. We are committed to complying with applicable privacy laws including the EU General Data Protection Regulation (GDPR) for users in the EU/EEA.

1. Information we collect

Account information: Email address, name, and profile image when you sign up via Google OAuth or email/password.

Content you submit: Instagram Reel and TikTok URLs you submit, video frames extracted from videos you upload for Pre-Check analysis, AI-generated analysis results, and content suggestions.

Brand profile: Niche, target audience, content pillars, tone, differentiator, and any brand document (PDF or text) you upload voluntarily.

Chat messages: Conversations with our AI assistant (Chroma) are stored to provide context across sessions.

Watchlist data: Competitor account handles you add to your watchlist and the associated content analysis results.

Content history: Ideas you save, mark as posted, and outcome ratings you log.

Payment information: Processed securely by Stripe. We never store your card details.

Device identifier: A non-persistent device identifier generated in your browser to prevent multi-account abuse on the free tier. This identifier is not shared with third parties.

Usage data: Feature usage counts, submission timestamps, and error logs for service reliability.

2. Legal basis for processing (GDPR)

We process your personal data under the following legal bases:

Performance of contract: Account creation, delivering analysis results, powering the AI assistant, processing brand profile data, and managing your subscription.
Legitimate interest: Sending lifecycle and onboarding emails, measuring product usage via analytics, and enforcing fair use limits and abuse prevention. These interests are balanced against your rights and do not override them.
Legal obligation: Retaining records required by applicable law (e.g. billing records).

Where we rely on legitimate interest, you have the right to object. See Section 7 for how to exercise your rights.

3. How we use your information

To provide and improve the Silma service
To analyze content you submit using AI and return results to you
To generate personalized content suggestions based on your brand profile
To power the Chroma AI assistant and maintain conversation context
To process payments and manage your subscription
To send transactional and lifecycle emails (onboarding, usage milestones). You can unsubscribe at any time via the link in any email.
To measure product usage via anonymized analytics
To enforce fair use limits and prevent abuse

We do not use your data to train AI models. Your content is sent to our AI provider solely to generate results for you.

4. Third-party service providers

We share data with the following categories of service providers only as necessary to operate the Service. All providers are contractually required to protect your data and process it only for the purposes we specify.

AI processing (Anthropic): Content you submit and video frames are sent to Anthropic's Claude API to generate analysis and chat responses. Anthropic processes this data under their own privacy policy and API terms.
Payment processing (Stripe): Handles all billing and subscription management.
Public content data provider: Reel URLs are sent to a third-party service to retrieve publicly available metadata from social platforms.
Authentication provider: Manages sign-in, sign-up, and session tokens on our behalf.
Cloud infrastructure and storage provider: Hosts the application and stores files on encrypted cloud storage.
Database hosting provider: Hosts our database in a secure, encrypted environment.
Email delivery provider: Delivers transactional and lifecycle emails on our behalf.
Product analytics provider: Receives anonymized usage events. No personally identifiable content is included in these events.
Web analytics (Google Analytics): Measures traffic to our public website. It sets cookies in your browser only if you accept analytics cookies; before that it runs with storage denied and sends only an anonymous, cookieless page-view signal. Either way Google receives your IP address, which it uses to derive an approximate location. It is not used on signed-in application pages. See section 10.

We do not sell your data to third parties.

5. International data transfers

We are based in the United States. If you are located in the EU/EEA or another jurisdiction with data transfer restrictions, your personal data will be transferred to and processed in the United States and potentially other countries. For EU/EEA users, we rely on appropriate transfer mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) where required. By using the Service you acknowledge that your data may be processed in countries outside your own.

6. Data retention

Video frames (Pre-Check uploads): Deleted automatically within 48 hours of upload.
Analysis results, chat history, brand profile: Retained for the duration of your account.
Reel videos and thumbnails: Retained for the duration of your account. You can delete individual reels at any time.
Billing records: Retained for up to 7 years as required by applicable law.
Account deletion: Upon request, all personal data is deleted within 30 days, except where retention is required by law.

7. Your rights (GDPR)

If you are in the EU/EEA, you have the following rights. Contact us at support@silma.app. We will respond within 30 days.

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate or incomplete data.
Right to erasure: Request deletion of your account and all associated personal data.
Right to data portability: Request your data in a structured, machine-readable format.
Right to restrict processing: Request that we pause processing of your data.
Right to object: Object to processing based on legitimate interest.
Right to unsubscribe: Opt out of lifecycle emails at any time.

You also have the right to lodge a complaint with the data protection authority in your country of residence. EU/EEA residents can find their national authority at edpb.europa.eu.

8. Data security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), hashed API keys, signed access tokens, and encrypted session management. Stored data is encrypted at rest by our infrastructure providers.

9. Data breaches

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, and notify affected users without undue delay where required by Article 34.

10. Cookies

In the Service itself we use essential cookies only, specifically an httpOnly session cookie for authentication.

On our public website we additionally use analytics cookies, set by Google Analytics (named _ga and _ga_<id>) and by our product analytics provider, to measure visits and distinguish returning visitors.

No cookie is set until you accept. On your first visit we ask. If you decline, or simply never answer, no analytics cookie is written and no session recording happens. Your choice is remembered in your browser, and you can change it at any time by clearing site data for silma.app, which brings the banner back.

The two providers behave differently before you answer, and we would rather spell that out than round it off:

Our product analytics provider (which also records sessions) is not loaded at all. Nothing is sent.
Google Analytics is present on the page but runs in Google's Consent Mode with storage denied, so it writes no _ga cookie and cannot recognise you across visits. It does send Google an anonymous, cookieless signal that a page was viewed, including your IP address, which Google uses to derive an approximate location. Accepting turns on the cookie; declining leaves it permanently off.

These are analytics cookies, not advertising cookies: we do not run advertising cookies, we do not use Google Analytics for ad personalization or remarketing, and we do not sell this data.

11. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email. Continued use of the Service after changes constitutes acceptance.

13. Contact

For privacy-related inquiries or to exercise your rights: support@silma.app